{ "Event": { "published": true, "date": "2023-10-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-08", "timestamp": 1696809781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "51f0533d-76d1-4c4a-bd3c-84d0fe4d8f7b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1aaf432-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696793775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793775, "uuid": "6e5e8d2c-28bc-46a3-aa2c-42cd1094a44d", "comment": "Malware payload (RedLineStealer)", "value": "364fffd35c4678f753f84ef43f40a79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793775, "uuid": "682d3cf3-ef93-411c-b64c-8b5db6fef0cf", "comment": "Malware payload (RedLineStealer)", "value": "032193e925a37c96849c9b3de93ac44aada334a3da9c0c4b98384b78b0163c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793775, "uuid": "ae726ba1-3493-458d-a956-1c92111a5251", "comment": "Malware payload (RedLineStealer)", "value": "f609a865b94a99cd00849289484f4ba89743bdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793775, "uuid": "5393a7f6-2056-4d44-9cc1-54c9fa74cec3", "comment": "Malware payload (RedLineStealer)", "value": "09c16d144f15b647211de32a91285fe25478b6054f5d725c532bbb76c75b3e842f4c4a623fde4506d3b25653d03e4169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793775, "uuid": "27b73c06-c071-497a-81cd-03f08474cc2e", "value": "T161452303EAED8030D9A5173159F707871F31FCE298389B6A23646AA51DB3E58943937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793775, "uuid": "cc4c3b4e-e67f-49b4-9a7f-9e1510559292", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793775, "uuid": "6093c169-bd52-4b18-b8ba-039c5fd7fc7d", "value": "24576:nysWp8oaHUycEpPPxZRiLwW8fiBuYJGerehaD0ZSDyw:ysroaHbcKHxZRiLwWIaJDehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793775, "uuid": "2546c9ef-aedb-469c-a645-1c9c6416c457", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793775, "uuid": "bf9cc0a0-df28-4764-b8bc-3d72f4e16a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793775, "uuid": "d100d427-281e-4285-ba13-1687defeaeb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff32228-65a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696745910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745910, "uuid": "2280bf6d-7556-4af1-85a5-f2417db5f49c", "comment": "Malware payload (RedLineStealer)", "value": "68b779b5bf333c1cf5405d8c8d70ae32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745910, "uuid": "80366fb9-a9ca-4946-a25a-fac906cd39d0", "comment": "Malware payload (RedLineStealer)", "value": "040bb4a3060c84f340fc23f76b0f2cf49a706a4ce0317bd2242cd998c04d6116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745910, "uuid": "f58821f9-e915-4cfe-a1dd-e5f7740f093d", "comment": "Malware payload (RedLineStealer)", "value": "75bef6918bb9945f6adbf78b8ac3772908d3bfd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745910, "uuid": "15275b4e-739b-43c6-9d5d-0647dac5d878", "comment": "Malware payload (RedLineStealer)", "value": "a2bf0188c7a927f037f98a99354693d0d3d66c00efc328ac5a6e6212df45054b78615874a01786e96ccdd7b60da08209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745910, "uuid": "743ecfff-9b8b-476b-9af5-155587380b40", "value": "T163352342EBD84172C6B46F70A0F606C30F39FDA16DB8161B37469E6F4D62984B832736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745910, "uuid": "c6789afa-524f-4126-be22-f158472860be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745910, "uuid": "4d7d2a50-511d-4776-b96d-d46bdbc8fe35", "value": "24576:WyJitJqWI0rOnJzMdNfgt5I52Nd/IXwun8Ia8W7K:lJitJqZ02zMngt5IMgXwe8Iat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696745910, "uuid": "cc2b4d29-c75d-438b-a2b1-06b793eb014b", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696745910, "uuid": "689354a3-ba29-40b8-9bd0-e23c30f1c856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745910, "uuid": "5804556a-704d-4d76-a174-ce08d98d83b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1334678e-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773644, "uuid": "be60bdf0-5331-4c32-8585-b94859fd12ad", "comment": "Malware payload (Mirai)", "value": "c67bbf0da81c6defdbc3b35e8496b262", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773644, "uuid": "c4a6388c-2eb8-43c9-a39f-cc5f59b6ebb7", "comment": "Malware payload (Mirai)", "value": "045746383513c143992e22dbb116f7a63e3a68644978f8b5a8e9aa40f6802863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773644, "uuid": "033b4ef3-309a-4edf-a5f4-6e7487bb17cf", "comment": "Malware payload (Mirai)", "value": "349de78acf5a6d927aa25da8393f660f4d3eb1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773644, "uuid": "a4cba0e3-2544-4a0c-9971-bc22cecd6e9d", "comment": "Malware payload (Mirai)", "value": "c9547ea70f4d6dabbe6cc39dc52ac6f969e1c3f14db2b78a0ee6c34c1ffdc4a8450eae37d8e06d5b85fbe18c31435830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773644, "uuid": "7cccd764-6ea4-4428-a953-4d29d4fced46", "value": "T10D63F6753945F2ACD6E94078F4436EE91E1209283EDCD1E36087143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773644, "uuid": "af6921e5-a93a-4f69-a2ec-8ebfa827d762", "value": "1536:BWq4mXBnUM+mxqIKaHIZVBIVCCfy0K9Uaq:dUM+/IOun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773644, "uuid": "e1fb1b05-ddd9-4d22-a7b7-67e868012311", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773644, "uuid": "8d4884b6-a67a-4016-9052-4be695efb8d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773644, "uuid": "3c3eb5c8-80f8-4eb3-bf1b-0a32550edf14", "value": "c67bbf0da81c6defdbc3b35e8496b262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1692bb-65fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696783784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783784, "uuid": "9c0b9d9f-df80-4b03-9186-347d822e83f0", "comment": "Malware payload (RedLineStealer)", "value": "f7288b0323aa546cad0a33d03057e72b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783784, "uuid": "9702463b-0006-4bfa-ab3f-aa2d2dd8ec63", "comment": "Malware payload (RedLineStealer)", "value": "07768d69935659882305b38997347211d64142c640ffceeeb4bba13eb130179e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783784, "uuid": "21126194-f579-4278-8905-9101b4145d55", "comment": "Malware payload (RedLineStealer)", "value": "b6f523094af09a56ea8f9b515fae8d0ada749817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783784, "uuid": "622aed90-5e82-48ea-b1e1-630f266dc9b4", "comment": "Malware payload (RedLineStealer)", "value": "7315b34c94bac3109cc460be84d5e0a30b321c249c725df2adc43d32e213a64562293a20ab3def0097b09b9e1b6e2ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783784, "uuid": "dad33d83-2869-4735-b279-75ba620b0216", "value": "T146452312A7E4A0F2C979573428FA12CB1F3BBD914D74A26B5746D04A1DF3864B83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783784, "uuid": "507eb550-061b-48bd-95b3-5003819eb1f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783784, "uuid": "2a2e82dc-c670-45bc-8f94-0556e71ff2ff", "value": "24576:Jry4fRNuv6mC9Y92mD1Elc2pbWsBlkpLLlll1nbt0v:4iNsr92mwp/2Dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783784, "uuid": "29d274b0-7c26-471b-8440-5b628b87bc6a", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783784, "uuid": "866c9b7a-d7f4-44db-897e-d68c4b665f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783784, "uuid": "470efdf9-fe2b-4eb6-ae89-d2b28372cc46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46686d4b-65d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1696768576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768576, "uuid": "caa9594e-a37e-4258-8a5a-2c01c83c5be1", "comment": "Malware payload (StrelaStealer)", "value": "4ce4085f30ee6d318e9ccbcb9579acd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768576, "uuid": "af7af77c-44d4-4437-818e-0c3bf2c37399", "comment": "Malware payload (StrelaStealer)", "value": "07f89446252c48823231a8ba971800b0c416ed560bf00acc49293b0398f1c80f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768576, "uuid": "dfba0be3-a8d5-4cc7-a7ba-269739da6d53", "comment": "Malware payload (StrelaStealer)", "value": "afb416aa45097ca4242bcf667cb92b391d8fe4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768576, "uuid": "aa8abdc1-b672-4e52-b3c2-2eb1e2b44c78", "comment": "Malware payload (StrelaStealer)", "value": "02c3160372f949ebfb9d82174b5a9becf1ec0bbf201762996411fe997a70964959248bf404c41f52a522c8df21547417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768576, "uuid": "5b176382-8296-4659-87a3-92128846dcc4", "value": "T16F547D1363E0AC21E5269A329D2DD1E4372EFCA18ED9779B32587F2F08711E1D572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768576, "uuid": "d7933046-7387-434d-892e-7ca4153e9612", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768576, "uuid": "b4d54d1d-eb0c-46c7-b0ca-f32b09f9b09d", "value": "3072:/cSml20AeBWrKcDQNs6ZZBE3xz+UZ13PtzTJMR8KdBeXqAh/a9:/mMKWOeQJpk+Yu9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696768576, "uuid": "6532b9dc-3602-4263-a512-4553715da341", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696768576, "uuid": "5b0d9a2e-d964-4caa-962c-b63d989240c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768576, "uuid": "b61a14d8-ddbc-4b3e-b9e2-f7f1a4bd4384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fff544f-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783947, "uuid": "0aa46d1d-ebc7-492d-b2d6-ece35f9768eb", "comment": "Malware payload (Mirai)", "value": "55f140ff5d87165005eb1a20759bd853", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783947, "uuid": "cb361330-503d-4241-99ad-8eb4357f96bf", "comment": "Malware payload (Mirai)", "value": "088fd42f207ddd1a835470f590638574bcb854e115da512b8c14c606fc05d8b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783947, "uuid": "aaf213c5-0987-4206-b10d-c2fe479e0f49", "comment": "Malware payload (Mirai)", "value": "99007b427838dba7a30e24ecc790983dec716da7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783947, "uuid": "f49c2cfa-dc13-4987-bb3c-4440eb685a53", "comment": "Malware payload (Mirai)", "value": "62cc50d23092f20767f99262df1e40b8b8dfd2fce95669ffca50ecc3dbe4dba613ffa1c5714769a20a4287cb88ef752a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783947, "uuid": "a06345d4-c500-49bb-bb98-e6a5f5792665", "value": "T108D31845F8505F23C6D312BBFB5E428D3B2917E9D3EE720398251F25378A86B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783947, "uuid": "214a8fec-f403-47b0-9c0f-bdd942ce3554", "value": "3072:iIaGBZLje7tX1lj4kfco/KHJKvEP91uDq7y:iIPcZbj4kUo/KwvK1uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783947, "uuid": "02d7b8a8-5fc5-4f4f-8b8e-6526fadb94ba", "value": 140448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783947, "uuid": "2d84a63b-2156-43c4-a037-546b4e069aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783947, "uuid": "4b5f2a3b-e737-4bdd-b016-5e36f0b3b4e8", "value": "skyljne.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b27a00-6633-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808200, "uuid": "850976ba-8885-46d3-8b5b-937f0d13bbb1", "comment": "Malware payload", "value": "a9104b092d9351e0b43dc99ef52f8c77", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808200, "uuid": "7459919f-78ef-4228-8123-3f7d936ae647", "comment": "Malware payload", "value": "09934e32acfde19375912fa8b1cc70dfbffc1df06cb4de3dc4bbbce28e5c4c2d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808200, "uuid": "eb29f72b-a4d4-48ea-9102-3004faa09896", "comment": "Malware payload", "value": "ff7ec5c06131ecf3917c5cd05c6da7fa6e7926cc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808200, "uuid": "845ed316-29a7-44aa-a5db-3102bc95d649", "comment": "Malware payload", "value": "8a9c2d802876cd9ee666ace133495f6c4f05e452e0f1e311fcc071a2a7d99670b97fbb127d1110c545c94ca57e2324a7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808200, "uuid": "68e2b12f-6124-4249-abd4-4006f10143d7", "value": "T15543F3E30E44AAE837D55B2EF66CA83933B11DB7143BAB946092D51F1312405C9EFCB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808200, "uuid": "695da284-757f-4abb-954e-067f3301f31f", "value": "768:8aZEVIpcuJUALTCbLcSopP48LXeCr6I2Zqj6t:8wEVIppJUALGboRPnXNYqj6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808200, "uuid": "75195339-1919-4c62-8604-9e1b774f5993", "value": 57610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808200, "uuid": "96126a6b-a3ee-4782-9f66-88364fa27ab8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808200, "uuid": "846941a7-7c56-4bd4-abf6-89f0ab9760c5", "value": "lingiang.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de32cdd2-65df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696772267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772267, "uuid": "14ce37ca-7042-495d-a8ce-4070a102eb80", "comment": "Malware payload (Smoke Loader)", "value": "304731e1cd8dd46122b3617b7188fae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772267, "uuid": "54568d1b-2281-495d-9483-3cc567d42f71", "comment": "Malware payload (Smoke Loader)", "value": "0a8651b6e9d4332c65157c102d6f75a9fb73b082587fb94e0707a15030d27825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772267, "uuid": "b9495d9c-f994-4b49-b01d-048a40e4faae", "comment": "Malware payload (Smoke Loader)", "value": "36cf17e1d34ebdc6e210f5995ad4e53a69705569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772267, "uuid": "88bb9e32-77ba-4d1b-a0cb-5be219331867", "comment": "Malware payload (Smoke Loader)", "value": "89d9524821765e2a87d0f3b2361731559d1cb93d2adb645c2a44d856aeca2840b1a156934e47c517d7d8bd692ce4baf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772267, "uuid": "044d9109-7b32-47ff-96cd-533cc8481b34", "value": "T173547E13A3A1AC21E5268A329E2DD1A5772FFC91CED9779A33147F2F08711E1D272712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772267, "uuid": "8df5f305-a8af-436d-a3e6-d18f47d707d2", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772267, "uuid": "4c167afe-e00e-4272-9df2-b0552f67ef95", "value": "3072:TcSfwqxQ/BW8VcD6xZ7j9QLg3JdMZZtKJXhKxRXuG3q7OAj/a9:7fp6WMe6xpt5utKJxmR+G6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696772267, "uuid": "97d5ebe5-f191-4682-bfa3-ed72c8e6e29f", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696772267, "uuid": "db0afe9e-c1b0-4318-9e57-6e914d551736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772267, "uuid": "43b12400-0494-4316-a62e-767827987c7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a31e45d-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696784098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784098, "uuid": "f66eb372-d35f-4b30-8712-269344e9abc5", "comment": "Malware payload (Tofsee)", "value": "ea7b4f4626defc87d66896c1e456d2a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784098, "uuid": "672f88cb-98f4-4634-8ab6-7d2c8227ee1a", "comment": "Malware payload (Tofsee)", "value": "0b861c1fce1ec79589ecccfa8528fd70ddd0cbbb8ac983cc908041c1a169e262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784098, "uuid": "fd9e6d60-60a7-44a1-9c18-2ae8732dce41", "comment": "Malware payload (Tofsee)", "value": "a67912de0dd55482d18e5a6438fbac67872733ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784098, "uuid": "ce54b052-94ed-4f30-808d-e3ab66d6a1d6", "comment": "Malware payload (Tofsee)", "value": "f3760fe923fda5e7845f7407e3aa552ed58018211e3a01f55d4e00d06d0bd061a9f37431fd5d84924c86c37ae1e5b893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784098, "uuid": "15d53043-9ea9-4c43-a350-393e4f4d9880", "value": "T146547E13A3A16C21E51A9F329E2DD1A4373EFD91DEE8779A32147F1F08711A2C562B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784098, "uuid": "ef9fda2a-04cb-4eba-b2ec-cd2706da2eec", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784098, "uuid": "38e07394-58aa-4bec-bb7d-437f103ccb8a", "value": "3072:c0W+MHLRe4h8eh4EHdO+AV25FGFyDbyDakZA6PQABQn/aT:CNteg8oPM+A3cDb0ayA6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696784098, "uuid": "1b7ebee5-f7a7-4f74-b5c1-3ea685fefa56", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696784098, "uuid": "754d4ff7-8799-461c-93db-a351272317d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784098, "uuid": "63abe85a-462c-4108-8443-9bec803c0c7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee7587c-6616-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696795756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795756, "uuid": "19694f79-9bb3-43fc-8c34-956b6b5106ea", "comment": "Malware payload (IRATA)", "value": "b279d6d073937c9e72d8a4479b9a0503", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795756, "uuid": "8abdf261-de62-4ac2-98b4-26e594ea2192", "comment": "Malware payload (IRATA)", "value": "0c84fa9d35afa1892af079c4acd91d078f026c9ca888bae27460645edc63eab1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795756, "uuid": "b1ac677f-38ec-4520-b8e5-b275738c2856", "comment": "Malware payload (IRATA)", "value": "9d3a60274d06f0c94103f9438a1f7088150b8bda", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795756, "uuid": "562a0911-88d8-43a9-96cb-ff79f32bcdf3", "comment": "Malware payload (IRATA)", "value": "c37d8f64c9108fb8f03619a8be4bdfbeebf799b8fb8cceb261f7e3a422a8f3c0da241483496afeb9689f7f77695c91b8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795756, "uuid": "3eb7f79d-a6d2-4817-b3a9-a8cc399e2244", "value": "T1BE36CFCBF794A95BC4F39331917653A691474C268B83DF876D04367C28BBAC01E5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795756, "uuid": "fcef9ce6-0906-4cf4-9b2b-e502fe9e01ef", "value": "98304:ta0a4+MNagLCrgD7yXoxevZqt1feunsTo4s7oP:ta14+YR7y4YQns9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696795756, "uuid": "10040577-9147-4e83-9b29-6c68d154550f", "value": 4950002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696795756, "uuid": "1ef7a32e-ae6b-4cee-907c-63684c3f142d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795756, "uuid": "96b307eb-8602-4205-86d9-efd9d19e5b46", "value": "app1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabad4fa-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696793763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793763, "uuid": "3165d60d-75b3-42a3-a49b-811e4cd94e32", "comment": "Malware payload", "value": "917465375259529bc10098fbcb0e560d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793763, "uuid": "af642d5a-07a6-4e77-b95c-99d6ffbf1147", "comment": "Malware payload", "value": "0d2761a3e32ec7f81e85331884bec3362226a1d339cf27529b377208689e5456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793763, "uuid": "09a9f473-32be-49cc-be55-19e44f2871c5", "comment": "Malware payload", "value": "0defda61d036a1b8052ba62d1c3718e88be53dcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793763, "uuid": "0757aba9-4a77-4d2b-9744-776bd99cf243", "comment": "Malware payload", "value": "cf5fd2bd1f2cc8afe6c2d13f759fb961dd9c6eae2bb880867abd43aa084a6c00600064d2f924aa0dca8cf1bdde76f29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793763, "uuid": "51f2a4a7-c5bb-4802-a7bc-caf2c437fdee", "value": "T1B534E617A390EA27F12285F267B5176402AABD3104B8AA07F3C11B5D63B0FE7D631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793763, "uuid": "357b53de-2d8e-4ebc-a9ef-fd8248175a36", "value": "a219390c7ec90f3e72e772b674064123", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793763, "uuid": "ed2577ec-39a8-4ee0-a6d0-aeb4067d2b4e", "value": "3072:JySYWUHYk0EwERUXVoWdcMCTsOaYKQY9QhXQlW//Ruvm+qgDH1d4s6YdZHRuwabT:JyrWtElRUXGXjRZQlpvnDHFPdZHRTav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793763, "uuid": "7c1c7fdc-9935-4dbb-9670-00649cc9c99c", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793763, "uuid": "45a107c8-d72a-4370-b54c-9cf4520d9f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793763, "uuid": "6dda2627-49f3-4b6f-93f7-021a1c94c49c", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.13604.21761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d68c5f8-660c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696791325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791325, "uuid": "795cc8f6-2bd5-4308-af43-4a309e47b8cb", "comment": "Malware payload (Stealc)", "value": "d25cd9dbdfe09bb9122dba761a6d2587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791325, "uuid": "85b5de44-fa8e-4a0a-b72c-4f6e7f0c5a01", "comment": "Malware payload (Stealc)", "value": "0e2f79bdb74c05a62fbaa1c55badf211e17d68113ed5fb8654327d9d362b38f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791325, "uuid": "529bdf68-ed32-4039-9e4c-a68a4ed9e2cf", "comment": "Malware payload (Stealc)", "value": "9a101d0297a192b102fc4f76a6ca397e33f5927b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791325, "uuid": "c1165db4-cab7-4eaa-bf26-f67b5e0d4653", "comment": "Malware payload (Stealc)", "value": "d2462e5525a5f720f89b83afa35000786cec09bd29841f807429e643b701cc25a960148b0b188bd22d60d1ffb50b2846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791325, "uuid": "10ed4f87-74b4-448a-b667-a26f353eec5b", "value": "T171452306A7ED8072DDF62BB148F253831771BD729C7457972601E83A2D73A81E83A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791325, "uuid": "2e9b2c85-1fb7-4a3e-9b3a-26e49c5efa9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791325, "uuid": "7326fd4a-6524-41f7-9dcd-3d9a0520d5b8", "value": "24576:xyfBZikCkK2s0dlvD1MZPzIw38E06HA4iLle7ge5:kfBuvt0dlvD1MZ3gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696791325, "uuid": "2000bf95-c9d8-4101-b6b7-60d77588cb6d", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696791325, "uuid": "ec9557a1-97ef-47d1-86fc-cb1fc3b3b81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791325, "uuid": "23ba203c-cbc1-4843-926b-f2224d39b0c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8ec573-65d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696766226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766226, "uuid": "77ef3415-ada2-4939-9d79-b4cd4d1bde52", "comment": "Malware payload (Smoke Loader)", "value": "1ea2b1081f917e3e01ff9760164d478f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766226, "uuid": "3d2a7578-815e-4719-9ec7-66de39e6875f", "comment": "Malware payload (Smoke Loader)", "value": "100006c7008d8f1657a8d7a816d6016e78fd0fc356306076eb27868682fe5ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766226, "uuid": "b07a2721-6853-4e99-aa7a-a8b821c5631b", "comment": "Malware payload (Smoke Loader)", "value": "726148e17e717c1a37a8860f2ddda0503e9d92b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766226, "uuid": "74bb1f5d-2583-49a8-b060-b6e6ba3660e7", "comment": "Malware payload (Smoke Loader)", "value": "7ffffaacc49e6a163c5c1b801d9771bff2b0c728b75266b83bc7bb654de95ac3cbe916b08ba2c5f458d71e1729984267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766226, "uuid": "2255de33-b900-4191-a5ff-dcbe3c19315f", "value": "T1C6548E02A3E1AC21E5268A329D2DD5E5372EFDA1CEE9779733147F2F04711E1C662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766226, "uuid": "33cb6c97-bf8d-40ad-9331-b7f6ddfd9506", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766226, "uuid": "d23ed4f4-5d29-42d4-a24c-4ddc1ab08f0f", "value": "3072:rcSezyELRBWU0I/q7bdKRBh4FHzFh6FtxLMECVQISLS/a9:TeusWRuqMRSHCvLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696766226, "uuid": "73b00960-7049-4ec0-86e0-c4a2c4ddf9aa", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696766226, "uuid": "663c8963-7591-4c3c-af57-a86197ca3bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766226, "uuid": "ab377e1a-82f3-450a-ac16-ef178ae0b01c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e197dfd-65e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696775059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775059, "uuid": "0c0c3102-552f-45a5-8fcc-8e344c19731f", "comment": "Malware payload (RedLineStealer)", "value": "382045af03eb417e3f0c0d23e46ce46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775059, "uuid": "3e388096-aa6d-4e6d-a179-c55ec8aeef76", "comment": "Malware payload (RedLineStealer)", "value": "10816d319e9567cf374028eb1e510a5459eaf757d92358c2c11f36bc23186d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775059, "uuid": "d00206df-0d71-4078-a2fe-e15474c66ae0", "comment": "Malware payload (RedLineStealer)", "value": "78760adf649c3b42fe95b63d58d9d80e1a5593b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775059, "uuid": "7af9bdc7-c73f-4c46-a83e-29af397da469", "comment": "Malware payload (RedLineStealer)", "value": "01cbb01c4b89130fd4b361dc34c84846cb57182c508fc3928f40f961b608c4327f90845d222bd5d6e3b94789bfc8f8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775059, "uuid": "8056e0dd-5482-4de8-a8c5-c4a1d054b5a0", "value": "T1C4A45B0D69A2C823D2551E3250D697A2CB7B7C795A246C6FDF4C477ECA60370AB2CD23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775059, "uuid": "77834f94-8b1d-48e2-aae8-cfc83dcec6fc", "value": "f5f86efbd827b8a05e7f7115d12623f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775059, "uuid": "fefb89e3-be1c-4d7e-a94b-2e335e171e3f", "value": "6144:b/aiGs0V5vbjGibWeHGTTmO4AOJfmIqd+xuuT0YxehH/X/lgkSKpyVUXS:bCiGs0VpBEm5eIvxuuT0Yw6krpUUXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696775059, "uuid": "1de61024-0d19-4a66-82ee-6f35eafcada4", "value": 455032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696775059, "uuid": "7d1256e9-7c8c-4559-825f-a9b8c8f92381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775059, "uuid": "57cb824d-1e38-43b2-bfa0-751edfc879af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32175256-6596-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696740625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696740625, "uuid": "882b3d97-0ecb-43e0-b7f5-aed7eb27311f", "comment": "Malware payload (MysticStealer)", "value": "5f9567ab294d3a3ec16962968b23e547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696740625, "uuid": "9ec828ae-66b0-4aa0-8083-8d8f16893371", "comment": "Malware payload (MysticStealer)", "value": "10bff39f9f63fb26bd3cb9eef5add86fe1ba8007c0d03d7a09cebb8ea4c39358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696740625, "uuid": "fe47e673-39f7-46ba-9554-e54312053773", "comment": "Malware payload (MysticStealer)", "value": "68ea4052344324bb374fa4c1d71411512a913ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696740625, "uuid": "95856da0-079c-4385-9798-d609c05a0582", "comment": "Malware payload (MysticStealer)", "value": "9020e8257d4bf3b9a48fd7b3400e2c7e4a23bd5bbff77949071a7fbc295021b7c1f835b8e81435df241df655f2cb5616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696740625, "uuid": "1b3a580a-0ac3-42d8-8f76-63e2eaed497b", "value": "T13F652317D9F59066CBB1233058FA13930B307ED6196087AB279ADD5E0C32A88D4F5BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696740625, "uuid": "a941cd76-68f4-4c39-a046-88caa703fbc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696740625, "uuid": "2a2f2886-578d-4b49-a422-d8ab274137e6", "value": "24576:7yYxZ0IUKv+tcI/4U2C2C4foJKnFVDxXskdBc1xq82+hTjT/NtqzTJ2Js:uaRbI/b2C2C4rnvxccBc1Q82eTjTbqzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696740625, "uuid": "9268638b-7c27-4176-9019-99a3a99bf956", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696740625, "uuid": "81f86f7d-72b2-4490-8d90-ebf26ff80fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696740625, "uuid": "2ec6ce5d-62ad-4fdf-a157-f5f6c18d0fa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fab7cb-65f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696780172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780172, "uuid": "e28c85ea-4de2-4ebf-a728-7467e508f2b6", "comment": "Malware payload (RedLineStealer)", "value": "a8ece52297c49f77c77e85bbaec1b817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780172, "uuid": "237ac2f9-1117-44c3-b0cd-af5f33b43cfb", "comment": "Malware payload (RedLineStealer)", "value": "1219a5530dc07d27405785d467fa5c8bfd5c5fb3357185e1b648b52008e8a270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780172, "uuid": "9f0919ee-d580-47aa-bc75-58114088cdfb", "comment": "Malware payload (RedLineStealer)", "value": "c5718a07d9da8b47ba6c06fb9e9fec63c065df41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780172, "uuid": "86f23829-d69e-4ae9-a69c-3d844a3e0038", "comment": "Malware payload (RedLineStealer)", "value": "5c53e765f7c1acf480beee62416296770e04ff174f739a55c7d1c5ad619f753671e89365ce2d5cc818aae2124122263f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780172, "uuid": "137196e1-8d7c-4999-b144-b93bfa94408e", "value": "T132452353FBC9C0A3C8FA2BB168F7125307317CA166B886263685D96F1973994647233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780172, "uuid": "8adfd906-b14c-40a9-a083-cbd7e852609f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780172, "uuid": "39c8290b-82f8-4163-bfd2-9d78d3d898d4", "value": "24576:byd6hxRWchL9Q1GKQaHfW2HNp7Ap8diFr8i97VhA1oqyZ:OCFhL9Q1GKQaH7HDDdiFrN5Eoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696780172, "uuid": "6b004571-4225-4833-9626-1400f965e595", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696780172, "uuid": "46196cd3-0dbf-4f05-a2b2-e65de9e41195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780172, "uuid": "dbc50b4d-2664-47e4-bc90-d80386741717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4baaf2-65fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696785181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785181, "uuid": "5314556f-cd52-4331-88fa-039c358b100f", "comment": "Malware payload (Mirai)", "value": "ab2f3be098e9aa9d32cee7e35aabd0ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785181, "uuid": "04029a57-3479-4b81-be37-22e0caab61e0", "comment": "Malware payload (Mirai)", "value": "13394da2159acf347fdb875c797f5d37e7d62c51c6f8db6884aee5989335de14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785181, "uuid": "c7f703fc-a668-40bb-b4cc-db862bf87269", "comment": "Malware payload (Mirai)", "value": "a50099640e61a58200cf2fdcb61718286075eb5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785181, "uuid": "004990f7-742c-4ece-a177-7246db414a6c", "comment": "Malware payload (Mirai)", "value": "9bff41fa0a808c5feb9da28ea2e4ebed8a882e01d2f6b6f9844b121b690bf98964b9ececdd88ead6a75424ecd89038c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785181, "uuid": "f4c6bd5b-87ee-444c-9cc5-92c45571aa84", "value": "T170C35B72D8356F68C169D1B0B0B18F791F53999181476FBA15B7C2B44083D8EFA09BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785181, "uuid": "f20cdb30-5a32-44e4-af06-4345abc71e08", "value": "1536:jaJcCLHaQAkbqzCNK+P5unTuCz+KRBScpuE05WB/WNeqAxJiN2HDyl1d1:jE7aJzB+knqER8E0M/WYqAY2HDqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696785181, "uuid": "dac580ed-4c87-4fc8-9d1a-daff3a3fdcc1", "value": 128320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696785181, "uuid": "5e43ba65-d532-48d6-9917-5ec952076d3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785181, "uuid": "516303a7-d5e7-4e99-baba-f82223b755f5", "value": "ab2f3be098e9aa9d32cee7e35aabd0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dbb9c8-65db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696770246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696770246, "uuid": "2ad0b2b0-d640-4ec3-ae38-d59ab95e0617", "comment": "Malware payload (RedLineStealer)", "value": "5e3ee6798b68bef71eb9f35a5a2b4d5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696770246, "uuid": "2eb6ef5e-669f-45c3-96ca-5400e06a24f1", "comment": "Malware payload (RedLineStealer)", "value": "13bb862be9d2df5eb6379b0ce6a62ee231214327adc2315296c1e85f976751b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696770246, "uuid": "5f90a09b-175c-4a35-a6e1-db2b52fda335", "comment": "Malware payload (RedLineStealer)", "value": "9c4de43e94097d4d0c56b3462a064aece72da595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696770246, "uuid": "a53040c7-8867-4ba0-a790-e333bf577e47", "comment": "Malware payload (RedLineStealer)", "value": "ea09b3a14039d68f2c04d94f4032c4ca3e311ebd7f174dcb116254a1563aeba9ce9a1e801ee390b5693bed6df5e6bba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696770246, "uuid": "3e953260-78de-4e5b-98c2-69de85638fd0", "value": "T17045235BAAC9D5B2DCF5573068FB03830F337D915938625253848D2A1A73AC0A8767BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696770246, "uuid": "5d33548f-881c-4d7c-ada6-39c4616cb235", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696770246, "uuid": "7331215d-4e02-4b9e-a764-cd8c495d9912", "value": "24576:LyOJ7xJchnhZ3fCGXXM+gw+UA88t+UFYnVx84Hj:+ODcjZvCGXXMNw+UAr+UFYVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696770246, "uuid": "29bdaf9b-76a5-4ff7-a077-05897e736487", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696770246, "uuid": "281f3fd6-b9b5-451b-a27c-94ec54bafa65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696770246, "uuid": "47e3b52c-8ce1-4309-8001-0641a2e33e37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42677983-65be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696757832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757832, "uuid": "3da93e13-a8e8-4a32-8628-c79fb8cb92f8", "comment": "Malware payload (Smoke Loader)", "value": "854b5c0686fecd62735cfe962db1fd8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757832, "uuid": "b6be8699-76f7-4eae-b242-8ab0c7d90e40", "comment": "Malware payload (Smoke Loader)", "value": "141398e4cab2c24c9df53d19f3310a31c5edbc39e8dc64fec46003b2f6255f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757832, "uuid": "19eb4122-5012-463f-a0b4-01b9d8a5c8d3", "comment": "Malware payload (Smoke Loader)", "value": "81b9c3d72043754056156694432f14be17da937f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757832, "uuid": "ea65360f-8e9d-482f-97c8-8f11d4470e9d", "comment": "Malware payload (Smoke Loader)", "value": "3c91dce6b9a8c89e84aec971e6693b4f6b61ba0790c55d20cd7247ab5723e7ea71626717f8e2a825d8aa20eeae29728e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757832, "uuid": "e95eabf2-2e8c-4d80-8617-35a3d5112eed", "value": "T1CB548F02A3A1AC21D5264B329E2ED2A4373EFD91CEE9779733587F1F44B11E1C562B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757832, "uuid": "5ed743bc-501c-4ddc-bef4-42f06f5912ad", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757832, "uuid": "7bc11918-8ed4-49cb-8838-c35463867fbd", "value": "3072:ccSS88xWg9uov8/WK3OE+Mh+FGf41QuSA/a9:WS1WH+8//OET8ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696757832, "uuid": "f1913c89-b02d-481b-beb1-bb903d2b78b5", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696757832, "uuid": "e821a99f-ea6b-49fc-814c-2f58ded3a2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757832, "uuid": "4946cb98-9cbc-46fc-9459-a62ece16069a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ed656b-65b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696753293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753293, "uuid": "cad3141d-a689-4e8d-b026-b0f8696b93b6", "comment": "Malware payload (Smoke Loader)", "value": "c0104d763765b09fc32d4fd64bf773fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753293, "uuid": "d8817d21-5cea-40a8-9001-f46860439883", "comment": "Malware payload (Smoke Loader)", "value": "151754b17a295353911712a405a969650c46a56a980913a99d9a99b23b55f1ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753293, "uuid": "3d48efeb-3ec1-4c11-948d-380fc7c63d73", "comment": "Malware payload (Smoke Loader)", "value": "ff88413af332d3c5c958f8eece0b088dca4576ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753293, "uuid": "09fe968a-be34-4bbc-8539-4bb70737cd2e", "comment": "Malware payload (Smoke Loader)", "value": "493239ebcfb1bcd5cdd28684a9a445adbb1e6004c43d6ffd7c4372db6f97f58d27e8a3ff09bd063142f9af2f5a63ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753293, "uuid": "5849b4cb-88a2-4c35-92f1-99346df9b698", "value": "T195547E12A3A1BC21E52A4A329D2DD1E4372EFDA1CEE9779B33547F2F08711E1C562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753293, "uuid": "0b0597b8-2257-4fcf-be3d-7d9739e39be7", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753293, "uuid": "e07ffb9f-86ef-4515-9099-1f7ee777cff3", "value": "3072:AgonW423mB1WQzg8lDFy3XwEPrny75NQkE5588z33Qhr3IK/a9:EW1IWGJlDFynwELyVKk+3+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753293, "uuid": "14a8cbf4-a99e-4b21-833f-32caf437f8b9", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753293, "uuid": "67ba9a90-a4f9-460c-b124-102499f7ae4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753293, "uuid": "6ebb623b-2afc-4285-a39c-1387505dd692", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e52be4-65ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696785789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785789, "uuid": "50d5683f-11c2-4024-bfd8-6a39532b094d", "comment": "Malware payload (RedLineStealer)", "value": "75a9ab246e0bca983d09c3c8e268b3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785789, "uuid": "e0e909b8-3bb0-4a9c-9f44-3559b8145960", "comment": "Malware payload (RedLineStealer)", "value": "1587279e416a2e3d52af68e52c8ea3f279f59022f18dc4880d8f00273fd61401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785789, "uuid": "bba28fab-2e43-422b-9136-483f9cce1ecc", "comment": "Malware payload (RedLineStealer)", "value": "0cf1c9989f74f399a8e5899cc0a15f4e06c38420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785789, "uuid": "409e0b23-c59e-405c-b5e9-36ef4eda5667", "comment": "Malware payload (RedLineStealer)", "value": "98bbd1209ec6b4e30256847ae3114214cb79b33f64281e7202bf0af3ae4a62c836fc7c4be402073c034cef210a0b6756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785789, "uuid": "bbe77b56-4689-4a74-bb92-2dc7dfbc84bc", "value": "T198452393B3C98462C8F90B7069F606D70B363D965C719367168AA96E08F3FC4587272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785789, "uuid": "20fee87d-0e87-475e-8b71-3a234a52f0ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785789, "uuid": "cdbc6043-fb6c-4194-97a3-ebf0079c8567", "value": "24576:GyTcPd/LeMvWS8hDr8fq7HQom8MKoz8CJ7Qp6OdxYWnNhRWl7OLP+sOhbR:VTcFDeiWThDr8fiwvvz8vpHHUl7OLP+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696785789, "uuid": "7e439e20-183f-412b-adf2-0000ea646952", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696785789, "uuid": "a13705d5-187b-4dfe-839d-ac34a44a6bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785789, "uuid": "ae3cd9de-2ed6-4679-8767-a2c1f2be1138", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8b4e7e-661d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696798809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798809, "uuid": "60242184-d352-4312-812e-cb505d1d5c88", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "32846f71425da8ab731ebe0016dac49f", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798809, "uuid": "84451d8b-612f-4c56-b28c-6f517165b287", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "173cf6b50cfad4fa06f6826452aeceae743a49fb7c2cdc6445961c01dc11da92", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798809, "uuid": "4bc1c841-62f3-42b5-a51d-64bbedabee92", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "507b6fc8d7ebdbd39cbe1de91859eaa9086d9fcc", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798809, "uuid": "f7607be6-f5d8-43ae-ac48-0982cba53841", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0b55648a950d23dc731714156773146a87eea6619e3ee8945d109bcfb0d3c13293136aa8e83da4908b6c6b2ae650b489", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798809, "uuid": "8a538cbe-4d94-4817-812a-6643fb18a745", "value": "T1D2E6E16CB396684AB672EEC39FD2E9A2C3D79378F3058D36300A539959734F0D91242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798809, "uuid": "ba0f4615-d227-4351-b5b9-1398f3c511dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798809, "uuid": "c48c8542-4cff-4e42-875a-248f972c83cc", "value": "196608:2IgCXUXYGU2MYWZ3mpejjiAN8YrOmSIFIuHB+q9LOKd/VT7cRRbYc:lgCkX1SZ3pniIzl7XhZLOKd/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798809, "uuid": "e52d9f9c-2713-410b-9902-ac01b061c697", "value": 14080512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798809, "uuid": "0f25203a-cd76-4694-bb43-41a559ba4622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798809, "uuid": "a56ae3f3-9a32-4e10-91ac-005b7bbb71c4", "value": "32846f71425da8ab731ebe0016dac49f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec18976-6618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696796481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796481, "uuid": "c6f69940-f030-4d92-b222-e9bcef1d739a", "comment": "Malware payload (IRATA)", "value": "37f9a8efd4d488ea3c76b21ddccee1ee", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796481, "uuid": "ae700d71-b8d7-49ec-b99f-4226f3de52d8", "comment": "Malware payload (IRATA)", "value": "1ca94c9e9048b96768ee74e0dcf91106e41e782193822870bbced71ed2d7005a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796481, "uuid": "1af1826d-85c4-4424-8d5f-b990c2fdae34", "comment": "Malware payload (IRATA)", "value": "2abb191d8588c144aa3c88d544d00c2229536449", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796481, "uuid": "07d92da5-a4bc-4778-96f2-78397adfbe68", "comment": "Malware payload (IRATA)", "value": "44f09988330bbcd0c6e7f5f4284b5b0a3a401aad11231019f879ac6c943c9efb7fb903523322f540ccddf94475b0021b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796481, "uuid": "b7d26a59-a7c8-4fac-a92a-2518373c883d", "value": "T1F536CFCBF794A96AC4F39732817653A651074C268B83DF836D05367C28BB9C01F5ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796481, "uuid": "3ae2a19b-7751-43f1-b019-ad5b35d76393", "value": "98304:ja0a4+MN9gLCrgDSTgopBZSIhxXeuPFHLA8i:ja14+YSSTjbxPFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796481, "uuid": "a3a8a346-7825-496c-8e4c-0a93fe789243", "value": 4950002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796481, "uuid": "5c5a6879-9b5d-409e-a550-93a83b8bb996", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796481, "uuid": "ea521c4f-1d44-46f5-bfa5-674379609b85", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e523bf-65f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696781403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781403, "uuid": "04753a3e-87ae-44b1-bc8a-5ac6698a19f6", "comment": "Malware payload (RedLineStealer)", "value": "e7234438f385129a4200aeda6981ffb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781403, "uuid": "58fe34b9-63c9-4125-8ce6-fba9725fd984", "comment": "Malware payload (RedLineStealer)", "value": "1d634c26dab957538c5862fb46ae7b4c469e2e809b45829c2946249592b0280a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781403, "uuid": "83145442-3991-4d7d-a297-88bd7a0cbb4e", "comment": "Malware payload (RedLineStealer)", "value": "bb0a704f854b716b9c8c14039edd4f3f97327d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781403, "uuid": "ab2559e0-71a9-4341-81eb-fcaf245fc14b", "comment": "Malware payload (RedLineStealer)", "value": "e23bebc337171a6633b65c339e2be7fa4cc28c8475ad1ab4eeffdde8c3ac0091ff6ee7d620e78c019618d26147efb532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781403, "uuid": "074bf44b-7862-43a9-9eb9-f846730b4be4", "value": "T1D7452352A6D9A032EA796734CCF243A30B33BC80D87483671395A92F0DB76D456753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781403, "uuid": "41d8f2bb-3c83-48ff-8ab4-16ebe2bdfff3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781403, "uuid": "b2799b59-3444-4083-880b-9ddbe30cea85", "value": "24576:1ycyQAJzg/7fe+PpbnKBV7jIhtppVr6di3UT92SN5O8tZXRHV:Q42U/7fnPpI7jIhtppVr6dADYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696781403, "uuid": "6dabc10c-34b9-40d9-9ff9-128c87431f97", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696781403, "uuid": "46d1a881-8849-4f57-96f7-44301cc9dfc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781403, "uuid": "930a6458-6ad4-4cef-a318-1e30a0df9038", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aac5131-65e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696775429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775429, "uuid": "f796266e-4327-48e4-a479-4d621ea79fc0", "comment": "Malware payload (Stealc)", "value": "a3f79eb1a1d6f61a9ce524513ceaae63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775429, "uuid": "4d7b5de4-adbb-41c2-828a-4975350d9b00", "comment": "Malware payload (Stealc)", "value": "1e4c1bfa0a79b28e68a8046f8fe97d8a97f9376ff985b92a2353c1d141cfd241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775429, "uuid": "ad49120c-1e4d-4373-99e6-f27c51070ed3", "comment": "Malware payload (Stealc)", "value": "1157c7d4e170ebc549e8d52733adb5aefcceffb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775429, "uuid": "2e65b029-7de3-44fb-b1f6-d2aca897c2a3", "comment": "Malware payload (Stealc)", "value": "40c18171e143976e7c1f3bd2855845c7efe6a3dc3c8c774cd83ea664c14c88c843d246b1af2dfb38ceaf7ef6397bc804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775429, "uuid": "01397a0d-53bb-4d23-ae71-b7ee9cf729d7", "value": "T1D0547E1363A1AC25E5668A325D2ED1A4372EFCA1CEE9779B33587F1F18710E1C632712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775429, "uuid": "e4084547-d176-4bdd-9f10-9996fd47c7bc", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775429, "uuid": "daa3c1c9-6ad3-489d-b1a1-d69cc9633a58", "value": "3072:LcSCDtSVcKBWuqcDcwMiPw3TSiI7yQ6UE81NtAuAl/a9:zCkTWJecwLKTSiI7yQ6UEGfAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696775429, "uuid": "dd20af78-95ae-4f75-a654-e3392d8493bb", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696775429, "uuid": "e07b02e4-7b8c-408c-80e6-9f9d7181dcd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775429, "uuid": "48abd969-ecb8-4995-8747-b2bfe3f61df0", "value": "SecuriteInfo.com.Trojan.Siggen21.37421.15910.32261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4420a739-6584-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696732924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732924, "uuid": "930a009b-fd43-4dfb-b5ca-22bf6f0a28c1", "comment": "Malware payload (RedLineStealer)", "value": "87c850491adaab80d31f6005f16cd4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732924, "uuid": "e5073aee-3a15-4e52-b8f9-0be252ae3443", "comment": "Malware payload (RedLineStealer)", "value": "1f0b12f8f0901f956d13993cf280d05afe57063454c280eef49c1e510ce68b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732924, "uuid": "d4cf493d-8551-417a-b57e-2aea358c36e7", "comment": "Malware payload (RedLineStealer)", "value": "c9b826c50fcfc8d08d09a9061d338aa5e1078ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732924, "uuid": "93bd590c-03ad-4c69-8622-11f26576cf10", "comment": "Malware payload (RedLineStealer)", "value": "972b57a937ba2dc91121c1a755c453bea41cb126f6d25043c64a5c20cec22a68199011e7f214b414591051d07a5a9c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732924, "uuid": "78782e45-a4f2-4830-9d54-4ea4e8bd1489", "value": "T1E9652325BED9B833DBF4237084FA4B931B35FDA2A464C34B27A9ED5B04B21456072739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732924, "uuid": "268c16d6-671c-46c7-9b84-cf876de0cdee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732924, "uuid": "d16df789-93b9-4b70-be21-370f178881e4", "value": "24576:1yoXad18HffWECj3WjgqFvDZF8CisH4oGFReNzm6ue3+WqgXFDrONDzDOvh:QoAGWEEWjgqFrZyCiUbMeNS6ueuP8Drb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696732924, "uuid": "700e3cf5-b83b-4791-9a95-84374e2cb34d", "value": 1539072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696732924, "uuid": "b9f31b1d-f762-46cf-b806-c16db7b5a422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732924, "uuid": "fe61329b-e0dc-4c18-aa21-426cacfb8fb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033198e2-6579-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696728091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728091, "uuid": "a5c79b9f-0245-4e40-b7f1-caeca2ed1eaf", "comment": "Malware payload (RedLineStealer)", "value": "887e7c41dcd765693a6c62b2837f7a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728091, "uuid": "be7998ab-7fe1-4b20-abef-f44c0daec5cc", "comment": "Malware payload (RedLineStealer)", "value": "1f26a97b400321925f1ca380d97d19cb4205d3b461056e23038f6373be067e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728091, "uuid": "c6f44f5b-06c3-495d-a992-86a26dc49fa1", "comment": "Malware payload (RedLineStealer)", "value": "06e78a247ec593d4ab67708295ede0b41dbcc532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728091, "uuid": "2057124b-0bba-4795-a920-6dc325de9dae", "comment": "Malware payload (RedLineStealer)", "value": "f2f2fae952f0c909d4dfc9fa26abc5e4187b6edf8352a25f614325d634073ace17a699a02fcbd9e82136d743a7fb62e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728091, "uuid": "804d8529-5197-4bca-bea5-3f4fdfdb7c8e", "value": "T17D653393BAE9D4B6D4B1273264FE06C30B34FCA2B9F466BB67999C5F48711085231723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728091, "uuid": "cc80660d-a37a-40c1-aa5e-34b2392a1e2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728091, "uuid": "8860498d-1c05-49d8-9a47-a54552261495", "value": "24576:NyJ2ogPVbicDmxivjYnIOjrE5022IJRJd0WJKm/PAaHWRF1NMZQ:oNmVb9DmxivjaEe9IX1UQJW31iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696728091, "uuid": "cf07cd3a-285c-4561-aea6-4fbda877e1b2", "value": 1545728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696728091, "uuid": "997e190b-1d05-4d6f-9256-43bae9a99c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728091, "uuid": "9fda2d19-b321-4128-aa94-90f7574f8ae6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073feee9-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753868, "uuid": "a5f0f746-dbea-47ed-bbb9-d71a36f6a89d", "comment": "Malware payload (Mirai)", "value": "9dc01488e3698f2d6a49c005a1796f9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753868, "uuid": "3d32bf47-337c-4662-844f-e7b45f4eda6d", "comment": "Malware payload (Mirai)", "value": "1f280e1a6103295f230f50ae2e2723c8c146a968e55c46eb8890f9db550da24a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753868, "uuid": "16439aa6-9ffe-4cfa-a7d8-a70f7bc1b904", "comment": "Malware payload (Mirai)", "value": "7ef72b7423962ccd449fe3186ef8eee28728ec55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753868, "uuid": "fe6a6090-1c86-4c34-a519-c6d94b593990", "comment": "Malware payload (Mirai)", "value": "5e1000ddae19c614040cafbee691d11a4a9abe6b8af75dea13fd10cda6d5c9809241637ff4ee83f7f9e10122e8a8ff10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753868, "uuid": "8bf1db50-1b12-4be0-9fde-c3844345267b", "value": "T155837D31AD792F56C1C0A43B02F747A5B2F11B8E2AEC860E7C710D1EFF64A9065275B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753868, "uuid": "e6c6024c-8c28-4d82-bb2b-e4041ac6d07c", "value": "1536:IJb1NszRNlwsPumht/4Xy/EyeT+T5+imUUiPjPK:QwZumr9szKNmUUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753868, "uuid": "31c4cbc2-6c2b-44ca-8639-46de66a74be9", "value": 82992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753868, "uuid": "bb346c11-ad93-4cd3-bb37-583891e8bddc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753868, "uuid": "28356f58-bee6-4a78-b4e3-c6a220681dc8", "value": "9dc01488e3698f2d6a49c005a1796f9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a996965c-65af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696751563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696751563, "uuid": "2bde4840-e685-4a3f-97b5-d1a69c87bbad", "comment": "Malware payload (RedLineStealer)", "value": "2a4d3fff8c1cfb8c70c3ab7f09602bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696751563, "uuid": "d8ffcc41-805b-4f28-acdc-c25a67955b69", "comment": "Malware payload (RedLineStealer)", "value": "22dbc195ae67929a7849addd574a31d771b5a1ba22aee177ec498f204977717c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696751563, "uuid": "10737e0e-c1ff-422d-946d-e1acec214979", "comment": "Malware payload (RedLineStealer)", "value": "51fee375d028516c2d8813dc568168b5647809e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696751563, "uuid": "ebe0aab9-43d3-4476-9619-9aeb7294385f", "comment": "Malware payload (RedLineStealer)", "value": "e750bddf1bb70cea6e9c825a83ade28c0b42869ce4575c2f054a8b8ee5e43c4940acb387e754a3ae16264a7ea8b20e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696751563, "uuid": "f5bec4a1-f948-4298-bba9-4871b75e3c0d", "value": "T1A4352303A7E88536C9B12F7094FA02C31B35BDA16C74827B2767980E1D71AA4D97B737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696751563, "uuid": "8d478fbc-4ecd-4f86-88ae-c59830b55185", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696751563, "uuid": "ee33c425-c8fc-4843-907e-2565a5ba7329", "value": "24576:xyolFwOnzs4wXfjbTq0q+jdBSlaPDpfkSMq0CsKVTE3zP:kQo4M7bTq+jdzpfJ+iVTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696751563, "uuid": "b1e49275-db8e-4b54-8c23-a7d5b76300ca", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696751563, "uuid": "37802c0d-9217-4b08-8489-b776a18a4fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696751563, "uuid": "fdb4550c-5824-47c5-b8d8-663a2ba08828", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911c9ea3-65f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1696782016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782016, "uuid": "a72c3182-9c70-4042-af31-dc6763c99670", "comment": "Malware payload (AveMariaRAT)", "value": "47894aa2287ccf6c0af44ed888366fc0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782016, "uuid": "4fd9bebd-a321-409d-a6ab-187b00677de3", "comment": "Malware payload (AveMariaRAT)", "value": "245e73c7eb50a6b8dd8ad5a52bce6897d78e38ee0c2c4c712f19a44dd633c5f8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782016, "uuid": "81267dd0-bfab-4c92-aaf9-36181940cf88", "comment": "Malware payload (AveMariaRAT)", "value": "96edea354354dde27548137ce2a185dea79237a8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782016, "uuid": "fe6cf4f3-18c4-4cec-a971-0f37bde805db", "comment": "Malware payload (AveMariaRAT)", "value": "c5b655a599fae49aefea10bcdd30a25c10c5bcafdf6f258c5315a040f7fbed3fe4086ceba4022ea6e4ede43f60261356", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782016, "uuid": "839b21a3-9a08-469f-a1cd-9c5c4a519128", "value": "T155D4F1983650B2DFC81BD872ADA85CA0E725747B430BD717A05716AC9E0EA9BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782016, "uuid": "8f10115f-0369-407c-801e-f821a52b47e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782016, "uuid": "a90bc168-8ef6-4e78-94b0-13eb7ef2f1d6", "value": "12288:5EmJysnoROJLcsfd1S97Js2Hh6j4q6X3M9etzueTKko767YpKTPJOUlwOsZCwYJ:eCoqLp1IJs2kUDXKeYe2X7r8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696782016, "uuid": "09799d17-47ed-424b-a645-59974c16c732", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696782016, "uuid": "bfe1edee-c3b4-4c0f-9052-5e0a6795ea6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782016, "uuid": "9f0c832d-d173-4718-a98f-a59e3bfa4a80", "value": "47894AA2287CCF6C0AF44ED888366FC0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67075e9-65bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696758537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696758537, "uuid": "f733e2fd-733f-45b3-bba0-9b66234928b8", "comment": "Malware payload (RedLineStealer)", "value": "b75c88fa9ab706fa79b21aac05781df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696758537, "uuid": "b785cf7c-086b-4441-82ac-9ce32e55bd96", "comment": "Malware payload (RedLineStealer)", "value": "29346609fb3bc982696dea86bb6a5de5ee3965de311a6ab85e064c005c77ac23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696758537, "uuid": "3a99176f-31b6-429d-ad8f-83ac1389c074", "comment": "Malware payload (RedLineStealer)", "value": "e2a2002abd67fb1b91771a8a1b94080c01388f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696758537, "uuid": "bd384409-fb39-46dc-9f6e-f8df0d5628c0", "comment": "Malware payload (RedLineStealer)", "value": "e6b9a815f57a1b80973c86d50509c856a68b3264ee7320bb6063efd911bee85f9c4d62e63ab45e5429f9aea61a97a29e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696758537, "uuid": "4313ff6f-ece8-4246-b63f-5ecc0940298c", "value": "T1DE352303A6FC8E2BC47C2F7094F607930F35FD629D34969E1355A96A09726486837B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696758537, "uuid": "cb1dd8ad-911c-4bb2-81b9-e31dfcf94464", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696758537, "uuid": "8ea7fcf4-2d76-4d6f-b5a9-b83fba5ede09", "value": "24576:3y0+veDRxdA9n671kI4z4XFSDS4i60/ArLPLO:CcDRrm671kI4EXFSNiHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696758537, "uuid": "b61751e4-09cb-4806-bcce-a4a9fd1854df", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696758537, "uuid": "508de08b-7eef-4ff6-ad9e-1c6d296007ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696758537, "uuid": "1e49c108-1e5d-4864-b7cf-c54e30825f1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26900a55-6636-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696809325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809325, "uuid": "2287e17d-a5d7-4659-b0d9-620bcf080a6d", "comment": "Malware payload (RedLineStealer)", "value": "5c0e8dec93f921031c182f1b7d11a5f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809325, "uuid": "43a15abc-0480-40f1-8f9b-8b2443cf48c5", "comment": "Malware payload (RedLineStealer)", "value": "29546bed8c3a31fe27f07dae040f8fd9f4c9df4e6b0035cb8f45fbb90dbb6c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809325, "uuid": "2c033e56-3e76-4f3d-9318-503c7b3cd37a", "comment": "Malware payload (RedLineStealer)", "value": "efa356ccc76f246ee2a5fb5d1997494f836cc179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809325, "uuid": "4ef79d41-2824-477f-9cdd-1594cda5420a", "comment": "Malware payload (RedLineStealer)", "value": "76f380bb0ef18d601c2bb6ff05fcc45661dd90e7b5f68bb4f7d8c51a2e0e32b1e9767ca24b09f109b5a1b8e2953883fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809325, "uuid": "060486b0-e8e8-44cd-b7ce-9be29c5f2f5b", "value": "T19345231367E0C473DCB427746CFA07A70B363CAA597D892A1BC5A8450DB36D5A4323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809325, "uuid": "f6246eaf-6c21-471a-844b-3d6fabce9c24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809325, "uuid": "9f0ed480-16b3-471b-9173-e95069e360f8", "value": "24576:FyFlHHJ1wUnfcqxRfE3rJdV4ZwMCww5+WUc:gFlHPwUnfZRfE1d8wMCn51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696809325, "uuid": "7c907819-1303-4804-be69-5818ac9476eb", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696809325, "uuid": "41ce438b-9e40-46cd-9cb9-0468b4218bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809325, "uuid": "0d3b1b63-05fb-476f-8765-e23aa802f81b", "value": "5c0e8dec93f921031c182f1b7d11a5f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623bc0ce-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808566, "uuid": "543d9f19-6fea-49d2-89e0-12993d413d82", "comment": "Malware payload", "value": "f9bd681eb756f003a36c4d2cd64e28e0", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808566, "uuid": "c475448d-d9f7-4c92-85ba-389e43c7d6a0", "comment": "Malware payload", "value": "298bda6934276760168fae06a92b2f71e51368e6c9356ee693f5bf3982d00d77", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808566, "uuid": "43aae906-43b7-4457-be02-c4daa7d5f3c1", "comment": "Malware payload", "value": "6064d13f4c6b30d223aae3cc89a131afd80af417", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808566, "uuid": "11ac3890-3c55-49d4-9260-e71b073dd694", "comment": "Malware payload", "value": "8e4ba74b02dcda18349d4e03dfa2a7c15556c0cfce9d9a41db7d464f49910df08023a244eae30f9cfd98077a19217a6b", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808566, "uuid": "a9054f63-e80e-45a0-b2c1-ac68ebfe7e25", "value": "T16E51AA1A7E442C619157E5D0A5877806F68E4177096C1A30F4DCC6A92F42326DFBFFC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808566, "uuid": "b2fa115e-7730-40bf-86ad-56ec331207f6", "value": "48:5ODJ29xTS/sdMIdUwTx/UjMjrPGqy7a9gBqV/Z12Z8iZN:5ODkysdHNTJUj1WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808566, "uuid": "0be69d78-e6d2-43b5-bcfd-1dbadb80d871", "value": 2738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808566, "uuid": "b6a05cd7-191a-498a-a8b0-c686a3720b15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808566, "uuid": "ae96f1db-b788-4cd6-aabd-ee740f9fdea8", "value": "IP-Grabber.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ebab9d-65b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696754959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754959, "uuid": "2f4b499f-9234-4c71-a8f0-6dcd729542cf", "comment": "Malware payload (Tofsee)", "value": "7c8dc9859c13a141f0a93b8231f802b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754959, "uuid": "ed56acb4-ee03-4511-ae29-09c0d656354b", "comment": "Malware payload (Tofsee)", "value": "2b31dd8005e33f286d28b508f864b6d4d0f0cc99c1613cd48ad342f36f8da0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754959, "uuid": "396c7803-469d-4c1f-a778-3a0a1f4435aa", "comment": "Malware payload (Tofsee)", "value": "b20a6e8bf62a72b071b62ad46310a7480dce885d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754959, "uuid": "f745375b-562c-4aa5-8ada-4e35513b3ea8", "comment": "Malware payload (Tofsee)", "value": "f08bc95f5e63d50aa979d3e097b86a4d39edad91c623f659add3f229c1df10b6ab8fdcb0efe9bfbf178b780a9046527f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754959, "uuid": "ddab9326-8ad5-43c9-8ede-28b1a0121ea9", "value": "T111548F13A3A1AC21E5264A329E2ED1A4772EFCA1CEE9779733147F1F08711E1D672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754959, "uuid": "7d386b79-022f-4a35-9b39-e99609f89e1a", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754959, "uuid": "cc590176-5c99-479f-b86d-ed5e6a3d4f26", "value": "3072:ZcSK11RMyBWHuI/jQQMwSGPBx2SpnhrAFQwSq/a9:JKPnWOujNpZ1hrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754959, "uuid": "e52e365f-2b95-43ca-a31a-5a95a8d4bb55", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754959, "uuid": "ae695408-5e46-450c-bf8c-9158217538f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754959, "uuid": "d9a98dd0-53cd-4214-b1be-7122713722d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980f6a87-65ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696764848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764848, "uuid": "61623501-9a4c-4e3b-b9a8-2c051b69ce7e", "comment": "Malware payload (CoinMiner)", "value": "13cb1c0ba17765f1a5959f16e3255f5a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764848, "uuid": "e69793a8-5cf4-49ae-be68-5f20fb2dc650", "comment": "Malware payload (CoinMiner)", "value": "2caec2a447046895085baab1dabcc13d974b71c98eb4d3161cd34a7e2caf8b42", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764848, "uuid": "872bb9f2-c42d-4745-8e80-6f2f086e9966", "comment": "Malware payload (CoinMiner)", "value": "3524140ceced36765ed7c3db3da8d7e242df5103", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764848, "uuid": "766bf661-1f0b-4cd2-a580-5a06dbb24613", "comment": "Malware payload (CoinMiner)", "value": "036f52cb3a775e54191a434e8b203248cb9a256e747e38b877e6cd70e476b95c27eb39a0e6623c16600ac1bbfc5716d2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764848, "uuid": "10b4900b-ee35-4e67-a01e-095efd092ad1", "value": "T158A6DFD2332C7146E0D0ACF9317D8B04702BCED8F64B6947DA70BBB16DAA714AD659C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764848, "uuid": "f7bc96e7-e68f-4b49-bb45-cfc37c04ff03", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764848, "uuid": "7fba3ca2-22a4-45b1-9788-c9c9e8969244", "value": "196608:Thzft/IXx5GA9h4NedvttJAkBLk/8dFCXTQxvqrGmqBJK:Thzft/IXTrldzCDKhJJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696764848, "uuid": "a38739d6-eb39-487c-8a5a-b3fb96a9e651", "value": 10259768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696764848, "uuid": "5f9a4c72-f9f2-4118-99b0-0cd705fb6a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764848, "uuid": "9aa9960b-c315-4771-bd94-5b394859982f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a693f7-65e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696776041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776041, "uuid": "e944af7e-919b-42bb-bcd3-f44fa7841b0b", "comment": "Malware payload (RedLineStealer)", "value": "fcea84519c2dfd2552d7244645500acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776041, "uuid": "ae3fe5ef-4d1e-48d8-a861-6134bad780da", "comment": "Malware payload (RedLineStealer)", "value": "2d45036bb89c23f86f168aef35272119f5d5605e688c1b603c457135bae00494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776041, "uuid": "2b6b8f6f-1060-47d6-bc92-8b3574bfb18c", "comment": "Malware payload (RedLineStealer)", "value": "f01bd9c9138637682054bd9a0660c3d864a32279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776041, "uuid": "0069e458-fe29-4fef-ade8-ec4f23f85fb2", "comment": "Malware payload (RedLineStealer)", "value": "ae2b93e151064b1a22fa1a904e149a29f2249c00bc706caf2e720755806e57d72b85b4954fa2dbb547c26fd8e7a964ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776041, "uuid": "926c2905-05c0-456d-bc42-4128e5aa5abb", "value": "T11C45231157D9D033D9B123B03CF70A93063A7DB118748A2B3B6AA91A3AB2791D57533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776041, "uuid": "2eb4deee-51e7-40f1-8663-9c2ca54eae11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776041, "uuid": "2f9d5feb-98fb-4c5e-817b-d1a2bd479e59", "value": "24576:iycYjyJ4arDWfiTap4xWy4E9cbe+94RA1ffkYPDqwju:Jzjy+ar6fWap44yTm942EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696776041, "uuid": "0878f81e-3698-4667-922f-f66d5381ff74", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696776041, "uuid": "ff8e260b-a12b-4e17-be54-ed4a775d89fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776041, "uuid": "7db9bcdf-6649-45ac-b992-4641588d08d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bf123e-661c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696798244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798244, "uuid": "6a3aacb3-2d77-405f-be0b-28bebeb83926", "comment": "Malware payload (IRATA)", "value": "14fd5d6450873dad25434ae1c8f809dd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798244, "uuid": "72758766-adfb-47f0-b6f5-c90e660965e8", "comment": "Malware payload (IRATA)", "value": "2dae892ffdace96e645994347db6f37f42f48f2d91d6ce7a8c43e94e211c95c8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798244, "uuid": "20e5d8b8-9ec5-42c9-8b01-bab9f5725fbe", "comment": "Malware payload (IRATA)", "value": "e5928d808a11e5285164f7e9874d37bdd75c4af7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798244, "uuid": "2b66b26a-a52d-4cf8-a6ac-06328d554f40", "comment": "Malware payload (IRATA)", "value": "433f1152404858d937de1bc3d2070cc119dd6da568e966024f510dabf2a8242e0ad344382f07c08d2e241af388e67eed", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798244, "uuid": "c80afcbd-9b2a-4f02-88b8-6c0b5a888cb6", "value": "T177E533E2EFC5E427F29D853B0A4BE1B0AF8E834C140553772E55D54AA7F2C865A078F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798244, "uuid": "8190823b-5005-45b7-aa38-fee1330146af", "value": "49152:EJWJh+40oypfbdEEHphRSXVpVvZhNMCHFcVVWSMHi6WD+37BYnf4cus/IOu+f1h:Jq40oypjOEHpSXHVvZhNMCHFc3WdiPC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798244, "uuid": "5d74471c-6ba9-4449-af37-3e279405c832", "value": 3102714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798244, "uuid": "14078df6-8e38-46da-81ac-8d99d1a615a6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798244, "uuid": "985036c7-e213-42e7-a1d7-731e9e0799f3", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2c8bd4-6622-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696800911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800911, "uuid": "002d523f-0618-4ffa-a1d9-7749c093381b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c7f2b50a51b84d1108430e3fb119d0d4", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800911, "uuid": "03d9d21a-715c-448d-8037-5f210632ec05", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "31c5da8614998e7836aaf3c70559f7710edbd4b536b840e0c63babfdc95c5921", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800911, "uuid": "89c48b97-0ea9-4cf9-9586-8d617ae664bb", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "456b0ddbe6ab80c883835fa2de911cc94a94e001", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800911, "uuid": "17c582bc-91d3-409f-b3de-236733eb2535", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "996bc009b67f3908ab05401067231624671a14050c7519e53667314d8e7fcfbc2b43fcb6e52d81a359536bcdf14c2425", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800911, "uuid": "3db1a53f-ab60-4104-bb8d-c548fcfc5dee", "value": "T1D1E6E16CB396684AB672EEC39FD2E9A2C3D79378F3058D36300A539959734F0D91242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800911, "uuid": "1c95d784-3e2e-401f-acd2-2ad452cb653b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800911, "uuid": "6bb38b4c-4c0d-40b6-84c4-c9a6d3be5a75", "value": "196608:aIgCXUXYGU2MYWZ3mpejjiAN8YrOmSIFIuHB+q9LOKd/VT7cRRbYc:JgCkX1SZ3pniIzl7XhZLOKd/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800911, "uuid": "5f2d23da-4205-45de-bf73-ab53936e09b5", "value": 14080512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800911, "uuid": "009cb57b-1069-407c-b128-551a810535e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800911, "uuid": "26cdd096-d2a0-4d07-8b05-f83208bfabb8", "value": "c7f2b50a51b84d1108430e3fb119d0d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360ea789-6592-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696738914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696738914, "uuid": "2c417a69-d2ff-4bd9-9dc3-169716365e67", "comment": "Malware payload (RedLineStealer)", "value": "01a7aa5a2130c2c6c5b88215613f37d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696738914, "uuid": "2b9db534-3745-484b-b587-8d36e77d2917", "comment": "Malware payload (RedLineStealer)", "value": "31f0566a022352f175cd24396d3a3231736d24cf51b48550e934da9a656001fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696738914, "uuid": "9b3e4b5e-c337-4092-9f80-9095f49231e7", "comment": "Malware payload (RedLineStealer)", "value": "9e4310572d9bc1d1de845b02f2846ede09f89552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696738914, "uuid": "2fb372d7-fc9a-4204-ab0a-ad5facc8a6e1", "comment": "Malware payload (RedLineStealer)", "value": "731aec356ce655ddba478c4a62b0e37ff8b8eadc6372a59c0192815c0c03eb730ed8278364dcef82c760d4922aa883f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696738914, "uuid": "6a8db369-6e93-4f54-9730-767d1760e1fd", "value": "T1546523A3F3E44873CCF92B3069FA03831E7238615D64868A3765E98F4D72585A83537E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696738914, "uuid": "4a3587fd-14c7-47c7-9fe5-66b84cf7a63e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696738914, "uuid": "09d5208b-b761-438e-a2a5-11c1ffcffbf9", "value": "24576:0ygFfH86W0zjoeaZBO5qxoQdrKj/nQAProRSRo/5sEv7NoveW37w7kduVZwU:DWf40BaZBOWKj/nQAUSK/5TovXk7kdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696738914, "uuid": "5b1a3cea-1277-40d7-941e-95c20e2b19ef", "value": 1544192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696738914, "uuid": "ece71ba9-1b65-4dd1-b12c-c0ac93440949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696738914, "uuid": "c8613f35-ad4e-4da5-a6ba-c17c2c5a74a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5da3f37-65c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696762348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762348, "uuid": "e6be8b6f-63fc-4d04-b40b-0f65642fc990", "comment": "Malware payload (RedLineStealer)", "value": "e7dfd8269357ba07037fe18649a783fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762348, "uuid": "5070c5e7-0452-4215-995f-5fb0fd59e9e3", "comment": "Malware payload (RedLineStealer)", "value": "3304d837d5a0e0479b234bf3d70bab74293678c3a7ea33c94fbdf808a54fdfc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762348, "uuid": "3544f5ba-c485-4031-b2e4-7ec74bb28fdb", "comment": "Malware payload (RedLineStealer)", "value": "1cae54a7a3046c146404e871fbc33c9389453ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762348, "uuid": "fbb70d68-35cb-4238-b441-06a52673d82c", "comment": "Malware payload (RedLineStealer)", "value": "75241f698a0245e16f7a55efcfe911614019d0d73e6fd8aaae9eb31571daae50f7bcfef7718a92f1567f83c7974c1614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762348, "uuid": "ee633a00-da63-46e4-ad5d-218c18b414f0", "value": "T12E45232263E94136DCB52B3098F613130F3ABD569938DEA71209FD5B4A72688F536337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762348, "uuid": "de0196ca-8008-4a0c-bc99-6979a6f0934b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762348, "uuid": "7c2079e7-2f1a-4e0e-8803-bf45036512df", "value": "24576:6yfe+WWVWDpUffsZwzw8fkzzXS2//aaJ/LmzL0eMXLiG1Jq4Z:BNW1pUffscw8sSUH/Lm/0Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696762348, "uuid": "f615385d-9e35-4774-9b36-3856ad0035df", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696762348, "uuid": "67ae0e8b-ad83-4aa3-bc28-3372a9b95012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762348, "uuid": "87c4da5d-7737-412c-a209-868fe88b3892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed22d9aa-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696793767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793767, "uuid": "e50b3f3a-1e21-42c1-b6c9-e6d9723e5ec5", "comment": "Malware payload", "value": "6ba32bbbcd6cf3b13373302a82be09b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793767, "uuid": "2e21ea1a-024f-45f5-aca6-12ab443c01c5", "comment": "Malware payload", "value": "331561442c919c166c31a4860b750b3dc9803f0c9f60dc2b6e1c24a28cf65ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793767, "uuid": "830fd5ff-f07b-4fd0-81f8-11f094ce9fca", "comment": "Malware payload", "value": "b0f5bf1ebf65e906ce97c80de8f2985fe8e3abd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793767, "uuid": "bfc9d48a-6978-4c09-bf39-0e34d4fd0648", "comment": "Malware payload", "value": "a6c304c6b86a0336380f89a605c457250061f82ec94ed377fd4dd83637b35cc844335f48c16ffce2f605bbcc0714519e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793767, "uuid": "ecb65fa1-9b67-41c3-ba42-89bf18f7904f", "value": "T160E52375B491C577E1B10D79CEA192D6753DBB203C292C9BB2EC0F4E5C7E1D28A2C21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793767, "uuid": "92c74905-9342-428b-8103-148ef02c1279", "value": "c1a1896c511e1df507cce3e5f7bec89d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793767, "uuid": "331cfa56-571f-43be-82b8-0b59cb7d86e0", "value": "49152:06dewCvfh/CxQ5HHUVPVzEyyiGJ/9etPtk1HyM6HHgi/0f0zSVfCajpIDzM:06EwY9fHaVIRcSHyTgi/w0zSVf3pAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793767, "uuid": "5ea2c5ab-1988-4e20-beba-270b0bf2f5b4", "value": 3216160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793767, "uuid": "e369dd5a-d5eb-4db1-aa5d-5b8430018fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793767, "uuid": "33028338-bdee-4ea7-9225-8a78b0e25a96", "value": "SecuriteInfo.com.Program.Unwanted.3923.1453.7893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c158b20-65e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696772935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772935, "uuid": "875351dd-f547-43b1-817d-848f05a13135", "comment": "Malware payload (RedLineStealer)", "value": "be10eeb8f30dd85165f0c468ec2db044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772935, "uuid": "d0b6827b-250f-4f1f-aace-afba22ad1022", "comment": "Malware payload (RedLineStealer)", "value": "334aeddb337488edc9498501134cc6af7f1fc4b9a012410a8fe63bd5a2b6d6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772935, "uuid": "cb47c33c-bf9e-4beb-b939-8af11b1451ce", "comment": "Malware payload (RedLineStealer)", "value": "36463b49a0b840561e851688e43daf972ee15711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696772935, "uuid": "d6f3729f-8b39-4f0d-97a9-b24184249e74", "comment": "Malware payload (RedLineStealer)", "value": "90dd5af6b37db0e5d68d59fed0b7682898b000ea0f0f3b344c8d1a1e50cddf8de78cecd284f24e316d71241d74c49f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772935, "uuid": "7b9637b6-3ab6-472f-8bf9-570f699f92b3", "value": "T13045230367D494B2C8F5ABB058F316531B327DA0986C665A0746AD2F0C72E90F5B63BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772935, "uuid": "691ff588-9ed4-4574-adff-c4bd95d4687d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772935, "uuid": "e33fa544-c300-47d8-9796-5e87cd415462", "value": "24576:iy31/Ps2pJiAcpnRNsc2UlV6g3nuasIXcdrSasUku5YjrN2:JBkWiAcpAhUCg3/bUujZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696772935, "uuid": "adb8a282-e95f-4db1-b6f7-5e10e09df17b", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696772935, "uuid": "d05db979-c9e5-44f4-a120-4534fa33cb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696772935, "uuid": "63e61d8c-cbe4-45c4-b5bd-ff4ebaf93496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec497bda-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696793765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793765, "uuid": "8133c547-059f-4674-8f89-372a5c08ecb6", "comment": "Malware payload", "value": "e857074f286f76a76a088c6ddc4be6f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793765, "uuid": "f13325f9-20c1-4210-8fcd-c410363d2668", "comment": "Malware payload", "value": "338183f71622cd3b8ca2816a3fb8a925731810f40a6d843f82c195fb25384bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793765, "uuid": "0a94af63-53ae-45d3-9e75-58346d40a996", "comment": "Malware payload", "value": "a2eb616a6beaa4f89a4bbc3fa05e11004785b85b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793765, "uuid": "269662b5-c0fa-41f0-aeb8-7ddc552115db", "comment": "Malware payload", "value": "502963bcf6ee5c50536f689b82d51e32616d23a5c1e3bad76b70d39bcbca69dbf41ca32e2699bf57fd17bcb9634f4189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793765, "uuid": "a8f6bd85-b345-4aeb-9f13-104358a6d128", "value": "T1D8D6AEDB798237A5E0A2D0F0802F9D34A752707A8A779C5CB08CAE151425B6DF3E7F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793765, "uuid": "a8930524-1099-43ba-b618-a87402d8fca6", "value": "3b05ffb6feb50551604654284ff6bf22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793765, "uuid": "e423b4f4-245e-4dac-b1ac-cacea2005205", "value": "98304:F1jxUnQEgkSea97xNzOsAvI6XBMHWNLLako9nJUr9nJ0zz9Kp3rSUNOa7:F1jaQrB1xDNgrof4p3rSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793765, "uuid": "b7936480-c759-4dd0-b5a5-582f79ad9deb", "value": 12739584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793765, "uuid": "e5272300-6ef3-49c0-9577-6615e7a2a5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793765, "uuid": "8f238df2-8f00-446a-b5bd-f1b5c7e8c97b", "value": "SecuriteInfo.com.FileRepMalware.26310.29478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cc6c8a-662e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696806082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806082, "uuid": "8dd8c141-4a10-4fd9-a3d3-d3a0859b982b", "comment": "Malware payload (RedLineStealer)", "value": "f6b10a72c68e0af83fdaed9c14eae092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806082, "uuid": "33740615-d0dd-4778-a76f-b80cf393c9d8", "comment": "Malware payload (RedLineStealer)", "value": "3986fafc1246177572db9e6200fbd1ee641e228f7b9dc972d95a195153e1ab80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806082, "uuid": "6b100b59-fadb-4991-88d9-d89dbba0ae45", "comment": "Malware payload (RedLineStealer)", "value": "a1cb2d4017df5d7ae3fd710f80ebe805e7ce84b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806082, "uuid": "b172fe40-07b3-4006-a9cc-c07308839314", "comment": "Malware payload (RedLineStealer)", "value": "1a8dff8df433a711380dd9459f0b78b18cf979d53d5f3870613ac46a94cb559eb5a503bf54617d532f03682451934ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806082, "uuid": "06eed969-d653-4ce2-8757-062695e95693", "value": "T1BB45232259D5C077D9B45B70A9F303C30F3A7DF1A5748A2A1299A88F0DB3981AD7533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806082, "uuid": "ccd3321b-4f0c-477d-9e28-cbf467101e08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806082, "uuid": "cd768032-8469-434c-a859-9caf86a32dad", "value": "24576:UyeCaL5yxt2sVzK6JdB77kokffmPAJXHSrmPeUPd2U3W6rHXyHUSgiL9ga:jeTL5yx8kK6LB77kokffyAJXYmPpl2Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696806082, "uuid": "1e06427f-2ee9-4986-b5c5-00e255951d39", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696806082, "uuid": "1d040c1c-5dee-459a-9140-1687fdf17ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806082, "uuid": "dd648993-69af-4e93-9d37-e2f71f306d66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1781641d-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783960, "uuid": "ac682a61-2266-4780-8f38-d4aa9bb3d5a4", "comment": "Malware payload (Mirai)", "value": "afa2fc59c8e3cee4ead304b6f4d41630", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783960, "uuid": "1d8f0650-99f9-4b29-9b3e-9752194c240d", "comment": "Malware payload (Mirai)", "value": "3a56c0fd8a82638c22edd9e6170cd09b61f3eb3783c64e5cbe2b08298ae35fc4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783960, "uuid": "2d4e69e6-6039-46de-9b9b-9597cc2be3f7", "comment": "Malware payload (Mirai)", "value": "9465d4e33fbc0e9d982a83fddc5a1d886ba45bba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783960, "uuid": "809cc2fb-d892-4e38-8f69-830e63afc0a3", "comment": "Malware payload (Mirai)", "value": "38cf6fc4b27e2f282f1bfe6e2c6290e27404a23ec57e1022413ea5f003069b5b6f03321403a655830820727cb4630397", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783960, "uuid": "b3e0c528-9d5f-4e2f-b845-4e00a3230abe", "value": "T12DE34B1BB5C18CFDC4D9C1B44B9BF63ADD36F4991238B26B27C4AA221D4DE305E1EA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783960, "uuid": "db3b1393-c3d1-4b2e-ae85-fe1b553825ed", "value": "3072:2e0+Dwf9EnxUY153iz6CknhmZDPO5kE2Xy+Ko6QmnC2xVK:2e0+D89Enxp4Kr9/C2xVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783960, "uuid": "86299ca4-c2af-43c0-b559-0cac6b7e154e", "value": 155960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783960, "uuid": "9efe9e0f-50e2-4fdc-a486-5eb2ecd71e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783960, "uuid": "3cdbd8c5-4497-4b3a-9882-99772c57515e", "value": "skyljne.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071a3d5a-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773624, "uuid": "64770d7a-4b79-4f90-9031-8eb765c54501", "comment": "Malware payload (Mirai)", "value": "a7b947bae2604ef8cca878976b8c0a93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773624, "uuid": "0ca9fd49-dc0c-40c2-82fc-70c61d6ef1a0", "comment": "Malware payload (Mirai)", "value": "3aa2908e4921794f34603b828cdd934802e36685636eb4a38b5ec9473f06b5c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773624, "uuid": "e7c65521-3685-4113-9953-38bed621fc1a", "comment": "Malware payload (Mirai)", "value": "68e3e8068b55ed65279f9d84d95d4f6364477712", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773624, "uuid": "1ad6cd3a-f9aa-4228-b54d-70d73537cbd8", "comment": "Malware payload (Mirai)", "value": "2ec9b4f6e04b5d40216e06accb77522f247f7147c931219fe0d4b2d6a8e667dbb16cf95391165a7f9e2a15db2d963d3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773624, "uuid": "67aa7b62-76b8-462b-953f-74a4a680a85c", "value": "T1A593751AAFA05EF7E8AFDC3346A91B4524CD54162588BF75BD30D918F20E24F19E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773624, "uuid": "88ad1644-b7aa-4a3a-8e70-ba54b66bc6ea", "value": "1536:2hG+9sUX9ZBLftSvTKp6/3aM+KyBJkMFlBgl+oJZSYHip:iG+9sUX9fftA+p6GSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773624, "uuid": "883f41b4-5d60-4f42-b411-b2f31a98fc8d", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773624, "uuid": "df34999e-db07-48bc-a17c-81eb87aa4c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773624, "uuid": "1361c045-e781-4533-b598-4eaf2917d8e2", "value": "a7b947bae2604ef8cca878976b8c0a93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50183f3-65aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696749488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749488, "uuid": "44ee7984-48a4-4859-95db-efe408a49bb1", "comment": "Malware payload (RedLineStealer)", "value": "afa59f0ac3540641dd5a4dc6f408fc84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749488, "uuid": "487232cd-54c7-42be-8e84-c2b9a275f991", "comment": "Malware payload (RedLineStealer)", "value": "3b7aeba8e0fcfabaedea717f6f08fe210f1d441b09daa3e11e4ee5c58acb04b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749488, "uuid": "d2a908e7-4c88-420e-876a-3caad728c923", "comment": "Malware payload (RedLineStealer)", "value": "7c65dc7a0fb0e039d0af61824a692af02e5f568f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749488, "uuid": "ecf5aa5c-586d-430e-8acc-dc38981bf7ee", "comment": "Malware payload (RedLineStealer)", "value": "72735011f47068d4e0f4e972fe049f570b0c92f0d2bf1afccd43d7b5bdb07a8e493a39dbd5a881d9231aae0730724c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749488, "uuid": "d3763307-8f37-43b9-bfb4-593dd0c11c1f", "value": "T106352317F7E88275DAB4373068F613830B34BD861878D62B7B67A84D6C72590B07277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749488, "uuid": "6ad060ef-2d12-4d97-8af2-e7c3b8608c00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749488, "uuid": "3fd84a61-cda4-4241-a6d5-67f072439ed1", "value": "24576:iyRiRLrx7m9WXoJ2zo3JFHtppNxh3T2v5TbkB:J+Lr5VXmnJFHlXhD2vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696749488, "uuid": "51067f98-605e-4f71-abff-313dfa26a794", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696749488, "uuid": "67975ebd-17cb-4ec5-a7fa-fb63e83b6975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749488, "uuid": "f2e1edb5-fa99-489c-b9d8-d14cbd981840", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd720b0e-65de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696771836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771836, "uuid": "f1071679-ddba-46f0-ba28-8819e44fb530", "comment": "Malware payload (LummaStealer)", "value": "4c8de425bf9144b244e7117a15cd6457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771836, "uuid": "c94db720-d02b-46ea-9606-a84251abfd79", "comment": "Malware payload (LummaStealer)", "value": "3db9d518ba3f056faa2c0bb8334879cca44cc7d4315451b644c602d503d2b22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771836, "uuid": "07d3373e-ff59-4c3e-ac16-8acf79fc669a", "comment": "Malware payload (LummaStealer)", "value": "4baa7bee867b98055a7219b1e09017ec7b011e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771836, "uuid": "a47fb3a6-6ab7-43a7-9e0a-38ef4e5556ae", "comment": "Malware payload (LummaStealer)", "value": "9fbf4bb306ab9e12686ef49fc42567cde49cbf2cdda1447c4fce092d9d492dea07a70dcde7fde04a1cae9a415259c087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771836, "uuid": "a114235b-a58f-4b32-81ba-98668d69ebee", "value": "T11E15235AF614B43BD24282F61C26FB60212EBC7962C44943FB9C385DAF71783A963357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771836, "uuid": "7ea5c981-58dc-4799-93d6-9ec7a55ff403", "value": "c1026f3bc4dbd1c7779566798486c792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771836, "uuid": "86d7107c-8c48-4fea-8fe7-e16d6f4df60e", "value": "24576:+s9rN9YwPzIFbDslb50xVyiOVCQMJ96IKc9BVZypl:H9rNWwbeP9QVC/Jf5vZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696771836, "uuid": "b1a82fc2-9386-45b8-8dfe-129abe9c2623", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696771836, "uuid": "8d0869d7-cbb0-4472-9206-8cb49b96fac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771836, "uuid": "896ed0d6-cfff-48f7-bdd7-ea312e4ad5a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25678676-6636-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696809323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809323, "uuid": "8cb05664-ac2b-44c8-b4c1-34ceb9131982", "comment": "Malware payload (RedLineStealer)", "value": "66b0dd0417d4316571c38cbdf73257c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809323, "uuid": "0ddb962f-89af-4325-bd28-d439645ceb80", "comment": "Malware payload (RedLineStealer)", "value": "3f6e7e6fe72282c219fa6e902b41765e3d45f36d5290f552e2b0818b35d46c17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809323, "uuid": "bc1a4d56-a3f9-448f-aec6-b93f3a8457d3", "comment": "Malware payload (RedLineStealer)", "value": "de31e49b1944c787483a584f909950d237384ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696809323, "uuid": "ef822172-f849-4bf0-a651-2ef193cd9f1a", "comment": "Malware payload (RedLineStealer)", "value": "1909fb8681f8dc98ccd79ae437f3806b3ed8fc4744aecbf0abdb8cbd2864b62cd74cbc1eb97eedad7537791420efe744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809323, "uuid": "0de72e54-0ba7-45ea-9c38-e61101017e6e", "value": "T176449D1175D1C432D732153209E4EB766A3EB9604F635AEF67EC0F7E8F202C19631AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809323, "uuid": "b0cd7be3-7daf-46e7-98e0-7bd11bcfdf09", "value": "ec52118c8f3a38f5cc07e496f7fb55f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809323, "uuid": "a0ca7ed5-8c21-4bc4-9e4d-6f44c1ac0925", "value": "6144:dD9wfTqHz6GV3Dmsiwyf0LvfhYuJAOrrEz1fAQrQS:dD9w7QzZV36YLquJhkrQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696809323, "uuid": "568ccd1a-0560-44ab-a081-8f41fad15537", "value": 277880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696809323, "uuid": "dbe8de61-261c-4877-aa77-fd741831c08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696809323, "uuid": "89f6386e-cf8c-41c3-a675-7a8a013c3847", "value": "66b0dd0417d4316571c38cbdf73257c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3987c2e0-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773709, "uuid": "5a6bc3ac-40ed-4856-9b7c-ca3acbc5663a", "comment": "Malware payload (Mirai)", "value": "f11f38eab8aa06bd145964bd91feeb2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773709, "uuid": "0c70601e-a077-4ca4-8a4c-64ea0726ad1a", "comment": "Malware payload (Mirai)", "value": "417796fde4ae079d3c75b9e684c967685120dae8fe2d5221013421090897b5a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773709, "uuid": "9e9d52f7-3c40-4f92-a9c6-b4f6d7e29bce", "comment": "Malware payload (Mirai)", "value": "a68cdb95bb6a0ddaa08fb0be0077ab1ac5d813a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773709, "uuid": "accd8b44-5edd-4adc-9df1-f616eec2b880", "comment": "Malware payload (Mirai)", "value": "6784a168e63f597df446585f7404c3cd23b25f824080129dc49fbc18cebfbfa15f3d274ff096066215cec2044e575efb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773709, "uuid": "3594d510-ff48-4217-b1b8-9e1994a02b47", "value": "T15D534B0073948F07F4AA5EF5283F27E483BEEE5016E5F1846A0FE64A8235E335559F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773709, "uuid": "619be94a-e3ca-4458-947c-2b9f65c95c34", "value": "768:rBFWn7icJpjqWBRunbEJn23dZk+0YGadi+Qq5wU05vlYGoWKchU5dM5lyd6grkHp:geYysnMoaAnzdkGoWKQ5CkHevV3XoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773709, "uuid": "62285a45-263e-4cf0-af94-e82e6854cb09", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773709, "uuid": "6bc0ff7e-78e6-40fd-92ac-15740c2eb4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773709, "uuid": "c67f2490-5c8f-4a76-bf54-54740b8823e1", "value": "f11f38eab8aa06bd145964bd91feeb2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a568e1-661b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696797732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797732, "uuid": "12004b90-fdee-4178-a615-2643984705a2", "comment": "Malware payload (IRATA)", "value": "e9d3d297d739cbad06e3ff08483ca5e0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797732, "uuid": "a821149d-5de1-45ff-a435-eac79adfb821", "comment": "Malware payload (IRATA)", "value": "41a2dcb87b585a1c93c7ae145d42d784663631d76b74b5ae6150104cb5cbe5fb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797732, "uuid": "52b59050-ccbd-41bf-a1a4-0b870a361614", "comment": "Malware payload (IRATA)", "value": "bee15aa574b822a178e75a11766148416e66f01e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797732, "uuid": "56ab2320-6152-4380-8fbd-6ad03eedebdb", "comment": "Malware payload (IRATA)", "value": "261be70275f0c806d2cc7bd6c01f12b75d4b2fd1c3d136fd148e35b5b92864068410e00dde596eec14ec55e96d20a873", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797732, "uuid": "07562372-7472-4e67-b677-499234fda928", "value": "T17AF59D8BF7D5AC5AC4F79332817652A661074C268B43EFC36D14363C28BB9D01E5ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797732, "uuid": "7a30a863-d31e-4d46-b748-7d62663abd7f", "value": "49152:2QBMmOKOcG+rHBpgjsvztWMTKy6HrIL/yFgLCrgDWXEoevKen723U79:JGmOy9rHBIsvBNigLCrgDWXEoaK3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696797732, "uuid": "42596660-efb0-42e8-8c19-0a73abc8af7c", "value": 3569618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696797732, "uuid": "3df52d9b-3642-4c0d-a718-cd66affa67ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797732, "uuid": "ae6b0ddf-4717-4fe7-ba0d-7eb7a5961d77", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c2a49c-6578-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696727711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727711, "uuid": "825522b7-6267-4f7a-aec1-70a047bbe49c", "comment": "Malware payload (RedLineStealer)", "value": "6628fcff626d449cdbfca8f7ccbd5598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727711, "uuid": "20d9bd0c-0b36-4e9f-98f0-5826ad95f0ef", "comment": "Malware payload (RedLineStealer)", "value": "42d8403a5e064296dd1e326ae33d13414be635b98734b729fdcde0df9c3aaa15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727711, "uuid": "fe056934-4af7-42c6-a67e-610e47192f5e", "comment": "Malware payload (RedLineStealer)", "value": "bbe3ac4a437f9c8a6c0decdb30c5773d4acfb4ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727711, "uuid": "ce6ca83b-90d5-4e9e-aedc-e508130fbcbe", "comment": "Malware payload (RedLineStealer)", "value": "ecaddfcb9e8ec2ce8c8a0c2e21277f5bb310aa90d80a1cd10136f1d9c02f6e6f93ae4c0136e618fa83614dc6614c6114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727711, "uuid": "a1452a8a-d41f-484c-98b0-7d689370201a", "value": "T1864429DD3854EA94C5D12EBF6909D29EFBEF6132A116C1C3CB41B91D2623307171AACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727711, "uuid": "c8225580-3fa5-44e4-b255-7bafb1348731", "value": "1bc01dfa698246ac804f970d5000ac59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727711, "uuid": "b5b6fdbf-ab49-48a5-8a32-9270cf9423d6", "value": "6144:ol1uQf/hH3qjxHOqMzDBvsBGGGGGGGGGGGGGGGGGGGGGGGSGGGGGGGGGGGGGGGGh:olF/VqjjMZvs6it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696727711, "uuid": "71018dc4-48e4-491f-93d9-fc5a968dbb23", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696727711, "uuid": "f737f201-d6b5-47a0-bc60-f3ab5134189d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727711, "uuid": "0d06bec4-b7d2-4575-9c63-726b5fbdba61", "value": "6628fcff626d449cdbfca8f7ccbd5598.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96cbf6b6-65e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696776013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776013, "uuid": "75486575-0600-44f3-8720-a0237f976ad7", "comment": "Malware payload (DCRat)", "value": "0d341ab3cb6899f5f051b10aaead1eda", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776013, "uuid": "1e50c4ad-61b9-4785-8938-da1e88bfcab9", "comment": "Malware payload (DCRat)", "value": "43824e5c1db3c8dfcc071806b4df30ac44467d2a9ef29c0346c528d21f88c96c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776013, "uuid": "20f15e43-ccc6-4996-8e25-32b212bbe444", "comment": "Malware payload (DCRat)", "value": "846da424dade0c2f79afe17fa1d8aa2a431d85e0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776013, "uuid": "943eb1fc-a0b6-4bf5-a286-26539ae7455f", "comment": "Malware payload (DCRat)", "value": "5fd529387e91f186df43c8c9853fb00c2fffb6dfeaffdae9bcaf2318242455cc14182b76610051ccd810ef9454baeaad", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776013, "uuid": "da2ae165-ffa2-478e-a56b-4b0a6c306f44", "value": "T1DBE5D0117E448A01F1081233C3EF458557B4DE61A6A6E72B7DBA3BAE25123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776013, "uuid": "c6068308-84c8-4309-8a65-935f5bf16c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776013, "uuid": "866bcbf5-44a1-4ced-9eb1-0b3cea439840", "value": "98304:PM0woQggbNhWxU68v4Xi3yAbFwHTE9J/i:N0gOWfackHbFJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696776013, "uuid": "0ecab50c-cb22-4b07-8383-03fe6934201f", "value": 3171840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696776013, "uuid": "397337cd-ece8-40aa-a4ff-e8e803b19e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776013, "uuid": "a8c1ecdc-ee63-47db-9848-9133f539f1f2", "value": "0D341AB3CB6899F5F051B10AAEAD1EDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01842ee9-65cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696764166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764166, "uuid": "ea004dd2-7744-411e-9d7f-a8e801f588ff", "comment": "Malware payload (Tofsee)", "value": "d4af62db2eb455216b3874089a01e230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764166, "uuid": "96cd45b7-6c3e-4bf0-8640-653b7429c195", "comment": "Malware payload (Tofsee)", "value": "446cf3b534f8049cf00817f22858e9c0284f9c78228411956a001ea9f0afa933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764166, "uuid": "a6ece8ad-b0da-4cf1-875b-aab0a4f07aaf", "comment": "Malware payload (Tofsee)", "value": "c0e059be6a5d9c07326a7e8915c2e546c428fa14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696764166, "uuid": "8950fabe-00f3-40fb-93f9-72cedac811a5", "comment": "Malware payload (Tofsee)", "value": "2ffdf0a44a34f309020c6e59b31fc3d6112cb0103d08112d63628656986a719d92f16d8b350fbe61f52ebc4a1a905606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764166, "uuid": "598ce26d-d29a-4cc9-9067-c91a8b98194f", "value": "T1FA547E12A3A1AC21E5268B329E2DD1A4373EFD91CDE9779633587F2F08711E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764166, "uuid": "5caa4a26-84cf-411b-bdb7-ac508c1fefa9", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764166, "uuid": "9f2dd191-ff5e-44dc-939f-664e47d97092", "value": "3072:scSSzrxWCD0ovq8WfiFOenmDSoNP3RjSZRtc3wz9Q0SH/a9:GSRWB+qliFOemN5joRY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696764166, "uuid": "9699eb1f-8688-4a3a-8367-24e4c8361543", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696764166, "uuid": "f5e72a79-ad60-4d30-a6cb-721c26839c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696764166, "uuid": "004615ac-02df-45e3-879e-f7bc81ea2694", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96377053-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696754107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754107, "uuid": "b05ca629-7ce9-4364-a455-061f7ce836d5", "comment": "Malware payload", "value": "09d22e15ebc3e9e02eb4ca818cb228bf", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754107, "uuid": "947af67c-22c5-432c-acd1-587095973979", "comment": "Malware payload", "value": "4568ac5fdc586eb88b48414a7112f81cae1ae36bc3a50c6df77636d18ed6e181", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754107, "uuid": "57fc608f-1545-4bca-8981-13e8de866e43", "comment": "Malware payload", "value": "15b78afffc1ad9c1ee06effdb5afb62a5230e77b", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754107, "uuid": "be40d0dc-35b5-4382-b676-b36ba63c0526", "comment": "Malware payload", "value": "b02f064ad6a8eb8233d316617c0da41fdbae9cd3068959db96a04fc00edd2a32b305ea02da3faefe9a30c3b2c78a2951", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754107, "uuid": "9f4ffdbc-d47a-41b3-bd39-cc0055f52c0e", "value": "T11795336A001F7C55F9211520BE4291A550FB0FAA04B62F2DFFD60EE848CD5CA527AFDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754107, "uuid": "cf0243b5-a3e8-4cc1-b1d5-aa2426934376", "value": "49152:qeYzbPJXb4RGfhFQ+VcMCM0N+KN3GN2H1NPg8I4r8:qDB0Ifhm+eNg2H1NPg8I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754107, "uuid": "3e5a0c55-962c-4617-9156-63cf64aaf3ff", "value": 1939419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754107, "uuid": "f87a3184-5e77-4bbf-8bc1-751e0d10c801", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754107, "uuid": "823d2aa9-7b70-40d6-9d67-203c332d9946", "value": "zip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03368c11-65d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696768893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768893, "uuid": "4f8968bd-36ef-4133-b72c-a3434ccceabd", "comment": "Malware payload (Amadey)", "value": "73cf2935601f0a1e12e3c38607d7fe72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768893, "uuid": "b8ffb653-57f3-4874-b535-773949aeeab0", "comment": "Malware payload (Amadey)", "value": "471d335fed144e67016440fd90dcb44c03ce84f647aed5ea4e0b0e5df215cd47", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768893, "uuid": "bce2176c-cef3-43ca-a706-c2e6cd2ae11c", "comment": "Malware payload (Amadey)", "value": "7089eea194dd0d8ab6adf7d6b651da9db0199fb6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768893, "uuid": "bc653f97-1b96-4a66-b6aa-b588343656bb", "comment": "Malware payload (Amadey)", "value": "8c4d30a84143801a161728c530b1e3b5ed7abc706134ef13458b293f468febc864ba3988ed1ea4dcb12febdf9455d176", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768893, "uuid": "5a65b954-0247-4b22-9ace-0c7f98b96378", "value": "T1914523936AEE2439F97AA3B034FA07D30A723D9214386B9767A1E9970C736C01571337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768893, "uuid": "a797a1fb-4cec-4fbd-9c8d-d1148a7ece00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768893, "uuid": "a2dc4d44-6560-4e29-be86-8e6ea7c35fb7", "value": "24576:KyupcpdqdgPLlJ6m1hJJImOZXgvTM81wuOM6IUzNyahomZR:RugAdEJ6m1hJJIvXoPHyzYOom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696768893, "uuid": "8e578a31-f00b-4d78-af39-979ba71003db", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696768893, "uuid": "edd65835-f87f-4695-9362-656a625d2fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768893, "uuid": "b776d0e5-c8da-4675-895e-850a4faecaa4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837043f0-6626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696802609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802609, "uuid": "a0489520-f5aa-4a03-a915-c4ced269cf8e", "comment": "Malware payload (IRATA)", "value": "e22fcb15edd947fcc9c233b534d22f2e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802609, "uuid": "8fc673f0-2b0c-4307-9501-74b9c08d4494", "comment": "Malware payload (IRATA)", "value": "4766c3d44b642e71338652abd00b9fd70f0e193657272b2a5594dd2ac370c565", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802609, "uuid": "6485d192-a462-4e46-a2ca-a6e00254d700", "comment": "Malware payload (IRATA)", "value": "d59db33864122a5f65a0c20654ee06e8404cdc27", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802609, "uuid": "38291437-4b1c-4efc-a30a-2bf551899d48", "comment": "Malware payload (IRATA)", "value": "246720b1c305340e111cdc7c9f220d309d273d8c13b4d4ec80ddab08a78719c4e467bcd7c6818ef4eb4da8c6d1fbd014", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802609, "uuid": "0d60f120-ce77-472b-aa0e-f630a394a89e", "value": "T10036CFCBF798A95BC4F39332817653A651074C268B83DF836904777C28BB9D01E5ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802609, "uuid": "f550636a-71fd-4ec2-badf-343fee492db3", "value": "98304:6a0a4+MNSgLCrgDDKvoxG/x6NVPeunUjQYM+t:6a14+YJDKQwYnUFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696802609, "uuid": "574ec679-1b4a-4859-9094-532e9e4f76b2", "value": 4950002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696802609, "uuid": "910da517-cbef-404f-8e85-22ecd5060254", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802609, "uuid": "7f27e28f-c58c-4a5d-bae9-14e1e411607c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7e12f1-65c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696762444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762444, "uuid": "0b236680-d70f-4385-a362-812ec7b8ec3a", "comment": "Malware payload", "value": "3d5590ac1ba28af12b2e99c00899e5e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762444, "uuid": "4f2645bc-3e4a-45d0-9e69-2543d0ce0d67", "comment": "Malware payload", "value": "49062d835067b5f4e56a27cb5dc549d46d83de99f85aa1acf7a0649410708299", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762444, "uuid": "86938198-c90a-41d1-9b39-36953cbdaa0b", "comment": "Malware payload", "value": "46a7b10bcae5e6cf54e238cdacc5c830b7a3555c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762444, "uuid": "33b7cd5c-dffa-4a7d-83a6-225c3ceb107b", "comment": "Malware payload", "value": "6852828dd9eb8224c1402a500c51b543046f2c79de7713637f1965ce98893fb413c08e56c6166352e7835cbf47f757b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762444, "uuid": "fa639a58-938f-45b8-ad73-761f3647e4c8", "value": "T1B906DF03EB84DA97C9BAC3F16B370CA92A130F14C6529ADB55157A7D2EB71D00EC5E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762444, "uuid": "bf8c71fb-85c4-43d0-aa63-eff56bad7f8f", "value": "98304:ulfc2lbduCcIX3kSPeVMmzsoPzBQTT0tRNiZ:ulfcQbduQkigbzxacc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696762444, "uuid": "e5c39375-3e2d-496b-b653-3ec246263bcb", "value": 3957080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696762444, "uuid": "7feab50b-994b-4651-8151-be65c6916c96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762444, "uuid": "b70232c1-514d-4a05-8c2f-b287f3b3017f", "value": "3d5590ac1ba28af12b2e99c00899e5e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbe0a07-65ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696756184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756184, "uuid": "b1784013-f888-4036-acf9-01f7fea96bda", "comment": "Malware payload (Stealc)", "value": "581a03dbf53bbf53af8d0d976dcb9853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756184, "uuid": "1c9132c4-afab-4d73-9561-5cad380fbe91", "comment": "Malware payload (Stealc)", "value": "497cd01d63385749dcb5b83cfcda8f33b8099d4ce013a9184a3898b0222ad606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756184, "uuid": "8ae6c0ae-3853-4b3a-92c4-1214cdc793c3", "comment": "Malware payload (Stealc)", "value": "6a55cb376fa7b81f5b9bab807f240b839bad22af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756184, "uuid": "2a04c88d-3b21-4d87-9dda-69aff7162a8b", "comment": "Malware payload (Stealc)", "value": "f1266e4c386b494ef1d4555547acfbf5e152897237806dabce44450e8f64826d2e878377f9cb2b341ddd2dc228b04654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756184, "uuid": "11ec622f-af8b-4484-88f2-93464d04469d", "value": "T1A3547D02A3A1AC62E5264A329D2DD2A5772FFCA1CEE8679B33547F1F04B11E1C572713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756184, "uuid": "9c799078-8152-4bdc-9355-6409ba831d57", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756184, "uuid": "e58ff71a-65c4-4abd-888e-7ae7e9eba80d", "value": "3072:FXgoEC5HWY1W3Fg8I8zs2Q2tdpBzlnsTH8G7CaJK75fwYlQfGWTdHQcrCI7/a9:FlEwFWVJI8Qx2vp/sTNU8tTdzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696756184, "uuid": "bbe41417-e167-40e6-b004-d4c718e614b9", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696756184, "uuid": "359d333c-c502-44d4-a1ac-4759e901fa25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756184, "uuid": "cb24ddce-b07d-4712-8db1-e27245d990f3", "value": "581a03dbf53bbf53af8d0d976dcb9853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bc2e1a-661d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696798697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798697, "uuid": "93d99b4c-7b82-4f5b-b888-e7da44bd7ed4", "comment": "Malware payload (IRATA)", "value": "4d80dd5fe33e7fc62ca4d1da0fecaf1d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798697, "uuid": "dda5c7e5-b063-4383-bb21-c58e92c58a13", "comment": "Malware payload (IRATA)", "value": "4a0c43a0c8386a60687f995579835371e2473b93a730bbbb497941e8f7cdccf4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798697, "uuid": "4df5ea1d-7305-4629-98e0-1d458a23b8d7", "comment": "Malware payload (IRATA)", "value": "170b8b58f1e83c7cfcae48c0608be965aa7da7f6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798697, "uuid": "9acb84aa-349f-4443-8aba-47e98d43cde3", "comment": "Malware payload (IRATA)", "value": "c76fb1c179b2fe3fbd83de217c8f645e95ade7e96d597237f54b43e3a2859f2065e6c9389ff15875901f51bb919288f7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798697, "uuid": "27dbf7a4-39ee-471a-a821-83de569b2314", "value": "T14CF58C87F7D8A95AC0F39332C17652A691474C268B83DF836D04367C69BB9C01F5AACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798697, "uuid": "a4d58434-9b52-44f2-ab8f-dea4bdf0aac0", "value": "49152:nPSQWc/ktinEJkJLIETWHrIL/yFgLCrgDmj4XZR7kP2cxVA:Pd/xEJkJLpTOgLCrgDY4pRyD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798697, "uuid": "271cd583-2a3b-4ab6-badb-a364b8dfe9e3", "value": 3520466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798697, "uuid": "18e5f711-e283-4e75-b5cf-fc764c4a6177", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798697, "uuid": "ddab4631-b885-473e-9090-d8f29855daf7", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b30fc1-65d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696767010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767010, "uuid": "27e4dff7-701b-4e78-a9b6-197ab1516f4e", "comment": "Malware payload (Smoke Loader)", "value": "489c80814e401378c221f965c3bb8797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767010, "uuid": "a885ba5e-a2a4-41ab-a810-924f321db844", "comment": "Malware payload (Smoke Loader)", "value": "4a8e7710aad3b1a23f3a8255f1327c53301856f18ba4291efd7c06da109658c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767010, "uuid": "7968192d-c0f5-40f7-b71a-796acbf95655", "comment": "Malware payload (Smoke Loader)", "value": "2730b1d41b203f5aeed3c6cad4b4a49ac61a1140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767010, "uuid": "9e132225-810e-495d-855d-a475660a0f80", "comment": "Malware payload (Smoke Loader)", "value": "3dab4bdec8cf9cff763245ad3a7783c0dd308bceaccac135d14a7c197e4632228c7abca8b84700fe78ffe222bbea7ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767010, "uuid": "89f30072-7910-4365-8e92-c00d5951d41e", "value": "T1A3547E13A3A1AC65E52A4A325E2DD1E4373EFD91CEE9679B33147F2F08710E1C662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767010, "uuid": "a42032a7-0741-466f-bf31-247023e54ee5", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767010, "uuid": "7eb85e7f-9fcf-48d0-bb88-743575317060", "value": "3072:OcSe1aPO0BW4OI/mknVHcKkxTmnJRExbEQqSJ/a9:4e4lWHumm2xTUMxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696767010, "uuid": "b91b7efc-e532-42f1-aaf2-30a19a350830", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696767010, "uuid": "7ed190f2-36c1-4d38-93c9-812b73d4064c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767010, "uuid": "da954a38-249d-4c6b-9bc1-4ef1dcec8cf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f20246-6632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696807812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807812, "uuid": "4687e20d-87c3-4745-a78a-1c5464092c27", "comment": "Malware payload (Mirai)", "value": "3c0eefdf933699fb6ff9da6b092a2b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807812, "uuid": "50eef517-2b02-40f8-8f44-c7904b85723c", "comment": "Malware payload (Mirai)", "value": "4aeacd56e616112c87276b4a24ef4ec39b9fa2dd8dbb369fa044327fb0b9d937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807812, "uuid": "31f50946-4b78-4414-8c0d-d782e14b5e80", "comment": "Malware payload (Mirai)", "value": "13273722846baea4afe90a293482a3eed508afa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807812, "uuid": "7d0cee9c-6464-4a62-a004-e1c6b6ad7709", "comment": "Malware payload (Mirai)", "value": "bbbaaff09afaf8fdeef12d2d1b35209871bb35344e738c66116739330378397ad490844d63904bbfbd5a8cc9dec04f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807812, "uuid": "8d377126-ff76-4647-a469-fa17e91717b1", "value": "T1B0D33A46FA818F03C4D5177ABAEF424533239B64E3DB730699285FB83F8669E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807812, "uuid": "e66696bd-35ce-408c-b03f-86765af5cd41", "value": "3072:fEXNFLARLyT3XnSpw4yibkqWqd5wCKT9cCHb3M/9izDD:MXNF0lye/yqkqWqd5LKWCHzM/9wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696807812, "uuid": "5468a035-9e74-47bc-a7c8-49921baaa5ef", "value": 130772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696807812, "uuid": "ebb75bb5-f45b-4d4a-b41a-a4ee413413a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807812, "uuid": "bc462a67-3b8a-4ad9-bbde-9da3cf20bc84", "value": "3c0eefdf933699fb6ff9da6b092a2b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09a8e79-65c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696761077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761077, "uuid": "a2a6914e-1acb-4196-83af-8c7ed20c2190", "comment": "Malware payload (RedLineStealer)", "value": "046cf1925261490337b7f6266ee1eaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761077, "uuid": "542b7c8d-df01-4d44-89a1-ac28afa75e91", "comment": "Malware payload (RedLineStealer)", "value": "4d09119d9a264e45ac8e6931738eb79f52b44f217dbc10ed72056cbbcac2d836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761077, "uuid": "92f8a63c-1fa4-4ae0-8ec4-db45ec4f0756", "comment": "Malware payload (RedLineStealer)", "value": "946ab17d8267f21a053b22ee49d49dcf9f73d701", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761077, "uuid": "1896c7d1-bc68-4473-a7a5-35e534a55d33", "comment": "Malware payload (RedLineStealer)", "value": "c60c951d6d218020e98642bdfd10c5db75b234502ff47912344297dc4e758512de3664772ceb1199abdc6f9ae55cb437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761077, "uuid": "40b7c9e3-e60e-46bc-a2f2-eec8d64f5b7b", "value": "T128452311AFD494E5E8740BB1D9FB5B830B753DE15CB942271A889A6B0CB3B50A83137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761077, "uuid": "5ede2b55-6f34-49e1-82d8-43c67ca4e1f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761077, "uuid": "0387b3d7-ac47-4f42-8b3f-45f7fe347b57", "value": "24576:Ny1JTpSIdn1tX7YpXalsURlXDLtRUD8zNej3:o1BNn1tX7YpKlsU7LtRU8Nej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696761077, "uuid": "20bcddcf-cb97-43e9-8ca2-83d9b01c25b1", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696761077, "uuid": "0d3e659e-154a-4e87-bd01-85c6c7bb4311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761077, "uuid": "6be98e44-1ace-49eb-8f5e-40f5fbfd7cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285ee29f-6570-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696724288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696724288, "uuid": "57819929-4778-469e-a469-b2e122bff079", "comment": "Malware payload (RedLineStealer)", "value": "35a037c26d5981deff69887d2f3b7562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696724288, "uuid": "5ea724e2-2df7-426a-b537-a76e30f40a19", "comment": "Malware payload (RedLineStealer)", "value": "4d14853782dacc5e1ea03d8d5d2e0acade98ff7d3dc4ddd2cb13e6d42392272f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696724288, "uuid": "dc8b66bc-84d2-4173-8e66-3f2ab0bc8911", "comment": "Malware payload (RedLineStealer)", "value": "e1d9711eb8f59364a4c7b94573cb5931b837796f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696724288, "uuid": "87d96a16-dcbb-4404-9557-eb590b42732a", "comment": "Malware payload (RedLineStealer)", "value": "0d73947fdcddcb5f0bea5b455acf1e2deb72d2f46b50335412ffb87ba247cd2062213da338baacbfd56fb6c4b0a62fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696724288, "uuid": "048c6885-ad10-41c5-8644-5b22180603be", "value": "T1B8652302DBE49033DA75377060FA53830F32B9662C69D7AB36D19C5E5CB2984D872B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696724288, "uuid": "32e1c170-0067-4d6c-88b1-9994dae13cef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696724288, "uuid": "50a716d0-594f-41fb-ab47-89f0366a7234", "value": "24576:QyhJunTA+WXXtyhvYpGoDVbiwfAdaPE1CrjAj62XrgjeS7tm0nXae8aBI:XhJ2A+2yWVVbiwHP4Crc7stBnmaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696724288, "uuid": "c2604a9d-9998-4849-b0e8-8d50c6161be3", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696724288, "uuid": "c42b02bf-7f09-4aaf-8a88-68f1c00619c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696724288, "uuid": "ec7088e3-75e8-4a6e-990e-3218f7e937b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31bcd76-6632-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696807816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807816, "uuid": "9b087e82-2cad-47c0-bf5a-4718bb3799f4", "comment": "Malware payload (Mirai)", "value": "3a4349cda4f272e7d05f1a1a44cac0b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807816, "uuid": "5a12da20-1b52-4d0f-825b-ac1f8a58dc99", "comment": "Malware payload (Mirai)", "value": "5005eb8ea6c774ca5ef1b2af2624642842b96b2db91e1fd116dba36ea5073d75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807816, "uuid": "73089ddc-8abd-481d-8818-aeac4ac0cbe2", "comment": "Malware payload (Mirai)", "value": "8b8e19584d0bba56493bd4446c79601077100e75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807816, "uuid": "76e891e9-ceb1-4c6b-aefd-7516fbd28b5b", "comment": "Malware payload (Mirai)", "value": "72c86a155bffa2a864e12c251928b120767da7d3c9e39f6e332a6c20846187db8a4aa70c38ae8c7c1814156d5d25de74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807816, "uuid": "56030ced-17a0-4a77-b103-1bb44096d076", "value": "T12D431645BC918A12C5E062B7FB5E818C332523B8D2EF7307ED212F55779A81F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807816, "uuid": "ca8bb591-69bb-4f07-a256-c4761455785f", "value": "768:m85PX6ueAQR+XGbEpd3Y6A/ZqVHkPgtKfoaS2oOd1BbJHPvt5CkcsfpbNyXy0JKi:LPKuBd3YtEVHk/1BbJvvt5rcZXDJvDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696807816, "uuid": "816df486-dc45-4880-bc7e-d2023b874ea1", "value": 57000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696807816, "uuid": "8babdfeb-809a-435a-9d05-4de3fac071e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807816, "uuid": "b3bcc3af-7dbd-4efa-9d41-709ba2bb0342", "value": "3a4349cda4f272e7d05f1a1a44cac0b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d907e949-6633-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808336, "uuid": "e02baee2-3838-46e8-9600-4c71b39bdecd", "comment": "Malware payload", "value": "b52920a62d824d538812f9fb8bf563c4", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808336, "uuid": "53f3bdcb-e4e4-49ba-aa67-0fceedc43425", "comment": "Malware payload", "value": "50dfbc1f6e3d3177449809d932d12206961f9247f624cf1eee951d1fbcd60511", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808336, "uuid": "ac71c7ad-ff28-451f-b850-e0df8e321ef3", "comment": "Malware payload", "value": "3644b453e11802e0519b255d57fa7a1f34199001", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808336, "uuid": "0098b174-9d33-4127-84ad-b7db1aa01066", "comment": "Malware payload", "value": "e0d9993abe9d8a93cd8f7d8da3ea6ea1e94f51df6888787100405d12a093a7163322081ccd4f90ec23dd77e0a2abd087", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808336, "uuid": "356af367-2218-452e-a545-66c123cc6dce", "value": "T14FA40E15362CC76FC508453DF136882982A6528F3276F6A78F60AC9B7E077C7591F8E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808336, "uuid": "91fc2010-91a4-43c9-b9dc-a2eb97f7d816", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808336, "uuid": "0642e670-2707-4bf1-8d66-c40b944aba97", "value": "12288:f60CsVujMTOxxHtM2DdJS7GMUzB2grWrq:tRUzJrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808336, "uuid": "864ba330-9af8-410d-9818-25ca90f8b036", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808336, "uuid": "8e8ae0e9-9ac8-4c64-ac4b-fd442e981137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808336, "uuid": "6d02745c-05b4-48d3-adf4-0ccb7b35e3a3", "value": "obcliKg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a2077f-65ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RevengeRAT)", "timestamp": 1696776918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776918, "uuid": "0dd80fdc-71a5-49aa-b8e4-dd73374a8ee0", "comment": "Malware payload (RevengeRAT)", "value": "5a3fe2b16102676e5d544d2887996b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776918, "uuid": "4c47e96f-55ca-4afe-a981-277ce3751a17", "comment": "Malware payload (RevengeRAT)", "value": "54415bb6bb53153601096390f84d9306b5476f98b96908ebcf144bd0b7569f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776918, "uuid": "b9180c73-613b-471b-944f-47aca27463fe", "comment": "Malware payload (RevengeRAT)", "value": "0d55efec487bcca7488b4a6dba6dd568fd21b846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776918, "uuid": "0501e5d4-7993-4a3e-aabd-591e7e87eefc", "comment": "Malware payload (RevengeRAT)", "value": "7071c6f7ba2cf9e661e275aa09a35cceed121838ecd570a3cd2062b1307da8c715effff243b9d34e2e31f9aa8c90292b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776918, "uuid": "c3f8c78b-59fd-4994-87b5-0d4a31fb0d7f", "value": "T125921A9BA7FAD623C4BC37BD496123024770C78B8522D77F4CD4A8AB6BB369055407D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776918, "uuid": "3f602b41-70c5-4e55-a2b4-a67f7a3c205a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776918, "uuid": "7f0b7561-2df7-4d44-8667-42c094b5394f", "value": "384:ZGzk5TqjkV5ULD6GieFVKoyRsSap8yzDE:ZGzk5E/LWGie3eODE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696776918, "uuid": "2840a8d0-6e3f-49ca-b6be-ed12bff8529c", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696776918, "uuid": "ec2a3129-1375-4763-8442-df29b9f57dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776918, "uuid": "df86d85b-405f-4ef2-a2d5-58ac3cf7285b", "value": "5A3FE2B16102676E5D544D2887996B6B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0b33ed-6582-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696732295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732295, "uuid": "76fcd0fd-91c2-4808-a489-160bed96b0fc", "comment": "Malware payload (RedLineStealer)", "value": "376d6840f90bc342e4981a1874d39a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732295, "uuid": "be233a74-6591-4b23-a042-c6d96f4d7e0d", "comment": "Malware payload (RedLineStealer)", "value": "546bb11ec56829b56c440049e6dda7e5af885088006f46af38da54eec8a69eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732295, "uuid": "c3dff54d-6174-40df-a4c8-2e80a4c0afa7", "comment": "Malware payload (RedLineStealer)", "value": "f748cf0c973b62c7d35c655a1d6f3f551a5660e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732295, "uuid": "20225be5-16ad-4324-9ea5-a81aa7f3e52a", "comment": "Malware payload (RedLineStealer)", "value": "f1242fc7ee3744e0f7f16d58f20feb6124bd5e193a0f9277af893af4b6d466c776e5b72dbf3236820fb479d761e81571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732295, "uuid": "0dd93cd5-06f8-44ef-adba-ebc3bed333a9", "value": "T1AD652302ABE05876C6B9B3309CFB4AD316357EB0B83C436A37516D4F0E726646A35327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732295, "uuid": "1749dc60-319b-4340-b8b6-2a8ebf286fac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732295, "uuid": "26c2e938-ff25-4b16-97a8-04808fb22c3b", "value": "24576:hyT2Zr13aG4L0wHJNJ0Z0fS4Xa8io5DDeuAGFAryn7dWTRERPT2/UHP:UT2J3bnwpoZ0fS4q8j5LSryn7dzpTm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696732295, "uuid": "dd3f3c8f-deef-4c15-905a-e79da22c3f47", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696732295, "uuid": "916b3951-4f70-4a25-a6dc-055a66df774e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732295, "uuid": "94c5b048-185e-4479-8e49-cf4aa057ba5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72981672-661a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696797427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797427, "uuid": "16438014-eb9c-47aa-904a-f25a36df6207", "comment": "Malware payload (Smoke Loader)", "value": "29292ee21ccf3b6b263667b21ac48f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797427, "uuid": "7f056d27-fe68-4e71-b92c-235fa71cbefe", "comment": "Malware payload (Smoke Loader)", "value": "554543925d158b12b6034fc16203122545d01d345a709f1bfded57a79ec2cb3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797427, "uuid": "a8fa23ac-3d42-436b-8e99-a5982e119a1c", "comment": "Malware payload (Smoke Loader)", "value": "2b195cad837c82ebaeb3f102a9ecbe3d2bb33802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797427, "uuid": "c15ebbc4-4b4b-495b-a45e-68c3e01255c4", "comment": "Malware payload (Smoke Loader)", "value": "9c8c5fb0167408cc39e2bce411d824995a8255387cb10c09772bebd049557f68ca477a1896e0db2d00717831e1e806a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797427, "uuid": "59e850d8-a5b8-436e-9130-5fc61bf647fb", "value": "T100547D1363A1AC21E52A8F329D2DD1A8373EFD91CEE9779A33147F1F04711A1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797427, "uuid": "e34c46fe-7984-4ad0-a4d6-122fd2cc8e9d", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797427, "uuid": "3b6df0c5-bb97-48fa-ad4a-405dd35dca60", "value": "3072:xB0grRoyx4h8fqfhrYppozvuT/emqYHQb6KvQYVeQYF/aT:xNr7xg8WhrYppOWT9qYHQb6KhFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696797427, "uuid": "9cbc752f-124a-42f7-aa73-9ee58dd726c7", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696797427, "uuid": "b8dd5c32-bdb6-423a-a847-77b6bcf9dd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797427, "uuid": "f130ba91-7e52-4cee-b9f8-8effca190491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6668031-65b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696754645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754645, "uuid": "3b0177e4-8f65-4231-9727-8adbc451216c", "comment": "Malware payload (RedLineStealer)", "value": "e32b46dd74176239d179bfeac1e02954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754645, "uuid": "96b3713d-88e0-4d6b-b6bd-4d2309ecffdd", "comment": "Malware payload (RedLineStealer)", "value": "5742dee4f6bb6e780bcf043beabb76828d722a681e785ec9da5809f7d7546a60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754645, "uuid": "917b1a52-b3fc-4fd1-b2f2-dc062ec9e8ca", "comment": "Malware payload (RedLineStealer)", "value": "e64600c7f01b36d073b133a7f0587ee631663767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754645, "uuid": "03da2446-f8bb-40e1-8c9a-bdebd8a7bb57", "comment": "Malware payload (RedLineStealer)", "value": "3f92d943427b1fdd6103e79054dc232c5178ceca72efe4fd9060a0124857a3374e951321e9d5d6cd28714a57a774579b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754645, "uuid": "2daa2904-bcd5-4aa3-bb23-76e6344d7eda", "value": "T1F9352307AFE44476D4B83B7069F606C31E74BDA81C68562B3346AC7E0CA21596D37B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754645, "uuid": "4f0ed4f2-ba88-4f89-aaee-c486a1e1593f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754645, "uuid": "014a6193-8894-4aaa-9616-8ee3224ed73c", "value": "24576:CyWr6uD9UjQYYE/8iMCaDjlHcqU9FRpWm4w0PaHVROqvAHJl:pYdJsYIvMCaDjl2/RtROGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754645, "uuid": "d9267b69-9d86-470f-9598-d7d01ce94532", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754645, "uuid": "c7295a39-380a-4014-8b78-7da3acef1519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754645, "uuid": "be012574-d35c-43f4-aa6f-f05f9ff22d97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dec857-65f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696779982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779982, "uuid": "417e0f43-deee-49fd-ac47-5f891a1d4dcf", "comment": "Malware payload", "value": "1535e444ed04195a61daec17dc7d8b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "underical-cc", "colour": "#EC977D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779982, "uuid": "dc8d546d-309b-4d25-b946-2c444cbfa91f", "comment": "Malware payload", "value": "5785d79a31afcd5abe33c30d3cc5647f1b0f4ab4b8fb86790792896f5cf1550b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "underical-cc", "colour": "#EC977D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779982, "uuid": "edcb0006-b735-4389-8b75-0ac66a03be37", "comment": "Malware payload", "value": "347f7b3851cda3ba10b64a26f456a71f791b19db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "underical-cc", "colour": "#EC977D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779982, "uuid": "b28a9aa5-856b-4141-8bc4-4aec6efdefeb", "comment": "Malware payload", "value": "397f0e11da5e886bfc90c03af513c1831da4c2a69b8846cb629a464866f355e536f9189273400452d5b8af34463f5f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "underical-cc", "colour": "#EC977D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779982, "uuid": "206717df-f45c-4118-a48a-9a1326e64ef5", "value": "T1828623D562889BBCD0C3923C714142A970D06DCC88F9C959BFDB6C13BF61CAE11A97E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779982, "uuid": "53423c69-ff9b-44d0-b198-26487626757b", "value": "c269743ebbb3816fe656e57159e214ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779982, "uuid": "9fbc9e90-c824-4de6-baee-c513514f39b9", "value": "196608:9gP8u1r1tfmoq41A5LHQZ9xrN1VyN2VBw17WpcRjoWUaQIcs:yP8crBq40HQBRygPu4AMaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696779982, "uuid": "ae38c072-1044-40fd-ab54-df21d2f6306d", "value": 8545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696779982, "uuid": "c3dad3eb-cc0b-4256-8f8f-f824433fddb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779982, "uuid": "0d7ece1a-06c8-4009-8b06-c93649920254", "value": "c9kboaui5wasxyxb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253161af-6622-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696800733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800733, "uuid": "4fc4ac8b-18c2-4934-96df-5323dade65c9", "comment": "Malware payload (IRATA)", "value": "1328b5cdbd343cabdc8eecd608093b4a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800733, "uuid": "085e452d-84d4-4f31-b950-ca1ffadb91f3", "comment": "Malware payload (IRATA)", "value": "5894f82211a1bee2cd921a1863671ffd35f9916b769188d251beda28127d0bb8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800733, "uuid": "6852a584-ad00-4379-a24d-7f00fec8b385", "comment": "Malware payload (IRATA)", "value": "ab2e645145fbfcc35e70675a431133c240667c0f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800733, "uuid": "8ca72657-a078-413f-8f41-cb4e6d58058a", "comment": "Malware payload (IRATA)", "value": "2764a7249ecd9fff6ff459bacc2ec2d9ba7273ee6e1cb29275a066403e4c01681afddeae371418b17d11cb9e96fb4580", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800733, "uuid": "1d18a06a-442b-4bdd-8287-d424867032a8", "value": "T1E426CF87F799982FC8B764B5895F537162275C0587539BC36A407B2C39B32E88F29BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800733, "uuid": "5e417c1c-0ab4-464f-8de4-bd76de4f961d", "value": "98304:l/cmREiUhsj83uKyShNSBOzcXiytTzEYo2gLCrOwMfv:lEqUsj9PSqBOzcywP+wYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800733, "uuid": "977b5d38-2fb6-454b-9eee-a95ee7ec6d71", "value": 4420593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800733, "uuid": "aec1c125-6c3f-47e3-93b0-ab3295200eb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800733, "uuid": "80f08247-ca84-44a8-a04c-b8f02036f6e5", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec4649c-65bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696757182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757182, "uuid": "c845bb1d-813e-413d-becf-d2af6eb651d5", "comment": "Malware payload (RedLineStealer)", "value": "2a859139fcfddaecc767434915b67c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757182, "uuid": "6b120d0c-4a9d-402f-9eb0-63cfe587d777", "comment": "Malware payload (RedLineStealer)", "value": "5c8433a27512bd58126d9c22b0f755659033b1913af1bd441c8953ea417bcc8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757182, "uuid": "424e30cb-f3ad-44f3-884f-d9160a48abc7", "comment": "Malware payload (RedLineStealer)", "value": "fd8ba770d64dc32013154057540d12675020a868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696757182, "uuid": "57961632-32e0-4557-baac-6def37496e81", "comment": "Malware payload (RedLineStealer)", "value": "21860f459ed0c580bebd169e697d75aa63accb23d8280f48901b92e5c2c50077437042d9b3ab0c3f623cb1165d9018bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757182, "uuid": "6fc9660c-35ab-46e2-a7b4-58fafbd702c7", "value": "T10F352303E1F85572D4B81BB059FC13E71936BD61593C8B1B3B4AE94B08B29C2A83576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757182, "uuid": "eda31e30-8f10-4eb9-9c14-1d1bd99dfd77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757182, "uuid": "d910328e-5605-41ba-925b-03dc18b54458", "value": "24576:my4/633GUFtGfsOC6U6Dl+ZbHl99OhIURXZIruvf6:1qIPFwC6UCUbl+IGJYun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696757182, "uuid": "c6d32a72-93d3-4d04-ab7d-ddc63df5b60b", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696757182, "uuid": "b0a68ca1-601e-4baf-b286-35288f75b9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696757182, "uuid": "786dd11f-e13b-4ea1-989b-0505b663f17a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcbb8b3-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696793768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793768, "uuid": "d89cbff6-7bb1-44f3-9139-070a43030c9c", "comment": "Malware payload", "value": "ac4d79452a683b1de5b4aa6d7551c502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793768, "uuid": "a10d153d-a56b-4520-bf10-86e94f9a0c52", "comment": "Malware payload", "value": "5fff5b86dcb2fcf85d7bfa1398bf1aa78bcbaddf462763e51adf1d286c82f36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793768, "uuid": "ca06a209-6f9f-4f59-ab9a-13425b846419", "comment": "Malware payload", "value": "a1a1f44fe6915e6469b881a179251fba284bd6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793768, "uuid": "8ae6b325-f0c1-48b6-a433-079860fe3427", "comment": "Malware payload", "value": "82ce102f8ec987d51ced3764e7ed14ef863e693ee17dd39bf48a70ffe7f7fa905f1ffa3f586375078a54f0a45786e047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793768, "uuid": "23ec8981-1c0f-476c-bdd1-972e5590caf4", "value": "T19F0483C33F688A84E2905AB452379158AB3FBC931077A9966144FC1DC7B3B47B2E07E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793768, "uuid": "e260c6c1-116e-4bac-b076-29f1d9d32fd7", "value": "a4e92bb60f01e6d7ce91682f59d6a78b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793768, "uuid": "5b433116-0cbb-4f97-8380-212b7783b4d0", "value": "3072:GDOuQus4SxrucN9s7fxkbKJJ9VbVuqATJZJOnV9J5f0IL0CTKrB:G+D4L7ATJ/IL0CQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793768, "uuid": "69ad5dfd-316c-43ca-b29c-4060839f568a", "value": 174928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793768, "uuid": "f95c37a3-61f7-4d59-a984-cb0e40b87fc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793768, "uuid": "7ce9637d-3449-4abe-84a1-20c9ded19ee7", "value": "SecuriteInfo.com.Trojan.Dropper.15650.20327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8088e7a-661d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696798805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798805, "uuid": "7d4aef64-e6ab-401e-8c8c-202250a85fd6", "comment": "Malware payload (Mirai)", "value": "caf835dc4602f8d902009da865b60e3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798805, "uuid": "42ffa73c-a9ab-4e76-a203-f6d4829fec87", "comment": "Malware payload (Mirai)", "value": "61ade0891c480b8fe1ff1022196ba9ae390bf9de97c9557cc580803c743a9853", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798805, "uuid": "29edb35a-137a-48cf-8bcd-fa77413290bb", "comment": "Malware payload (Mirai)", "value": "3858723e89229f0b1baa3bbc21753be743494115", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798805, "uuid": "38bf70ec-778d-44c4-a2a5-e47378eccb88", "comment": "Malware payload (Mirai)", "value": "0b93005c133c1eead39dd7665c3f9d75d6628ff2c5517e7f94119fa8635df310b2bd2b1b4be5df0e257c1b08dd761093", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798805, "uuid": "4a438b2e-e446-4087-a05c-157dcf3ef18c", "value": "T13ED33A46FA818F03C4D5177ABAEF414533239B64E3DB730699285FB83F8669E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798805, "uuid": "143bb01b-e167-418d-a93f-9df69474d7e9", "value": "3072:fEXNFLARLyT3X/Spw4yibkqWqd5wCKT9yCHb3M/9izDD:MXNF0ly+/yqkqWqd5LKgCHzM/9wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798805, "uuid": "2d71d495-18f6-4ba0-bf16-92a064cca7cb", "value": 130772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798805, "uuid": "0f72968b-70a9-44cb-853a-451022ad8b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798805, "uuid": "b9ad2adf-a462-4a18-9e3f-0c0402593182", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1c8382-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783944, "uuid": "fd66f75a-c7cd-4a33-84e7-c7578537f858", "comment": "Malware payload (Mirai)", "value": "44898906661edf54fbdf80a7d51c56c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783944, "uuid": "edc19950-0daa-4b38-9b5f-b3d988f28d20", "comment": "Malware payload (Mirai)", "value": "6301a010e2451436c2c6880d74580a0c5901f6eccb8e9a2c611975ae6dadddeb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783944, "uuid": "184cffc3-a664-4c70-aa46-c79d7b822296", "comment": "Malware payload (Mirai)", "value": "07241bcd7cca2fdb98fa1c2eb987cc194e899831", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783944, "uuid": "f75f63bd-e83e-4344-9630-c72ceded7e5d", "comment": "Malware payload (Mirai)", "value": "4af4672537c4f1fee8433be859f552150e91f76600cbab8b03e3487533e096960a5651d3a7b2411c281ed051b5a06090", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783944, "uuid": "8401cd0f-c394-47bf-86dc-a97d6914b928", "value": "T12504C91E6E228F7EF668873447B74E21975C33D627E1D684E1ACC1106E2439E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783944, "uuid": "5758b3aa-03a9-4191-aba6-d5caa58179e9", "value": "3072:zQ1A5PKeRS7COc+lWz+XcdGJzxeyDqrMlqu:E1TeDU/cKz8yoMlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783944, "uuid": "c75f9701-99ef-4673-8c92-296512cc39ce", "value": 188140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783944, "uuid": "e289d9af-7924-4c9e-94b8-96253f262f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783944, "uuid": "d3829d52-11c4-4faa-8387-365689420cb8", "value": "skyljne.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e692ea7-6609-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696790172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696790172, "uuid": "2b45ba7c-1f87-4212-8d1a-4b1fce284e89", "comment": "Malware payload (Smoke Loader)", "value": "156dcc70147075fb48d570533dd8f6e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696790172, "uuid": "51b4471a-aa32-4b30-acdd-08224c206a68", "comment": "Malware payload (Smoke Loader)", "value": "63051a26214380ad54dde0ce6d6568050a9dda22f2f3f52616c355ee0edf4eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696790172, "uuid": "819718b4-7d58-4990-94a7-6e217d39a324", "comment": "Malware payload (Smoke Loader)", "value": "10b6d8b72f105a8229ff02a070f43cc1a5a9b844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696790172, "uuid": "e8a2cb83-2ab3-47aa-90fc-4119a89827d3", "comment": "Malware payload (Smoke Loader)", "value": "10e66b54b27bf0a91b4c80d96ea5e59fd4a1ce0ff37d33a364e056ed5f5c86cf7edbc713dd16658a7baadf77f678c717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696790172, "uuid": "6fc7a815-7a31-41f3-a1da-862b2f7c1325", "value": "T185547E13A3A16C25E5264E329E2DD1A4373FFD91CEE9B79633146F2F08711A1C663B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696790172, "uuid": "95154f44-930c-4ed9-914a-cf53af337fde", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696790172, "uuid": "a6407bcb-19de-4c61-9e7c-7caa4fee3f58", "value": "3072:j0SJQYv4h0qnnoOFAlmOseidqqwe7rhNCdpm9Q8wQC/aT:FZvg0qnoOFAlmOxidqq/M45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696790172, "uuid": "1492d969-2bea-4601-8617-c527de03b40e", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696790172, "uuid": "7f4e649b-d9fd-4ccb-a7fc-bd3fc1073cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696790172, "uuid": "a8f577bd-bf31-4874-b7ee-95fe5353a149", "value": "SecuriteInfo.com.Trojan-Spy.Agent.20447.12525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968a4d99-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696754108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754108, "uuid": "c14ce730-1b26-4f1a-8bd6-8deae9f3f4b6", "comment": "Malware payload (RedLineStealer)", "value": "b35471b960167b43427ea4b984a602ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754108, "uuid": "a7d93127-16e5-4635-a4f7-217932724724", "comment": "Malware payload (RedLineStealer)", "value": "6379bf3bac6025e6ec0441f9a56f5ac9a4fc74b516fdfb64c0d351c5e22b02db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754108, "uuid": "24364734-d66d-4068-98cf-729e4de12e77", "comment": "Malware payload (RedLineStealer)", "value": "f22b73efc63b3a640845a895e7421f9bc3c51727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754108, "uuid": "0dea66c6-9129-44c8-9db8-525e4d8ab0f1", "comment": "Malware payload (RedLineStealer)", "value": "21d532f6606da796c842df42db04ee730081786b82c2ce084d2e1bf93f89cdce983ed6a39e2621f6d70c8564c9700d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754108, "uuid": "0a86247a-519d-4629-9bbc-dd31febda120", "value": "T10E24E626E304596DE83E433DB41C38B09E707C52E16ED32F49E67AED693BB4D8A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754108, "uuid": "e5622ece-decf-4cb6-81cb-e467fa24adba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754108, "uuid": "e1bc36ca-50b7-45bf-8241-580cea13cf76", "value": "3072:ftoVsx0nhNgc40Om82pwt3g7t/qFHVlJPQ3OHSbajt:1gsChNgc4Vm8C5/G1lJPqcSba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754108, "uuid": "386247c8-bc5d-47ce-87f9-a5bc91e72aa2", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754108, "uuid": "7454bcc2-2340-4ab8-a114-4481032cb9f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754108, "uuid": "477b28c8-ec36-47e2-abe4-dea2d8333f8f", "value": "B35471B960167B43427EA4B984A602FF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba675bf-657f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696730977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696730977, "uuid": "df2dd39f-803e-45b4-8835-c61cac570978", "comment": "Malware payload (RedLineStealer)", "value": "7bb9bc38e7069451b5c1fac2667fb032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696730977, "uuid": "d0f46a5b-ede2-4719-810a-ab9991f9ec97", "comment": "Malware payload (RedLineStealer)", "value": "63dc610252a10c6ddfd4c1dcc6911763a4775feb56f4ee3968c4133b3d539df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696730977, "uuid": "b56f2b87-a82d-4b43-a227-4897752854ba", "comment": "Malware payload (RedLineStealer)", "value": "93c5daa3e32843f37cc815d555583c51d83f32ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696730977, "uuid": "fea04428-7bc2-436f-9873-a6ac5d812251", "comment": "Malware payload (RedLineStealer)", "value": "eb58dfc4271c4076a5e235cd9b03589852cbd2e3a3601005207de6bf20f13320e21f568d3363413c249238a3178911b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696730977, "uuid": "51e407c7-b6b5-4858-9fb7-f672d4ab7ae4", "value": "T17A65236ADBE129A3C9B823B084FA03DB0F34BDB06D745B6F1782598B4D736009875379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696730977, "uuid": "c00e39f8-a34d-44b4-b7f2-ba8fa0d4f8b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696730977, "uuid": "32959b46-0e33-488f-8beb-2e942613d836", "value": "24576:ZyHyjlXAaEVK0Q+ttn4Mv4RzKrcyyy6GrscB4Hcofee2giGPbGpR/DKiAWcTT:MH0ABVXQgtn4Q4NKrfyNc2Hbfiyb4cij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696730977, "uuid": "a7535e87-79bb-4d57-92af-9abc3cef7338", "value": 1542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696730977, "uuid": "a8bf0ea0-19a4-48da-81bd-7e1db21cbd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696730977, "uuid": "9a668848-786d-4369-a455-09ad9a83b3a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfb96b8-65e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696774171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774171, "uuid": "27a09cd7-b4c7-4e6a-bf2e-b8667d4e4ae4", "comment": "Malware payload (RedLineStealer)", "value": "2f4e9d6344f9282c78837404850f7e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774171, "uuid": "777fa314-5060-44a1-9598-ad46add0bd78", "comment": "Malware payload (RedLineStealer)", "value": "65014e84295892705dfc1de8e27ccc574fbc7121c2881a720bc5be58579fd4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774171, "uuid": "ac544a77-4d08-470c-8867-b3991871bac4", "comment": "Malware payload (RedLineStealer)", "value": "b0a3a5692069a9a753aec38aeab438bafc4f20c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774171, "uuid": "ca2f917c-e0c8-42d5-901c-ce011d7bec69", "comment": "Malware payload (RedLineStealer)", "value": "dcd739f880658026c9cb9ba6de22c65b77176585454cc369b561ea676750df4676f1437550a8e402c10e308498d6f338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774171, "uuid": "92b9caf7-2083-46a6-99b9-227a68fc3fef", "value": "T1CC45231676D58872EC703BB45CFA420B1631BCD899B8936B1316AC1E1D73A06E47A37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774171, "uuid": "7eb48af2-1333-4795-a0f9-2fe02c482526", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774171, "uuid": "7cf9cd97-5191-432a-a19f-9b1f1fbfd904", "value": "24576:Yyx3IoDemqZ/LjxflTJB9me7+/w+aRgo+SWooJZ:fxYFmqZ//xflTFl7Cwt+oZWo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696774171, "uuid": "f204a75c-55a6-42a5-a6cd-29eaf1dd71b2", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696774171, "uuid": "66c51694-08a5-4352-8343-9f4ecaed4b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774171, "uuid": "c0f1f389-4964-40ef-93d2-c71a191a0962", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e478403-6581-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696731626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696731626, "uuid": "0ec68c47-c282-4dd3-8a83-658f6b033923", "comment": "Malware payload (Amadey)", "value": "c4afe2681c57c187e938874f93eae4ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696731626, "uuid": "540ba1b9-88ac-4268-bd71-d8f0f6b8b9e7", "comment": "Malware payload (Amadey)", "value": "6752986ed6843ad7f41aa2195219c7e6b7312796328f944ef25968f69b7cb544", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696731626, "uuid": "b29fba44-5931-4320-b51e-a13c0db16f62", "comment": "Malware payload (Amadey)", "value": "fe75b3f86b47ce157738cdc8ddd2e3d880515624", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696731626, "uuid": "be49a1e9-0c80-44f4-82ec-770d804c017a", "comment": "Malware payload (Amadey)", "value": "a84ba46594da29121ddbfa2088eb20ded66451bf78bb0a05f8c48755a601685daabbbc8b1e84127a019a57a3c60a9e44", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696731626, "uuid": "3b35ceff-c881-43d6-9e96-c2c1a5e8e262", "value": "T170652353E7FD0572CAB62BB0DCFD428319397D91AC304E9725DAE84A8CB394425727B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696731626, "uuid": "be98d8da-5f23-4612-bef1-fd31ae18b8a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696731626, "uuid": "cb34e9ae-1fa7-4308-ada5-62446e06d84c", "value": "24576:syzsvDR/xVqk9T/rpB6EIybrLqz4svT6ejQuh8U/Beq7Og/dosHboPfz:bIv1SKrdB6EIybrLa4sL6kZhX/Cg6sHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696731626, "uuid": "b3ff8cc5-ae33-4ef8-969d-9fbb45c18c9e", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696731626, "uuid": "e097b647-7620-4c11-8d2c-8144f9291833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696731626, "uuid": "a1fb0990-a088-4c4c-92f2-53409fcda172", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7773cd23-65f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1696781114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781114, "uuid": "fbf7684f-f53e-4ad8-a851-fcd3bf1ff187", "comment": "Malware payload (AveMariaRAT)", "value": "6126e52db4c4bd281a4be55541140d65", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781114, "uuid": "990b9e9d-bc73-4cdf-ba14-f8f82cd355b4", "comment": "Malware payload (AveMariaRAT)", "value": "67d5baffc65319115a48aded582d6b77099064b61b67d6f0d73ef6efa640bbc0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781114, "uuid": "f447580f-b2ad-48be-aeef-ff46a2e875be", "comment": "Malware payload (AveMariaRAT)", "value": "75489a2b2c5f071cd886c43f3716c3ecfa1b9f94", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696781114, "uuid": "1d45d7e0-96b0-4387-ab0c-4604ac0e36e1", "comment": "Malware payload (AveMariaRAT)", "value": "5d7389616bce1e18b043b6544f0225089edab860e6814fb3022b6baf593afde69934d31b989f8df898ba1215e4c91fe0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781114, "uuid": "655fbb92-5ab3-4aa6-957c-c44f098e98d5", "value": "T17BE48C9A2E054AF3D71CF4B480F3332863BECE3A3A56DF8DDD9E3D9412B1A881655512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781114, "uuid": "bf84dede-e21c-481f-baa1-204bd632de3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781114, "uuid": "77580454-0757-43d0-a681-545fb65e396e", "value": "12288:EyRpNSFztmB+OzkgpYqwc0Ni8XlZHLsHrDKpREBfT0eyJc7s9XFJh:rRpN2moMJYqwcAlZHCrDKet7s9X1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696781114, "uuid": "93174956-86f0-4b6e-a1dd-eb2bdcc19411", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696781114, "uuid": "0b69a1d4-50e5-4b6d-964f-5d2f389a1a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696781114, "uuid": "273fb6eb-03e9-4205-9582-7657ef1eecaf", "value": "Online Form Mashreq Business.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b446a9-65e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696775368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775368, "uuid": "b0f15b3a-4d41-432b-a5b7-84c90adb0ac3", "comment": "Malware payload (RedLineStealer)", "value": "385178963986974e48ae197d87c67402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775368, "uuid": "64514883-64f7-402d-b1cb-ed1c19638281", "comment": "Malware payload (RedLineStealer)", "value": "6863524c90a7bcddb2d9ac1c4e9731a475359f2f28f2c373edf2e6cf30cdcc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775368, "uuid": "6accc81a-768f-459c-a53e-eb9227288194", "comment": "Malware payload (RedLineStealer)", "value": "e45aa3d3a5c34af87ac257c55066874f5cef91a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775368, "uuid": "0cae2880-e917-409f-9c73-f43826e4f0fc", "comment": "Malware payload (RedLineStealer)", "value": "84c9cd405e188a0d23917b23a894b5b02def8f0db7ecf4ee2ab573cb38e76ec4ad7e012bd8bc499cb8b25cb49ab51f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775368, "uuid": "933438a7-48d9-49db-a792-b9cce084819e", "value": "T14C452312E3CA81B1D976373059FA67930F75BEE04D74C32A1654A83F0973980E93A79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775368, "uuid": "0a8df7bb-30df-47a4-9fdf-c4eecd4fafcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775368, "uuid": "fb119877-1516-4f7d-aac7-21d02f351a0f", "value": "24576:LycFa39RYOJoJ0WEk/MwinBkrH+L03dfsQjpdW:+bNRYOJoJ0WziBu+kdfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696775368, "uuid": "796f6546-e0ca-45dc-9e11-2af2869d666b", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696775368, "uuid": "2508e3b3-a8dd-49fa-8298-9d9cf0115657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775368, "uuid": "2da6646c-8fbe-488c-8788-eddf0848c7b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc758ce-65a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1696745584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745584, "uuid": "b1062aef-3a48-470b-bdbc-8f996ac12c6c", "comment": "Malware payload (TeamBot)", "value": "42008c38257070c6eb7de43610218715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745584, "uuid": "8bb1610c-f695-400b-9fbf-c1ba5fa5393f", "comment": "Malware payload (TeamBot)", "value": "6a6aeffae09bf99332b3641d39606ebc0d6ae27d4502df6fa3cfe93ce7e3736e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745584, "uuid": "9605e255-b308-4243-86c7-f65c1f37d5b5", "comment": "Malware payload (TeamBot)", "value": "02ca264c33b042b606e2846aa76b60d7bfcd6f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696745584, "uuid": "6950a34e-fdf1-4adc-9ab0-a03eb758ece0", "comment": "Malware payload (TeamBot)", "value": "18883f3a247f9312b7e68604319f7b4380dbbeac4a848933fc7e21186d58b34ceb51052d16c6e721e824c79f26ab983b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745584, "uuid": "1edca3d6-a73c-41b1-aeb7-8c8c8dc160d7", "value": "T133547E02A3A1BC25E5268B728D2DD2A4362EFDA1DED9B79733147F1F04B11E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745584, "uuid": "a59f548e-5828-44d1-92df-96a0f1e81fee", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745584, "uuid": "1d27c065-9018-453f-8a2f-b4f2f82f8e76", "value": "3072:agoUYkBlW/HjgsqD3H9Us4kUwbv68C0zz6acrzIQvI2b/a9:u/oWLZqpU9wL+Azm62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696745584, "uuid": "c6abd9e6-3e69-4ade-a831-2f44303a3f28", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696745584, "uuid": "d6a35f4c-5ff0-4e9d-9d9c-9b690f26f961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696745584, "uuid": "6fa2522d-957b-41df-bfc9-6b3147ecd6cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a3dd45-65fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696784930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784930, "uuid": "23fae426-e483-48d7-845c-4b879435038b", "comment": "Malware payload", "value": "f93f91aca8e20bb97f94c05e5dd839e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784930, "uuid": "5938c545-ba4c-421f-b36f-27f1c54ee4d1", "comment": "Malware payload", "value": "6ae543b0a3380779b65bff8c3ca0267f741173aed0d35265d6c92c0298fb924c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784930, "uuid": "75f4a00e-d1d6-40db-a872-7198310efb0a", "comment": "Malware payload", "value": "c11d361560b3a397e98334b4bed7d787b46f3e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696784930, "uuid": "5b4c8a67-51de-41a5-a907-8d2925407e3d", "comment": "Malware payload", "value": "830456271af8beed30491a8192b3569ba505c33d46cc4d361acbc1360b936430934e7a73ddb40971361a316e1f278614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784930, "uuid": "5414f3f6-59cf-4c26-ba74-f291fdbc8c87", "value": "T12434D145B3A118FADCB7C47DC8524A45DBB07C1A0621DB6F03E486661F236E09F3AB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784930, "uuid": "c224c585-6b1d-4694-848c-c0673452735b", "value": "ce088b62574105896ea14183bc034940", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784930, "uuid": "dade483c-c134-4907-92a8-a5bfb43258ea", "value": "3072:SQ6ZYZTzp+cavEcNQe9GQM/HhdFlQuq0/1fvZDqf6tHFzSfV91puBYYJCslb:n6s8ca7DGQM/HHFlQuTYZpylb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696784930, "uuid": "34a6f873-4b8f-458b-84de-e4d8cd2f48f6", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696784930, "uuid": "be99f8fd-4ddb-4927-8eaa-e95722ea8d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696784930, "uuid": "09dc9912-ec91-45b5-8725-cf6c4db24455", "value": "6ae543b0a3380779b65bff8c3ca0267f741173aed0d35265d6c92c0298fb924c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5c0fad-6598-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696741793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696741793, "uuid": "99f75dd3-5cfd-4c56-8500-cc3c7679e0d6", "comment": "Malware payload (RedLineStealer)", "value": "2aecf416acb4ede264e3e4171366e7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696741793, "uuid": "c1387909-8c7e-4994-8327-9cc4dd4c0431", "comment": "Malware payload (RedLineStealer)", "value": "6b6371e4dae5e95c05116e0bb516defa3a37bc844b9f1b9576cfe92fc792a0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696741793, "uuid": "4c4756e1-8bdb-452c-9a07-a8c991fa8319", "comment": "Malware payload (RedLineStealer)", "value": "e22bdb2a524b59a992237a1261afd8672fe0c200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696741793, "uuid": "fd70e3a1-9e28-4619-a576-47811c594555", "comment": "Malware payload (RedLineStealer)", "value": "55eab4740432034609b9bc030052ec93f08638985c455cca583780ed86d510623580d7212c169cc86499746458b8aaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696741793, "uuid": "41462036-6108-4e41-90a8-c387db64a982", "value": "T116652351FFD48633C6F8633258F546A30A3ABD526C354B2B32AABD4F09729052973367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696741793, "uuid": "0f879107-bb20-41e2-91c9-c490adf81969", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696741793, "uuid": "9a2c27ed-20b1-400d-8f20-0ec2c6311894", "value": "24576:AyEV04JPY8ZX29xW9YaKlCIvzdDwFT4rtPV/o3yzp13SxZFNhAZoi8ss730y4Tbe:HEy4JxIQ6BzdDA4d/NzTiZhAeiz8ky2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696741793, "uuid": "d4026a66-e199-42df-977f-9b91300b4a65", "value": 1543680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696741793, "uuid": "a808e0ed-4a18-416f-8447-4422c539913d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696741793, "uuid": "ddbc0fb8-a5e3-4a21-b430-93f4b7b503a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb7c9b0-6588-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696734871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696734871, "uuid": "81287f6c-5e33-4095-be99-1c9cf7ca33a2", "comment": "Malware payload (Smoke Loader)", "value": "093a7b829f055df11344e9f2ee64ca0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696734871, "uuid": "29f79bec-2531-4149-b010-c1e203fb6422", "comment": "Malware payload (Smoke Loader)", "value": "6c21d5bd757746e5843d04f6b1a9ad3a13f92e5255f0ad4f4f9e5c87c69b7bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696734871, "uuid": "27cda6ab-ba37-4770-95fd-85088f59a7a3", "comment": "Malware payload (Smoke Loader)", "value": "feb2833898efd9954f11aab95db1e2f25bbf6730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696734871, "uuid": "84433c45-e653-4aa8-8f93-8ff8abb83a1b", "comment": "Malware payload (Smoke Loader)", "value": "18e8c3ab090fce3571e520408635f067e0ff158a816e1a64c862ad129c241ed98da01b2bd1dafbf68f4d3797a4995da2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696734871, "uuid": "2d701806-5571-49b9-8eea-b8be40aedd39", "value": "T107652363A6D99433C9F06F7054F213830E35BD515438CB9A764AADAE1D732D08CB63BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696734871, "uuid": "12c4034a-c61b-4559-ad4e-afdeb936318d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696734871, "uuid": "8bcdb705-19f6-4594-8d76-fbd37768de67", "value": "24576:eyYnAQlhU4JGEegIdLyPO8Gopf8W9zfKdzqMlyvOaQ9vyyQmCJG:t/QE4J8gIdLyPTGlqMlyTQ9qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696734871, "uuid": "d6b16031-3150-40de-bb14-c04eb4fcaa4d", "value": 1543680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696734871, "uuid": "221aaa82-f03c-456a-86cf-182808d8e4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696734871, "uuid": "9a90ba01-6cb0-4e62-8f77-d6ae7d64334a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195ccd9e-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783963, "uuid": "6c61ec85-9936-418d-9d19-4ff7c8d60d4e", "comment": "Malware payload (Mirai)", "value": "3ab6a23fc991074339bee23f230635d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783963, "uuid": "09ab8f11-97ba-47e1-adc5-f89bbf5244fe", "comment": "Malware payload (Mirai)", "value": "6c8875c3a6808af2e91aa2cdac1ec18a4526cf34346aa372c6bb058021b38089", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783963, "uuid": "0c0d430a-b076-474d-a889-95ec523f9661", "comment": "Malware payload (Mirai)", "value": "af88ae3fb62f6fa592ad4ff55a73aa147a0a5444", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783963, "uuid": "65ddccee-1e65-4d1b-b429-d60c9532c8de", "comment": "Malware payload (Mirai)", "value": "a3e4b9d23236c88eed330d6364d89cfc74b6a94073fa73f02738b9c38bad12e0b520725d64338a14d0f6b6b43dcbc03d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783963, "uuid": "9d2b48df-a5e5-4957-a6e8-729a2daafff9", "value": "T104E31945F8505E23C6D312BBFB5E428D7B2A17E8E3EE72039D255F24378A45B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783963, "uuid": "ce348642-0cba-49c1-96d0-3b88b9d248d6", "value": "3072:LcMMcHQYxFMyh4yih959bz/EOpN9cRDq3ss:LcUwORh4ym959fNpN9cRQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783963, "uuid": "56442af4-25c4-41bb-9536-93384366fcc2", "value": 144128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783963, "uuid": "89c5e412-d4c1-454f-819b-30d0c9657396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783963, "uuid": "6ac8f10e-cb84-47d3-aef9-29984d6d96d0", "value": "skyljne.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8fe834-65f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696779997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779997, "uuid": "46761bdb-5909-42dc-903e-4113d8efa876", "comment": "Malware payload (Formbook)", "value": "e9577305797da56c4538f35d2da1e6ef", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779997, "uuid": "19c48e5e-d752-4785-bf6a-46cfc9fcba50", "comment": "Malware payload (Formbook)", "value": "6c8bb939433b05a8b56b08ef68f8c5b5f396bc2b5454ec09d4ee1654951ff463", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779997, "uuid": "2111a47c-3ae6-4f3b-9340-ad49b08ecf8d", "comment": "Malware payload (Formbook)", "value": "4b19ed069368fa3b9433c9c8d8b4a050dfae77bc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779997, "uuid": "de335f52-2ffb-4825-82f7-02ee53aefde9", "comment": "Malware payload (Formbook)", "value": "bd14441478817f6cbfae7d5bbb39d35d26d9e1acd257d2655fd1289f717c8e4f7f7040475736a70d8b316bb750c0aa9f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779997, "uuid": "d1af952e-47ff-42de-8e6d-920037c69c29", "value": "T1C0251212BDC258B2C5722D336AB86711BA3DB9201FB58EDF63D0462CDA315C1D731BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779997, "uuid": "8b5b08bf-397b-4284-af39-12734b0d5fab", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779997, "uuid": "98164200-cb00-4065-b9e1-90c85fa3d8a2", "value": "24576:NTbBv5rUanWnNr75xArQDF8XhV+dFGa6mPcyGJzQfs8FiNGVDoB:HBjWnd7HbghVRoGBQfookB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696779997, "uuid": "6ad50427-f38c-46ea-82f5-372c9363f345", "value": 1029179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696779997, "uuid": "4cdb8145-576a-4f4a-b0cd-cb190e2c9426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779997, "uuid": "96e5a67d-75d8-466c-8161-742d0ca81d05", "value": "DHL-081023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b51a77-6618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696796459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796459, "uuid": "2f87009c-d174-427d-b147-fad216c8262e", "comment": "Malware payload (Mirai)", "value": "16ae61029646cda486808a2db070c68b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796459, "uuid": "2ac49ec9-78e4-4464-882d-54ef7d2c9eb7", "comment": "Malware payload (Mirai)", "value": "6e4511610452c049698eb59404a1f8d77f2349f0664688840dd12de785c02d98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796459, "uuid": "56afca74-28c0-4144-97d6-072953362581", "comment": "Malware payload (Mirai)", "value": "ee5b29b60a5bc05cad3067b06b08f7025ba2c290", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796459, "uuid": "4b34d1c7-0071-4d45-b629-08e7aed33038", "comment": "Malware payload (Mirai)", "value": "4dcfd2d0301634da74d270263c6c21c2013a5302528dbe66f0a83c7cc672fd87c6259ab4f68e46b0447981b9c2699f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796459, "uuid": "ef13d425-025e-4009-8cad-cf232e3cbcca", "value": "T13FD2D017C55C87A4E0A6403EAC5B3CDF5520532C480462BAFFE41E6EED12B873BA7752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796459, "uuid": "f531ab47-202f-4783-9621-cf248ed50ca0", "value": "768:Bs0+KlVX1nMUla+gbZGllgaJW6rTBJCHE/Afx7uGnbcuyD7Uryq9:W0blVXo+gslFBJsE/kxtnouy8mq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796459, "uuid": "0cef7fe7-4244-47b8-be26-00e1caaa89c3", "value": 29636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796459, "uuid": "5d92db64-eaad-4c9d-8ad9-9909d3a3a020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796459, "uuid": "4c11059a-8dd7-4418-b250-16b9eca9a1ba", "value": "16ae61029646cda486808a2db070c68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2310f02-65a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696746853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746853, "uuid": "03154d92-171e-4cfe-9507-4069cd7c91bd", "comment": "Malware payload (MysticStealer)", "value": "18037e813c49a324042565d55b74ae5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746853, "uuid": "961c6fb8-6ec1-41cc-b811-5354dd61a032", "comment": "Malware payload (MysticStealer)", "value": "70a2f125580ebc78d097755084820fc37c3646c6af143ef2549bba046d41f021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746853, "uuid": "1c074eeb-22c1-43b5-8748-8e0ddd6bb7b4", "comment": "Malware payload (MysticStealer)", "value": "bbed237f3725677fda158a0bfdd473dd4eae5854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746853, "uuid": "4414887e-3c39-4f53-a7e8-96751301f93f", "comment": "Malware payload (MysticStealer)", "value": "a3edc5276fca6a87983441d2355f585c7f5c5982a60777fa87950f31f1f7793bd1932e12aab07a4e9e7aa3e4b36b3a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746853, "uuid": "449969c7-10af-43e2-a429-5e520afa593a", "value": "T1F7352302EBE54072C8B86FB0ADF113CB1E357CA56934971F36819A895DB3A446C37B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746853, "uuid": "ddd95cb6-414d-4005-af11-a68187868f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746853, "uuid": "898bc006-454e-45cc-9230-f096dfb7f424", "value": "24576:Fyui10KX3f6ebgn9uE86dF1gRdyNG8Ar8gEE4Q:gx0w3Ceby9uE86dt9pTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696746853, "uuid": "82052d02-5ae7-41a3-8db0-85705b33d7bc", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696746853, "uuid": "23898fc7-40b0-4276-a7cb-5372dad7138e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746853, "uuid": "84b75980-28f6-4457-8491-85dd9a2330b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d36da0e-65c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696759246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696759246, "uuid": "6d4e3675-7193-49e1-8d26-6774612bddc8", "comment": "Malware payload (Amadey)", "value": "b1355147da5b94db04a3137dd41e8c7b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696759246, "uuid": "6821fe21-6849-452c-bb0d-a271582c9f4e", "comment": "Malware payload (Amadey)", "value": "725f2ff497ad8423b69f5bc2e608cc2d9574653a03defb009fc61463562c80dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696759246, "uuid": "2edf932c-02c6-4bf9-bddf-a62cc511a753", "comment": "Malware payload (Amadey)", "value": "6c8ac51e7160e4223277b09bfad4f308cb90a085", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696759246, "uuid": "180464ee-621e-424f-8dd2-403e55331f22", "comment": "Malware payload (Amadey)", "value": "8385e85e559992bfe2119456ced199ffc2f2349c1cc12d0a88c9ee0cf8d24e42d88a419a0d9868216150c51a392f8021", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696759246, "uuid": "2e3b0b12-bf75-434c-824a-11f6fadab164", "value": "T1EF352343EBE8867AE6B9277028F152C30B367D666C25532B37869D4A0C71550B873B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696759246, "uuid": "2563d15b-c742-4a11-8e74-44166f869d37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696759246, "uuid": "b6835db4-c26f-410b-a0d1-29e0d8610dde", "value": "24576:dy3JrD7BxiIhz52S2QrwW8UWK/KezxNhWuDvdeZR0V:43J/7Bxn92SzwW8URKCIuTAZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696759246, "uuid": "9de8eb65-4285-492d-9807-9d7e5c408b24", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696759246, "uuid": "353be3ee-962c-4dfd-9420-48a49f41ac52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696759246, "uuid": "e972623b-b110-4245-a244-7aed947d78ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3133ab-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773631, "uuid": "3c92c19e-2a89-4efd-b294-a6c96b722f78", "comment": "Malware payload (Mirai)", "value": "78a60f37aa34c067a8b74b6a4bd97709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773631, "uuid": "e70e2aef-579b-482c-b471-c81c7fd4b34d", "comment": "Malware payload (Mirai)", "value": "73ccdd117025bbb0370bf20b988c4dd4861a8d6e8311f84a45447b2472913666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773631, "uuid": "7bfafd0b-36d0-4fbb-85c3-8a76d08069ab", "comment": "Malware payload (Mirai)", "value": "99f40291ebf8b077a172db4f8708f2beaad5ae16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773631, "uuid": "1b7006a3-7cd9-44ad-8964-503e20b46c21", "comment": "Malware payload (Mirai)", "value": "cb7f37ebc94af68e6f08d23ab1fb20c044c30cdf7d05ccd99977e3d45906a03542c9b3c1503526fd60282314153d6e5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773631, "uuid": "be1468b4-2a9e-4014-94da-1205c4a5cc91", "value": "T171633B46E687F9F0CD450AB8206BAF75C436A8333130DFEBEBD8B9179D56742605225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773631, "uuid": "57bde37d-a0fe-4b29-a5d7-32f778dadf6e", "value": "1536:IeAolofbYYQsBehM1XcB3xESOUd3dgd8SbmDOmE:IeyssLcBTOXb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773631, "uuid": "d5523292-c110-4ba1-bf44-096616319c45", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773631, "uuid": "dac1af7b-c905-40d8-abda-2d0de25cb545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773631, "uuid": "f2425dc6-adc2-4702-8820-ecc4907c57ea", "value": "78a60f37aa34c067a8b74b6a4bd97709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249cf55f-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773674, "uuid": "bbe76f11-b05a-4d19-b697-94a90bf7f9e0", "comment": "Malware payload (Mirai)", "value": "68347ec3895ce13ab02720711ce5fbd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773674, "uuid": "7f63cd9b-dba6-433b-bb1c-14d77ebd3250", "comment": "Malware payload (Mirai)", "value": "7404a398d8cd42c94d3248cb060b5fb3dfc6c26f145c095c3aa693d547b8060f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773674, "uuid": "40942964-3405-47bf-b260-3642b1380cb2", "comment": "Malware payload (Mirai)", "value": "16f3bc238792d03e9c58c195c486356967e660f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773674, "uuid": "3a9351ed-cd51-4db0-8f65-5deeaa9eef2f", "comment": "Malware payload (Mirai)", "value": "ae332ae939ce97a02978a52f5b7a46cb40727433af20f9a1a4e6512a93fe19aa50221db3b397bdd4eb8ef1adeccc3486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773674, "uuid": "b65a03f5-f43e-4f6e-b8b2-6df91408e671", "value": "T103631985F4C745F5C80B4A3460BFF33FDA31EABA40705A6DEF59AE21DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773674, "uuid": "770246c8-6935-49f6-b6e4-b3311112dbdd", "value": "1536:+UzrP7BIluOdSIvwi3WwDYXJp6lYKOUM:+UzryluOsi3x8JoYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773674, "uuid": "be81032c-c9e5-45de-856c-6c7563a45655", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773674, "uuid": "83b064b1-730d-4860-a702-eadb3b347047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773674, "uuid": "11080cff-7818-47f3-97e9-0629f8e48490", "value": "68347ec3895ce13ab02720711ce5fbd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140799c9-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783954, "uuid": "f81c983b-461c-4068-8952-49f4f1b3d140", "comment": "Malware payload (Mirai)", "value": "2371e9f7bcc1e943f0953ced18a7d250", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783954, "uuid": "347d09ac-2f98-4c79-81a1-2481fc1f39fe", "comment": "Malware payload (Mirai)", "value": "784a8938f908af9f15964aeeb9b76bc84a8633ac2a7b2737368c6de74335bb0f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783954, "uuid": "401cdcf1-4f20-48af-8692-fff35a5efa0d", "comment": "Malware payload (Mirai)", "value": "e07afb11c6394e5476214fbb6ace2018fad3ba73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783954, "uuid": "b6175730-c75f-4681-9225-99dd0d4157a2", "comment": "Malware payload (Mirai)", "value": "049a506bd469b34dc55c18b037ea1507ec6844770966d0f147ef37f96f75b2b1d9286d8f307030772598bfcc6f5601ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783954, "uuid": "caafde08-40ab-4edc-8281-95968585be94", "value": "T1A3143B46EA404B53C0D727B9F6DF42053323AB9497EB73069528AFB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783954, "uuid": "40d005d3-b2c3-4766-b9db-c03bb112c5de", "value": "3072:BlzMZ0FJWOGzmLIuax949cPE5z/be9Dq4bpTFBUoMM/Rf+hQ:/zM4WOAmsuax949cPW+93tTjZMM/RWhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783954, "uuid": "c65f8984-5e5f-4582-8164-1d60f500a598", "value": 193648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783954, "uuid": "367c4199-5a08-4104-a0a0-b5e0ac5a4b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783954, "uuid": "b75da70f-6629-4f55-92c3-9e41226163fa", "value": "skyljne.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9269cbed-65d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696766556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766556, "uuid": "d29ac87f-4594-456b-875f-3c232a4c137a", "comment": "Malware payload (RedLineStealer)", "value": "43beaabe6fcfd7a318855a40bb88ff46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766556, "uuid": "ab51dfa5-4176-4099-bdad-224f8fd10aed", "comment": "Malware payload (RedLineStealer)", "value": "79083007e0237d41a6585b508afa75197da29fedd254e1a3ef10693acafa443b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766556, "uuid": "2ebd6cf9-dcef-4a96-9f8b-a57218f9060c", "comment": "Malware payload (RedLineStealer)", "value": "1f16a1a8599eafa60eb9db308f6794ef575408b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696766556, "uuid": "22ef32a9-bab0-44c2-a7f8-c50ce6d45749", "comment": "Malware payload (RedLineStealer)", "value": "533886ccd0d302bf3543a73fb344247d62aede1d1f16880d6d5b4a9ec11bc1d447cb396fa49ab1893080f257cc8d5710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766556, "uuid": "7d802f94-7e88-4563-b2f0-bbb7fad6f648", "value": "T1BD4523022BDA94B2C9B4577148F217832B36B8E59C74900B27A9A86F1D72F4DDC7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766556, "uuid": "fe9e456c-53ec-4f87-996a-c54d56d4cb12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766556, "uuid": "92afdf26-2ecc-4108-bf54-60fca4ea4ad5", "value": "24576:GyEQ/kpmLPo9vw/Erpz+Vn6FTffNfscuwfeABM:VEokpmLPo9vwECn8HN9N1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696766556, "uuid": "1d5736e4-6f48-42e5-8c21-1924ed23846e", "value": 1179648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696766556, "uuid": "2f9ddab6-1429-43d4-885e-60f6ca8ea07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696766556, "uuid": "8d54c229-bab9-4a2e-a4bb-2ee11b8349c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176d6411-65b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696754324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754324, "uuid": "ba21964a-e129-4e0e-94d2-775294cf9479", "comment": "Malware payload (Smoke Loader)", "value": "fdbf4ae6c709ab245c4571774ef5ed6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754324, "uuid": "92dcc34e-623b-4460-9767-f8e5efe6e1a2", "comment": "Malware payload (Smoke Loader)", "value": "7996f8f34d450d0cd8c7c35b78de3ea6dbd8932ae56bc05f30ad030622cd3fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754324, "uuid": "8edf420c-c372-4004-adbd-eb06b8f8c9c3", "comment": "Malware payload (Smoke Loader)", "value": "96fff89cfd6c4be274b15e46e88b7c603dbd9f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754324, "uuid": "1dd953d4-e753-4da2-ab85-49234e31f4e2", "comment": "Malware payload (Smoke Loader)", "value": "0fe6c5b40a4250bb89c225e957efad9adf9890eeafbe2a22c7b083ceb04875d399e976c528242d3248cf4cb4dd767ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754324, "uuid": "170a7490-cbda-49c7-9129-b7494866349f", "value": "T1C9548E02A3A1AC21E52B8A329E2DD1A4773EFD91CDE9679733547F1F08B11E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754324, "uuid": "a0b44dd4-ed0e-45f0-81f8-a2b15c167ea1", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754324, "uuid": "75100059-5d83-4255-8631-082a63797d54", "value": "3072:ngofE3uRke1Wcpg8PPgvNYuFmcCxYKoe4mnukgyQFIK/a9:VM+zWMJPOgcUzoe4WgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754324, "uuid": "801d1211-c1b4-42ce-a7b8-ea8692fe9c93", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754324, "uuid": "44a5178d-e957-48fe-9a3b-28b9ed48be72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754324, "uuid": "fc46219c-5937-4c9d-a5b2-19b71e4e090a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99ca2e2-65fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696785198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785198, "uuid": "7202fccb-e5aa-4939-a04a-239d83048fb5", "comment": "Malware payload (Mirai)", "value": "2042448fbcea93e74cc7fd84813f27d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785198, "uuid": "34f75e76-b863-453c-a4cd-204a74f78b20", "comment": "Malware payload (Mirai)", "value": "7aa5a2f5596024f3f332c6c2159b87c92b2f91df7fb8701aa687906989dfc39b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785198, "uuid": "d644dd9c-2df0-46fc-93cb-b63d092bd21e", "comment": "Malware payload (Mirai)", "value": "db7b6563d6877ea1cd84804bab2cd091de33aec4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785198, "uuid": "d7fe302a-a0d8-4ede-b861-ba8a5f8c8f16", "comment": "Malware payload (Mirai)", "value": "5589d59450ab00d94d42f9b7768e6d86c5cf08610a3f7f602fd1acf70ecf3d9bcdcc0c8fe27dc67bff882b8073fdbfb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785198, "uuid": "cfb5f765-a269-4269-9519-8d2ac9ce13b5", "value": "T159E33A06B70C0B07D1632EF03E3F67D193AF9A8121E4F644695FAB8A91B2D325546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785198, "uuid": "23210c09-153f-41af-af1d-8bf11f3aa6bd", "value": "1536:/NCOzYa4CZI6L7bxp6vfRJUlG9DX4EJoQrzFvAUWVUqKmujMqYpO4CT3Dyl1dfl:lP7bxM3AAXBBrGU4jCT3DqJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696785198, "uuid": "b2252544-4176-4cd0-a191-8baff4265534", "value": 144252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696785198, "uuid": "a522c882-6651-4666-9ed5-6f835a4e70e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785198, "uuid": "3bc5d818-004c-40e7-843a-fefe2a45e072", "value": "2042448fbcea93e74cc7fd84813f27d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9de982-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773684, "uuid": "fde283b1-7a29-4179-9d1c-ef66c3236184", "comment": "Malware payload (Mirai)", "value": "f502dbb8848aa70b7ba856776c29dd2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773684, "uuid": "13a80a36-8087-4544-b366-d3d765fff2b6", "comment": "Malware payload (Mirai)", "value": "7b3e172d1d757889dc329f1a94334442121c3b73bb0b67c79a41df674c87515d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773684, "uuid": "d4703f56-9580-421d-a969-849370dd308a", "comment": "Malware payload (Mirai)", "value": "045422381a68ca1dd97c76302a4f117eb8c024b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773684, "uuid": "cc77d8af-2546-4ab5-bad1-0fb20658d25c", "comment": "Malware payload (Mirai)", "value": "b0f08a2fd3d669e7787f7d2b1913871ff6f0c4c7450fac8aee189f0d8f87041fd132c9efb8fa93f8b01033d394367a80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773684, "uuid": "7a4847da-bba8-4be0-8264-3f8858493dde", "value": "T14A63F782BC80E616C7C01677FA6F509E3315A7D9E1DA33429D251BA07ACFC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773684, "uuid": "5fd0a10f-0415-4a6f-9b2f-55b7595e91f3", "value": "1536:xBnoU1QAu0Ud66g27Ilx0lB8t46uxtaqJDoa:xBoU1QO0384Bxt1JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773684, "uuid": "2975fe75-30a8-4457-a390-5ebb0df184c1", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773684, "uuid": "dabad23f-19f9-4067-b401-bb92bf603cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773684, "uuid": "23ae35fd-a9eb-4cfa-aeaf-e04a0982a33f", "value": "f502dbb8848aa70b7ba856776c29dd2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dac1fb4-6628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696803270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803270, "uuid": "321ce23d-304e-44f9-b571-e86c060166a6", "comment": "Malware payload (Smoke Loader)", "value": "44f9d3e34b4cf0a4d9e795abb847d571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803270, "uuid": "0514d860-7905-43df-b644-e763988ea57e", "comment": "Malware payload (Smoke Loader)", "value": "7e36265ad76fa6f482fdc09bcf491768d50a06a81fdb932f5b0b995d7af2bb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803270, "uuid": "3fbde94b-605b-4ce0-9d22-be2913f10cff", "comment": "Malware payload (Smoke Loader)", "value": "94083b0572bb6e1f7e39f79ddbf57ddb6d6403b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803270, "uuid": "eb9fdc83-2c18-4646-95ad-2b7ed84be05d", "comment": "Malware payload (Smoke Loader)", "value": "75467ce763126dd0c5c84bb6648afa10daa2e1aa276a74e6ce12c26e1357a058b587e50e4cb4f56639fd581e2e43af5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803270, "uuid": "5015c578-9eb6-4476-9996-4ec720421119", "value": "T17B548F1363A16C61E56A8F329D2DD1A4373EFCA18EE9779A32287F1F04711A1C572B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803270, "uuid": "db6826e1-576d-4b19-adcc-2c46095f284a", "value": "9d37df760655c3ef5d6cbf6ba5a52e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803270, "uuid": "a213dd75-0b9b-4a79-af82-5d39ead3239f", "value": "3072:jggnaFdL4g68uXydp6jOI4u/0SoJBb0jza64gnQdH8L8wW/aT:jg3Fqt8uXyijOI48m0KmArw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696803270, "uuid": "b22cb487-827e-4b91-b30b-f50a3328e281", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696803270, "uuid": "65ad3c57-27eb-41c4-b5da-74476d49adc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803270, "uuid": "5021dc09-2026-49c8-83b1-f4dd4b71c299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b496f40-65aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696749177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749177, "uuid": "d9bec68e-f922-4b56-89da-b5654ac84735", "comment": "Malware payload (RedLineStealer)", "value": "222dd02a579cda5778599cc9dbdc1202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749177, "uuid": "cd6685f0-1d24-4f71-9690-02a1aa0fd667", "comment": "Malware payload (RedLineStealer)", "value": "7facbc0f3f99b780c838a040234fc2e1315bd3d3acadc0ee0226eb890e891605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749177, "uuid": "397e051d-b610-4382-892d-8d39cdd82310", "comment": "Malware payload (RedLineStealer)", "value": "05d759fd6773d1c4552e2a7bf6b63fd95892aed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696749177, "uuid": "444eda27-0d20-41d9-820f-5a123a3da4fb", "comment": "Malware payload (RedLineStealer)", "value": "a5a6db088444cdc6b276421adb1e4b19724eb59d1dc95a7eec7850be801055e22e0d69027976293332dcb038aa146819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749177, "uuid": "4a11152d-0c92-4118-b64c-00313040b6b6", "value": "T147A43A902A579871C163363B05BCA5EF1629E06606521FEF7F601BBE3F392C256B3D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749177, "uuid": "67da74d9-be41-4aab-b67f-fd4ef1142143", "value": "abd414d2e28dbea147f5fd75ae68918f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749177, "uuid": "e550038c-041e-4cca-8233-c0e2fd4f85d2", "value": "6144:MO4Yjc+VxhflR1TmLKN3AOK1XtSMc3PqO1C4ubJocp4kQAl4q3oOZ:MO4ocYxhNhkponSO1C4uu64kQ4poc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696749177, "uuid": "3642a7c8-6e0e-41b7-848e-6db8bac87461", "value": 468936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696749177, "uuid": "8c7ea7a3-ad7b-449a-a56a-f0544a8f3713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696749177, "uuid": "e1ae94e6-ea39-4555-bac2-f31f2333b85c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6eb0b6-6620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696799884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799884, "uuid": "39c6b4e8-c02a-4e8c-a20d-ba2f51267ec7", "comment": "Malware payload (IRATA)", "value": "40b8f13852e8775b3e65ef501d5e5269", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799884, "uuid": "77f7f52a-ffec-4175-b720-c8a1d1347ea3", "comment": "Malware payload (IRATA)", "value": "81bb5d57f9df1959498b08f1fe4c0b1c0c7df686898f7a533e54566a4773bddc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799884, "uuid": "aa79b208-9ceb-439a-a0e3-00f1fa4622dd", "comment": "Malware payload (IRATA)", "value": "63803e1bd8b0c04dd60dbbab20aea43d079bdb78", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799884, "uuid": "9c2017bd-0866-474b-a3f2-97737951fba8", "comment": "Malware payload (IRATA)", "value": "d0764c29a45f74c4ad5ac38a0c052ea4afb923a59068c896960013f096e05564d0a65da098f6a456babd729b67059faa", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799884, "uuid": "0186e506-9ec0-44e2-863c-1a301845314f", "value": "T123F5ADD7F395686BC4F39372817613A5514B4C228F83AFC76D28723C29BB9C41E59AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799884, "uuid": "93f6aff7-ff39-4f77-b7f8-e8703e4848f5", "value": "98304:UL3tWG3gLCrgUeXS0oNoLcnUCBgHbvM4t:ULDeXS0Mb5BUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696799884, "uuid": "2412248b-1a94-4cb4-9c53-0d33b3688790", "value": 3599383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696799884, "uuid": "4d19a91f-6d33-4297-a9ef-58ee0a36555f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799884, "uuid": "6e4f268b-3c7d-4d56-91f8-17f0534baf27", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bc8a03-65c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696761995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761995, "uuid": "3d9bcf02-4d4f-4720-9ba7-8e9357bb2d80", "comment": "Malware payload (RedLineStealer)", "value": "9341d5d0405c6b78cf34d91817889c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761995, "uuid": "6e38a5a5-79c0-456e-874c-e3b873c0101f", "comment": "Malware payload (RedLineStealer)", "value": "831e1887de32640a9d66dc993eba2c31a7e01f017f69051cc8b94e76fd4bf51d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761995, "uuid": "802f7e9a-2a27-4622-a58c-6d2516461d9a", "comment": "Malware payload (RedLineStealer)", "value": "67f6015ea547eb129b0a30218862f72b4d3780dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696761995, "uuid": "b05a3b73-e802-4a06-b381-935d58682022", "comment": "Malware payload (RedLineStealer)", "value": "7400621e713cdb6d0b588570691181cb36320b22cde0f01b438ba840ba494fd7132e0a1228243734861cd9f548ca6282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761995, "uuid": "d561ac18-bd8c-4cbd-a394-d93e68465a6b", "value": "T1E3A45B7167B0F831D0692D3907B4F7290E2AA470CAA60EF713EC45592ADDAC75B6C3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761995, "uuid": "236a9d78-9610-4819-b0fc-b99a739d9434", "value": "abd414d2e28dbea147f5fd75ae68918f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761995, "uuid": "0a70bbea-5aa5-4151-af21-739cff91bb0f", "value": "6144:EtIZZuKBhlfq1T9AgKnaAOT1oDxhDh54d/K0rgCLtLiwZEnpKfOZ:EtuZDBhhlaluDXh54d/KCgCLtLirYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696761995, "uuid": "072cb099-ed64-46e2-bcbb-cb0f8ca57efc", "value": 469448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696761995, "uuid": "e68ad10d-9792-457d-8625-692140325971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696761995, "uuid": "74570892-0c5a-4189-8718-cf0b152d45d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754e696a-6619-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696797002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797002, "uuid": "88a8f240-dfc3-4976-acb8-f051173176c3", "comment": "Malware payload (CoinMiner)", "value": "fa1e97c7f20bf700a76427c1c6dd6970", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797002, "uuid": "fcf251be-f482-4126-a8ea-3396d5fcb7c9", "comment": "Malware payload (CoinMiner)", "value": "85b7b6cb61f1a5827c08243abd55022058e1dab967917ff39975dbdc0d93a542", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797002, "uuid": "1f08ee55-658a-4354-872b-2c2d7355aca5", "comment": "Malware payload (CoinMiner)", "value": "1f6522235758eebaaf186be025246f967617ffb6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696797002, "uuid": "da298b91-b45c-4838-a832-d51c300df7e1", "comment": "Malware payload (CoinMiner)", "value": "e7e9e784f0b14cb81a11f41470ec60270c14ef72b721eb0ff454fc75ee18a339c20006aad168001b53e228f8afaa1be1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797002, "uuid": "c23863ac-40e5-4485-bcd3-ae6abd4f4710", "value": "T141547D1363A1AC61E52A8F329D2ED1B4772EFD91CEE8779A33546F2F04701A1C663712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797002, "uuid": "a800e9ef-cfdf-41f0-bbac-77f47c810edc", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797002, "uuid": "4601b649-69b8-4b81-87b9-b71c831a68b7", "value": "3072:Y0+mbRe4h3drmLf+xo52RM0W+xzWAip7eSzFhObhytiQYTQ8J/aT:2ueg3drsyo58M10WAipKSzFhOFkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696797002, "uuid": "09057d7c-3814-415d-bca6-b4dcaa16e438", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696797002, "uuid": "845913d4-11d9-48f3-bff0-5bb450e5b9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696797002, "uuid": "1ed5b990-417a-4681-8c33-329c64b4342c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06176e9d-6618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696796386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796386, "uuid": "9230b760-5e1b-40fc-964a-69f009d19f01", "comment": "Malware payload (RedLineStealer)", "value": "bdbe9e9f00088970688fbbf2f2695743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796386, "uuid": "dd0bdbd3-9990-49e5-b154-b5db698c8d6c", "comment": "Malware payload (RedLineStealer)", "value": "85dd018102034bb96ca41cb1a6dd0ddb898431e90caff828af6975e2e17da1f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796386, "uuid": "7bec1fac-5e5c-4df4-b328-a06d5f17d37f", "comment": "Malware payload (RedLineStealer)", "value": "c2b9fe29f5f6e4f89e7738cbd639cffc1326ab54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796386, "uuid": "eddd7d99-b839-483e-be0e-429c7cd3536c", "comment": "Malware payload (RedLineStealer)", "value": "7355281d7e28b2283581b864ccedb9f5bfaa42c826c2e1ee9f7bf668bbc3c5742fd2a112448ca23b06117d185eb5a78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796386, "uuid": "d011a729-ae29-429b-ba86-45071855b5bd", "value": "T174452323BBE5C0A1EDBA47B018F622431775BC648CB842F7368BA75E0DB3950597231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796386, "uuid": "257155b5-e99f-41b7-a977-2e5336e8d918", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796386, "uuid": "246e1473-ddcb-4a54-8fce-f21dad1c415e", "value": "24576:kyh33PZqQMIrjPlsn3oaajJ9zmHGLJnvGSaEdKUwFLOXWudi3flU0fP8Ft4aUacM:zlPk4ru3o7J9qHGtve1udQflt8FsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796386, "uuid": "5f3132f5-6a31-4293-902b-044f1f541ce7", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796386, "uuid": "2f1d96c3-76bf-478c-abd4-e1c8f3362df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796386, "uuid": "e5881901-75a6-43b2-b946-e6ffce495354", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13dde5a4-6606-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696788678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788678, "uuid": "cbf09e61-1f8a-48c4-92ba-72032160520f", "comment": "Malware payload (Smoke Loader)", "value": "50f3c3defd68b3b3da2b424f6ab8ce41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788678, "uuid": "963bdf6b-863a-4eb0-b5ae-eab02c30ca77", "comment": "Malware payload (Smoke Loader)", "value": "864bf8c04d858b519b34029e0389de3839e0e66d784c59364b35ea86e4c4bcd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788678, "uuid": "816a25e6-a7b1-4cab-b660-22ccc1278ae8", "comment": "Malware payload (Smoke Loader)", "value": "880a0bf8c5fc1d4c265fac602b1635be394be690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788678, "uuid": "cf93e79a-8076-4eba-bfeb-75079834f03b", "comment": "Malware payload (Smoke Loader)", "value": "a78805e6e51bc47a1ec6c087eb7dea5a5cd3048e399449882529a9f8b292889b5db817d436af88e9b42adc22490b2ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788678, "uuid": "b53af13c-896a-496a-b839-3be9fb8fa01b", "value": "T120452302EFD496A3D8B04B7098FB17C30E357CB666744147069AE56F0CB3AA6E53437A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788678, "uuid": "30f03222-3451-4c15-b2a2-0f1f36c382c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788678, "uuid": "ab471d6c-614b-46ac-8818-ea0e52a6d0c7", "value": "24576:HyrS8LHKLN0+yZ+yvYkd0Rac5ZQlVMPsNlrevPzEyI+O:SrSCqLAZ+yvYY0RV5ZQldlWPgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696788678, "uuid": "3e90f06a-87ec-463a-8ae0-4ea29475547a", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696788678, "uuid": "8989ad01-b973-41ea-9fa4-e4182de7f92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788678, "uuid": "4ce04521-de79-4ccc-b846-62ad1e6d2fe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2767878-662d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696805721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696805721, "uuid": "6e0b907c-e850-4f19-8141-1ad8a9bb0a03", "comment": "Malware payload (RedLineStealer)", "value": "3ee09218829b1b2bf65bc2203e94af4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696805721, "uuid": "c302de3a-9b23-42fa-adab-5db0457acd8e", "comment": "Malware payload (RedLineStealer)", "value": "8741ba484a7bb1e25ccf924e813ecfc30065d900931762742b66b0e7a4372395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696805721, "uuid": "a67acfbe-688e-4a7a-b32a-edf19990c620", "comment": "Malware payload (RedLineStealer)", "value": "49f54c82ae0e2ebbdeb50ea2a03830258c6922a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696805721, "uuid": "5a2d8bf4-eadc-4e9a-961f-c8d9a1c186c3", "comment": "Malware payload (RedLineStealer)", "value": "00303851771d771fecaa4d64ee106c66801434a1c525f4feb963f551e1cea3446d8018a5fd6bc1640c330425f1c815a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696805721, "uuid": "d2c15e2c-06a8-4e3e-b099-10aacf3a8548", "value": "T14C449D1175D1C433D572153209E4EB7A6AFEB9600B615AEF67E40F7E8F302C1CA31AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696805721, "uuid": "1c89009d-9383-461f-b9e5-a0317c653cd7", "value": "ec52118c8f3a38f5cc07e496f7fb55f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696805721, "uuid": "84b2d34f-a7fc-4fa0-bcaf-5ea2dc7855b2", "value": "6144:bDWfTqHz6GV3Dmsiwyf0LvfhYuJAORr/NeBAQrQS:bDW7QzZV36YLquJD0rQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696805721, "uuid": "599e2d4d-28f4-46f2-a8ce-4100b80deb04", "value": 277880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696805721, "uuid": "360d814b-20b3-420a-8a14-ed141e1c1a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696805721, "uuid": "beae4ec9-a84a-4a09-aaa4-958d581c0cfb", "value": "3ee09218829b1b2bf65bc2203e94af4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c0e2f-6620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696800102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800102, "uuid": "c0699b54-a008-488c-a57e-679b8858db03", "comment": "Malware payload (IRATA)", "value": "008e7dee3c3634d8da37d0d4dede3233", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800102, "uuid": "3bdb6784-0369-4d46-b981-32a6c98c1493", "comment": "Malware payload (IRATA)", "value": "8892dba951a4fc58053a62e18ba5143881599be7808376d9baf6dd5e12a842ca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800102, "uuid": "70935ee4-be90-4eec-9639-aed3e9681638", "comment": "Malware payload (IRATA)", "value": "2536fe41abc37367b3924c613afd759c7967475a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800102, "uuid": "a1e831f9-d932-4a3f-8424-21abc4b1c654", "comment": "Malware payload (IRATA)", "value": "8dd483ade9f17662d11465d04cb91f95b96e4741600703244672719ec541f7293d71b7d3678c96cb3481167eded29af1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800102, "uuid": "ef59a830-b8ec-4ad3-97c6-7215c55ab615", "value": "T1DD36CFD7F794A95BC4F39331817653AA51174C268B83EF836D04367D28BBAC01E5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800102, "uuid": "007df746-265e-4e09-84a2-886f9cd1fe74", "value": "98304:3a0a4+MNpgLCrgDeHEoRlhWQJxveu/JnvYMn:3a14+Y+eHHvF/JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800102, "uuid": "7e7d87b2-c0e2-4bb5-bb46-2817c6b7e260", "value": 4950002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800102, "uuid": "3ec2b32d-19ac-4c5a-afee-84f840a7aaa0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800102, "uuid": "d1afaeb4-30b0-4b54-932c-618993ff34aa", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f6d067-662f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696806618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806618, "uuid": "32f30924-9710-44e7-9fb5-1329043d672d", "comment": "Malware payload (RedLineStealer)", "value": "0dcefa8d21bcffd5cab8adfb7f3ff988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806618, "uuid": "af7c1d52-af7e-41b7-bfdb-0803ba2ae174", "comment": "Malware payload (RedLineStealer)", "value": "89e0f5e2ac9db2d213b5b068e2b3b536eef3ee5c056c66f4c15e51ceeaee7920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806618, "uuid": "c33a497c-48c4-4635-a41c-e432dd7ab49d", "comment": "Malware payload (RedLineStealer)", "value": "89513a245f0d682bb44da88e421307343acb87ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806618, "uuid": "5f9e1d9c-50fc-41cf-b5f0-49b58b23b582", "comment": "Malware payload (RedLineStealer)", "value": "3f391a82b05da8fa3af54383c6591c15e47319d2979af7ddc0c4d3d44f1d605707c695ae5e03e0756714e8b234abc516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806618, "uuid": "3789cb3b-8412-4fcb-8af8-7edd80b785f1", "value": "T1E0E41202BBDC6472EDF517F008FE07531E327C619D35839A7B846A4A88B3680A57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806618, "uuid": "fa7a9405-1b75-4aab-b649-1fc7821c871c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806618, "uuid": "fc86771f-efe2-4020-b6e2-203540189746", "value": "12288:HMrTy90ob8KDim2bPuO5B6GTq4xiItN3dfiFN58JlwwLew2VPXi/GIU:4yhbHsbzB6GT9II/taFNMerVfiuIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696806618, "uuid": "48a50774-ba93-4b8d-8678-7a9b21707f66", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696806618, "uuid": "c32ec13d-c585-4642-a6e5-d14bf0bda342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806618, "uuid": "0e84092d-3d65-4dfd-8762-df91144217e9", "value": "0dcefa8d21bcffd5cab8adfb7f3ff988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd99b82-65ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696756187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756187, "uuid": "2dbb3fdd-f6d8-4e6b-ab04-40b575308f37", "comment": "Malware payload (Smoke Loader)", "value": "5fde36096c3edc48076b61c42811f01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756187, "uuid": "24870340-2e4c-4fe6-a0e5-b00a16f86af5", "comment": "Malware payload (Smoke Loader)", "value": "8a3258d8e2ddf101c043d08960fcab0dacddf2cbd49a5da71156ed2c74a7987b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756187, "uuid": "bf7bc796-13fd-4809-b008-9a8131f5b924", "comment": "Malware payload (Smoke Loader)", "value": "74bf9c0f72e3093d9bd98f6d01b592680d9cf55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756187, "uuid": "033ad79b-83b0-4a04-95ad-f5bbc38f9ede", "comment": "Malware payload (Smoke Loader)", "value": "3c61d9920c17b9df68d18b121eaf7debe615ec41f20f3674c3a5a530a5d0b07770d8e9957210d87eb6ea58044e2165a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756187, "uuid": "6a13db59-1158-4bab-8e24-e54a1ce1bc97", "value": "T19E547E02A3A1AC61E5264A329E2DD2E4772EFCA1CEE9779733547F2F04711E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756187, "uuid": "45180532-2647-4fe3-a7b4-ff6afb360420", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756187, "uuid": "eb716d5a-f258-438e-8468-955348718eb3", "value": "6144:mo62WQJd7dPzyXvk/ujAIEU5fiJz0ZI8:mN/yd7d5lIXJqz0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696756187, "uuid": "ad48e63b-8ab8-40dc-9851-f822448bf2d0", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696756187, "uuid": "464bf0c9-28f2-4877-a66a-12be1be4ed7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756187, "uuid": "bc1b9f18-27a4-49a5-9c8e-25bf40f0a0ae", "value": "5fde36096c3edc48076b61c42811f01e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca02a35-6603-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696787726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696787726, "uuid": "aaa315f0-dd71-4aff-8e18-2dde7cd3676e", "comment": "Malware payload (RedLineStealer)", "value": "385628e1bd9218cf7b4e613b62c0f7dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696787726, "uuid": "1e7977f7-5871-483a-bde9-18c64a996f40", "comment": "Malware payload (RedLineStealer)", "value": "8df90393e0c085636f49c3519778d75c7988d18ab774aa77769ddb5a14ed9676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696787726, "uuid": "fae2d6a6-5fea-4d80-8a51-1f0341e50bec", "comment": "Malware payload (RedLineStealer)", "value": "939dd6b2c2cb7bf4e500a92c4acae51beab25549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696787726, "uuid": "4bd55f7d-8b16-4f32-8c09-1f6120972088", "comment": "Malware payload (RedLineStealer)", "value": "c5a44f964bd3ac46c7f4f4b971a894c05db4627b8f2e64e467b4a238792203e231c4f044386f1c71679f0dc0730edb3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696787726, "uuid": "f53b0a76-9981-43a0-b7b3-fb791adaeffb", "value": "T1F34523676BD94023E87223B1EEF60AC70B363CA0AE3C575B9651691F4C774851A3633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696787726, "uuid": "0bc24370-0967-42a2-bfbe-af3e5a280f6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696787726, "uuid": "409f4aec-137d-42a1-b7b7-9b17b18a950b", "value": "24576:1yhkOI83y7TGqatHFB9KZ87Y7bOrxVABGm1NOmEvc:Qh83vatHFyZWYQxVA0O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696787726, "uuid": "fa4fa151-7171-4878-9cc0-a1d632b6875e", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696787726, "uuid": "8bbb9ab3-5bd8-4a08-8610-339525850bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696787726, "uuid": "5726bc27-4973-4355-83b9-ad13e1fe57ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba86415c-65b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696752880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752880, "uuid": "03b0d8a4-1a02-4bce-9a3d-7faf267249ee", "comment": "Malware payload", "value": "dfacf11cff37d089fdb939534d1680e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752880, "uuid": "6298620a-1d03-4028-9c73-2ad7c6326eb6", "comment": "Malware payload", "value": "8e97f86958e8abcbac1caa515bd07b0c20edc5c48b719e3d2a4f9ac14912165f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752880, "uuid": "843f9926-6d78-4b14-beac-684b4f2d913b", "comment": "Malware payload", "value": "f65c2eb6068f1a0daee7126592c5b035c3ccaf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752880, "uuid": "fc1cb9ad-7168-4eab-b10e-531fd32c71bd", "comment": "Malware payload", "value": "ef76eb5589a7199a899e613062606914f2b5cac45d3a72f6ad7c46141e4685ed501e089295f6f12b25e9fa91e1a1051a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752880, "uuid": "4ace955f-9dae-4222-b9a1-94b96cdcd5f2", "value": "T11AA4F14AA7D411B7D63A43B884E3859399327DB58B452BBF17E5B1BE0E333C1603670A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752880, "uuid": "0470f639-d080-4e1c-a0d4-66ef854980b8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752880, "uuid": "526e4c54-0c7d-4c5a-8b07-3ad4f9266f7b", "value": "12288:Wi4SSgPMpp35D+VmF6NetO4CJvy4g7X/pPk8y:Wvl+U+Vl6CJvy4g7X/hk8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696752880, "uuid": "b1fcea7e-ae0d-4d1f-9f76-e1d8a2845664", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696752880, "uuid": "251061ab-2cba-4991-b983-7e3aa6dbb587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752880, "uuid": "04196461-d0a4-4c65-a55c-cea02af9d96d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b6b58e-65ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1696750969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750969, "uuid": "c3872593-faaf-4250-af14-55a2d5da8dab", "comment": "Malware payload (DarkTortilla)", "value": "4408ca94191f9183b4bb7090a3372487", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750969, "uuid": "c91f232e-a418-4bf6-955c-33c381c5990a", "comment": "Malware payload (DarkTortilla)", "value": "8ecbf9e22f9274f3cb08ddc72750e8b9216a8d6a81a7838be2dfbd5a4b88279d", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750969, "uuid": "908e18c2-ab97-4b81-ac2a-520e6db8ea2c", "comment": "Malware payload (DarkTortilla)", "value": "e8247530efc1082164090f54d4e3f0facc8344dc", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750969, "uuid": "b82c54f4-0258-4f7a-a181-2bb10408cc8e", "comment": "Malware payload (DarkTortilla)", "value": "2e4f5d20e31ff1d957368413dd23a69935e744a1543a69c5249d794e49d2edd2c682793fd2cd4f515c86e9761a439986", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750969, "uuid": "6e527757-ad79-404f-b1bb-a9180a8fd226", "value": "T1ACC42331F263E0503C53D878D4CCA54D19E07D2B7A64EBD1222FA5AB36594CBBBE4836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750969, "uuid": "40482adc-32e0-4944-adda-3dd87f9c721a", "value": "12288:w4RRJPm2PBZewl+mSX4oJnFmQfa6VSmkV0aryzt+:fRRJeQBZeYSXzJkQfadXearc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696750969, "uuid": "1c06afd1-25ce-42d8-b7f5-f6b7038ba7cb", "value": 571253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696750969, "uuid": "2c2fa775-b815-416d-8a6e-77ce7ff38e6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750969, "uuid": "e0f1ea70-7fac-4e23-b003-963abf08d462", "value": "4408ca94191f9183b4bb7090a3372487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09388f2f-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696808417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808417, "uuid": "a8b2b193-b24e-4d7c-82ad-6e34ca14ca6c", "comment": "Malware payload (RedLineStealer)", "value": "120066763c3952d27b7fca51ec3a9d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808417, "uuid": "66b8ad26-bf3c-461d-bf82-5f9dce1e2cad", "comment": "Malware payload (RedLineStealer)", "value": "8efe7de6f1aabbb116d431754ff965b8cdc40cea85eb12735c4ae76f4b20ad86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808417, "uuid": "3c517486-c551-48c9-9a84-6c7d80775f91", "comment": "Malware payload (RedLineStealer)", "value": "fc86ab119033e3fb62b91724ba9af3a95beedfd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808417, "uuid": "9e70afe8-444b-4404-a46c-9d508e53068d", "comment": "Malware payload (RedLineStealer)", "value": "b9afe7d6513936854bc92e8e78ed33fcd4801d8176359625308c1bade99fcf00b09abd9fe5b2db986547acffdabd67a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808417, "uuid": "5a24fb70-bfad-45a9-9d29-7262a08543e2", "value": "T1ED75FA1176F95B59FAF34FB85ABAA611087AFC6ACF11C2DF1251904E0D21BD08970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808417, "uuid": "328eeb4f-89da-4a68-b5a1-6b5c5b738407", "value": "b092678fc438a3bc6ea71ba0ea4cfa08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808417, "uuid": "cb185267-d77c-451b-95c5-9ec0ddb49eff", "value": "24576:lxY5W7Dim9LMtNV3bqgHZY2gm6a9Dhvh1uchg:J7Dim9LMtbLqwYnm6a3vrJhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808417, "uuid": "f0e7c86d-8c5d-42f1-a815-cf525cce9e73", "value": 1692160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808417, "uuid": "f3ec7cca-0684-4466-847b-2d98895de5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808417, "uuid": "4981ffd1-36d9-4ac4-aaa3-7a6468ef4841", "value": "120066763c3952d27b7fca51ec3a9d62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eb518c-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696753604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753604, "uuid": "af9fd38b-f122-4aed-89b0-e5f2ac7abd1f", "comment": "Malware payload", "value": "d8a5e74d3cf250db67683ab09eea530b", "object_relation": "md5", "Tag": [ { "name": "Skibidi toilet", "colour": "#9DD466", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753604, "uuid": "8f4406d4-e47f-47e5-a208-78afd3ebd735", "comment": "Malware payload", "value": "8f5c8cdfdda7d9d00415def868a2945efbf7fcba2ed48e00e5e656a71329ae3c", "object_relation": "sha256", "Tag": [ { "name": "Skibidi toilet", "colour": "#9DD466", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753604, "uuid": "82a4f201-5b05-433f-8d40-c97c609485f2", "comment": "Malware payload", "value": "206160788eb21e8e0ec380f3c8e5743cecf57685", "object_relation": "sha1", "Tag": [ { "name": "Skibidi toilet", "colour": "#9DD466", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753604, "uuid": "816cddb2-da1f-4cfb-a6fd-7cbb192c6bdf", "comment": "Malware payload", "value": "f118dc9bd859973992bcd263bf5fb8e06e1614e0f17262d0af2154c999973bad83de97713bb6b0ba0c6f4ce68d70d570", "object_relation": "sha3-384", "Tag": [ { "name": "Skibidi toilet", "colour": "#9DD466", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753604, "uuid": "8ea8c925-59e4-4eae-9824-3f34b5b037b7", "value": "T1D6D3128E1762F9BD96AD2E1035A00419F2CBAB67A3E5EC2086F35FF222545D114CFB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753604, "uuid": "4ec30bb7-0c3b-46b6-84c5-5fb549a05c34", "value": "3072:zeG+LZxN7pAFUAuxCc66Io5Dz9oC3+AXhEZHDkC:rsC0xCc5ZoeyZIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753604, "uuid": "315f0bd5-4f3a-4077-8c00-b9a05b0c3305", "value": 131686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753604, "uuid": "371e7138-cd25-4a63-a218-34134035e992", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753604, "uuid": "eb6efc30-ff69-4ffb-a5b7-58cffd2b6f11", "value": "Baby camera woman.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77738be-65f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696782054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782054, "uuid": "44f0312b-55f4-4914-8791-736411358e17", "comment": "Malware payload (Smoke Loader)", "value": "0a98960babca771d88935fb6cdc9346b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782054, "uuid": "45e5fa56-3d69-489e-8a14-5bb9f60151b3", "comment": "Malware payload (Smoke Loader)", "value": "9104e853db817d29672ee5ad05e06415466efc0fbb5529449a178414695f0114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782054, "uuid": "7f90bb12-2bc1-47d2-b0c4-fed428292ce6", "comment": "Malware payload (Smoke Loader)", "value": "66e79dd3ab1e29cfb62d60bf6c19dfa01b7f8248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696782054, "uuid": "4f6188d7-9bd4-4911-9f95-5914fa0a3ab1", "comment": "Malware payload (Smoke Loader)", "value": "7c26af8da135e7ffdfe9c673a38bb91c21e4aae0db7e01c8b3e62db203ba389096aa1c4f4f17334cf83e739f6ce7fa1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782054, "uuid": "463f0e23-f02f-4df8-8017-8885afeea792", "value": "T111548D13A3A16C61E52A8F329D2DD1A4373EFD91CEE9779A23186F1F0871161C672B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782054, "uuid": "a1bf7f2e-d6be-4118-8682-7601661f66b8", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782054, "uuid": "16ea929b-0bc1-4b6e-8b48-66c88780039b", "value": "3072:H0s1Yel4hsipca8JZJyNhOhYkcYtulkYD6dQnTLePrQwoQZj/aT:XLlgsi+HrTepbDLTob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696782054, "uuid": "e556d1c3-2ec7-47c9-95f9-6f1061654cac", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696782054, "uuid": "ceef6a5d-05a9-42db-99f0-b8f5141cf81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696782054, "uuid": "3985f16a-83ce-4a11-9780-79833abe7184", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186695f6-661e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696798993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798993, "uuid": "2180998c-1c99-40da-97b1-98a72770192e", "comment": "Malware payload (IRATA)", "value": "e8c9849cef5703a8418e97bbf2dd1cd6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798993, "uuid": "efee04db-899e-4c2b-bd4b-7cf172d0140c", "comment": "Malware payload (IRATA)", "value": "912f779a26acd7ea345c37fbba8b3b9151193a0ac74986c077330d523fb2772a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798993, "uuid": "ddd81b07-89b5-4039-9217-a80840f53c48", "comment": "Malware payload (IRATA)", "value": "21a6dd109b157631b830a68ef4313e0ec8958cf3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798993, "uuid": "5068ed01-17f6-497c-972e-45c15cdcebd0", "comment": "Malware payload (IRATA)", "value": "046785c570f1dd769a1abe555450803a87a7a7221c538ae6b9f234ed26e36f2087347b0b38816009d92b0cd3538f2173", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798993, "uuid": "039ec6fa-753b-4bf2-b493-632b90f413ce", "value": "T1F0F59D87FBD4A85AC0F39372817656A651474C268B83EFC36D44367C28BB9C01F5ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798993, "uuid": "981410d7-56bf-4f85-b85d-a2a8e5eeb50b", "value": "49152:RPSQWc/ktinEJkJLIET4HrIL/yFgLCrgDqj6xZr67ZfvmD+D:Bd/xEJkJLpTEgLCrgDk6bri+D+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798993, "uuid": "ba8a3067-b941-4c7f-baaf-08f659a02759", "value": 3569618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798993, "uuid": "5cf106d4-8f7a-4179-9a6c-6dd0d2d93689", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798993, "uuid": "a30d482e-340a-452f-8c15-157c5e4a2c74", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480b4210-65a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696746245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746245, "uuid": "cc1ec086-8aeb-425d-aaf8-1ecbe5d9d997", "comment": "Malware payload (Stealc)", "value": "ffc9033099c61dd132d3d08d29ccce99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746245, "uuid": "0b2da3ca-236a-4118-ad00-eac63fdfaaad", "comment": "Malware payload (Stealc)", "value": "92f8faa5180fb698b2313532039b120227e32255dfacf2b3139a4b3734a1fe0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746245, "uuid": "86f4ac04-2e3e-4c61-8de1-485e828e3060", "comment": "Malware payload (Stealc)", "value": "767826f018f59db960024f6a68c959c3281309fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696746245, "uuid": "4b18aad2-3663-4440-8904-d2bb941b285f", "comment": "Malware payload (Stealc)", "value": "ad7225feacfa14d3524c5e3b5b7fcad063169e136d1c26904c31e5d621f48a2dc291f0bcd0ca37b418c70afc80f4e6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746245, "uuid": "2a01ea38-f64e-4925-a79f-95fb5b57b8fe", "value": "T15174B00297A1B821E5269A329E3ED2A4773EFC91DEE8779733147F1F08711E1C562B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746245, "uuid": "d4ffe9ea-9536-4790-8144-aac15256432a", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746245, "uuid": "4162e2a8-a02c-42ba-85fb-f27837f9ce81", "value": "6144:kTrWUc7KpUHsz1Sa/zjMSfdAVb9YdqFhrHrcf5/W:kO37KB1/zXfmthk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696746245, "uuid": "f397e0ab-5264-46fb-a8d8-88bf4efe25dc", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696746245, "uuid": "0d4b681d-6f91-47ee-89d8-9968f343f691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696746245, "uuid": "8dd980d2-6370-43f4-8524-f5972e74bcee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e7a7b2-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773614, "uuid": "3f2a0dcc-dff3-43bd-80cf-022fb0def013", "comment": "Malware payload (Mirai)", "value": "1f4796ae6e2512b8870be5ab8a71487c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773614, "uuid": "11f730c6-b7c6-45e2-9ea4-da3c4a44fffc", "comment": "Malware payload (Mirai)", "value": "9374700b5b64cb3b78f41a8f648b5567594c58b31e0a01acb5a0e62858da8049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773614, "uuid": "df23e184-3628-440b-a264-6094af87f404", "comment": "Malware payload (Mirai)", "value": "a35b49879bbcacdf8b0c4bba1b281914f47b2e8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773614, "uuid": "a21a3b14-bd88-4a17-854d-3f3706ab3ea8", "comment": "Malware payload (Mirai)", "value": "c792288998c2b95a1d3f0db4f3985e031c0700b1a0f157e62d230c2f7d6952e0743cd8c18208834989aac280ca23e492", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773614, "uuid": "b6d57d09-d914-4fd9-982e-128bf3a61635", "value": "T181730A86BC809A10C6C50777FA2F218E3307579DF1DE7352CE155BB07B8B91B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773614, "uuid": "e452e790-0fd9-4a16-933d-903e4f2413bb", "value": "1536:i6nOdybtD+q9ZYgJouKsXHMXLFD8J70qNdhQOmz8QI6iy5xdmpeY:idwL9ZtJEwHGEYqN/+5xdmpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773614, "uuid": "9a83d42a-1450-489f-be8a-ff4e81732dcc", "value": 80544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773614, "uuid": "a632668e-7a7c-49e9-ad89-7ed40bdca8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773614, "uuid": "7d834a29-0a67-4e7f-bc06-5409c80fb1bb", "value": "1f4796ae6e2512b8870be5ab8a71487c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab4a968-65d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696768261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768261, "uuid": "5488a9cd-69f5-41d0-8423-3bc726ed05bb", "comment": "Malware payload", "value": "74f28e28df4386befa5b4167fa511b33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768261, "uuid": "e333691e-c976-46ae-8b8c-0034af60471b", "comment": "Malware payload", "value": "9554e7ef83f9c1aabed52be7a308d7e25c99e7d71e006146aee045d29784f92d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768261, "uuid": "4e390901-e09a-421f-adc3-ed816d9672b2", "comment": "Malware payload", "value": "76900b7a8d1d63f04912c2c7a8d2d284e81c134f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768261, "uuid": "095bdecf-6181-45ad-9ad7-af4b6218978b", "comment": "Malware payload", "value": "c223c698ee557f3b864458680ad3bffccfa671b4c6f874c0310cf09848fe63f76f21fe98399430bdf2abacf57a1788b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768261, "uuid": "f23b1153-7775-45a1-8f09-686ebc6b2d89", "value": "T1F0753369D6E8357FD6EB877181E10147D6B0B2A08B3572AB1EC2C9F5D5233C0317AB89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768261, "uuid": "7121c64c-c9a4-48f2-92bb-b80023157ffd", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768261, "uuid": "5d0f474a-bb82-48a1-82db-f326e82c8785", "value": "24576:R6XsIC7nc42I60pi1CPXmlMMK/Z1cCljwKy1hLG9BpSNsYRv0YziTZa0wqKJj2AC:A4IfI6qKKvcMwpU3T40CqA4cnEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696768261, "uuid": "f35d9047-f7e3-46be-9669-11b44dc947a4", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696768261, "uuid": "eb57cddb-dab3-4d8d-bab6-6b49548a0248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768261, "uuid": "ff8f96e6-05f4-47d2-871a-be2f658f83dc", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15159c0e-65de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696771500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771500, "uuid": "a157be32-8d33-4585-a63a-261bb3a27f5c", "comment": "Malware payload (CoinMiner)", "value": "452f303bac83dc941d6433b176449867", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771500, "uuid": "efc98cf2-5c37-4616-8c74-5f9d391afdd7", "comment": "Malware payload (CoinMiner)", "value": "98348e8b85c3fc64f80db5578f4d474732a69220c17155ea93104dab72bd71ee", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771500, "uuid": "0aaf5f35-d867-4626-96f7-444f80defa4f", "comment": "Malware payload (CoinMiner)", "value": "5ad4b1842f9b04319f8f60a8e44058672ffc4c50", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771500, "uuid": "d4f1299e-eac6-437a-a40a-0bf5c3d63dd9", "comment": "Malware payload (CoinMiner)", "value": "30cd0f846a7a239c62a4f8342b78106dbbdae1ac503870894d9dfe453d8f4f7ff43aa2f6c7473cba18e92310ab65f476", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771500, "uuid": "17cb199c-c46e-4ae5-a6a4-65453fc863c4", "value": "T17E548E1363A0AC21D51A8A329D2ED5A4772EFC91CEE967DA33547F2F08B11E1C662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771500, "uuid": "b2ebbad9-50d1-4f3e-8f3a-3318085df098", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771500, "uuid": "758f116a-5db0-4455-b1fa-8742518f445e", "value": "3072:ecSKLbut7BWLMcD/FHNKZuKqtyONJvq4H6gGIvuFHrHtIxJXA4/a9:oKHOWwe/RNKkK0vNdq4HZG0Wr2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696771500, "uuid": "8bc388a6-f5ee-4286-a4f6-a678f6e00cb4", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696771500, "uuid": "30594936-ecee-4fd6-9f5b-3c9a30fbee19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771500, "uuid": "a1d7cb28-0903-4ca0-bf98-d473d387faff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fbacfa-661f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696799424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799424, "uuid": "2e7f42be-cac9-4d3f-8422-5fc44fddefc6", "comment": "Malware payload (IRATA)", "value": "8e8b12fd916bd219af9cb51c632ce6a7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799424, "uuid": "47e34b68-1f3f-4b96-93f0-9c84c4954dee", "comment": "Malware payload (IRATA)", "value": "98b47d5dce64e3454d1725401754b5631082169098a314971f575b77358fd414", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799424, "uuid": "22939906-efce-43c3-8f24-4c5d366ca013", "comment": "Malware payload (IRATA)", "value": "6a9002c5ca50bdd1e2c4ce55b42c3819c0b8cbec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799424, "uuid": "1fe046a0-533c-41b6-be93-0a5c0a8c8d06", "comment": "Malware payload (IRATA)", "value": "05e25d922c0a9f53b1ff6dd2c407a61acae3a6d95efd7b2609dd3e1f8766d7c40131f8f01f94b293654caec7e08b7550", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799424, "uuid": "40fd550a-154f-4342-b1f9-1bf347401b6f", "value": "T1B0D52393F775B95BC836C0322241263A114A4E598A42FB477E4877FE74BFDE84B81AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799424, "uuid": "c902fd06-582b-49c8-8e94-ac9bbe99b816", "value": "49152:KE73y9Q4ta3nQAhzP9PIwnjDb+G1Li+9Ub0DYRwNZOSAOxLc5kOO7v7p1vmAP6TB:Ksy9E3nQQPIwnfb+G1LTVDYSPjGkz7v8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696799424, "uuid": "c1b1c4b4-61d2-4a61-9da1-5070b416efc8", "value": 2748493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696799424, "uuid": "6edf878f-261c-4f90-afaf-f589475b07e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799424, "uuid": "a68c7dbd-68a4-4436-b5b8-31ac34f1b458", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23936bf4-6610-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696792999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792999, "uuid": "deb8caf8-a131-40b5-9bd2-1aa162abcfc9", "comment": "Malware payload (RedLineStealer)", "value": "a999b74ea0d77b1a0b8e7a750bac4110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792999, "uuid": "d84355f4-10ae-4866-9711-ef03dfa1748d", "comment": "Malware payload (RedLineStealer)", "value": "98c6161b199da595c22baf13f03ba94cda6db3535cc3104921842327b7c95142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792999, "uuid": "99fff2ce-41e2-4db2-a35a-99c031d460ed", "comment": "Malware payload (RedLineStealer)", "value": "170d404855687e4964cdba2beb998874d99cb816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792999, "uuid": "5e876b04-dd0f-4535-89c7-43e60a5a23d9", "comment": "Malware payload (RedLineStealer)", "value": "8e8b0c6fe1b6440a7ea921ea50067d0a816762eca67d555e8027908a533a8a67511a8cec57b04c68d4f10e7cf19d8915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792999, "uuid": "35be9f49-b8fd-4c1b-9198-4d09e46891b0", "value": "T1CF452342A7E99472E8F523B01CF603970537BDA24878D6563309E85D1CB39AD60BE36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792999, "uuid": "f48d5680-0d45-473a-af92-77f192d2515d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792999, "uuid": "f01976de-d846-4093-a6c8-c4c66292f160", "value": "24576:NyW9VEYBJmoSixecAk5IH8IUoL0jNHZKptzSQTXLlYAZQ:o+BxSixFzEoo4NZMQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696792999, "uuid": "49595571-e032-476f-9b36-155c75398cad", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696792999, "uuid": "5fecb572-98ea-4a3d-866b-530f80227565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792999, "uuid": "e7a19c77-f08f-4c22-a28c-79179cad83d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55c4d0-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753874, "uuid": "8539a0ac-da40-43a9-83e1-c102d91f2c5d", "comment": "Malware payload (Mirai)", "value": "789d09b7c9f597d909fa84882194f8fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753874, "uuid": "b07ff564-1da8-41e9-8855-20acf1733941", "comment": "Malware payload (Mirai)", "value": "98c735c6a7402013f39db0d3c3c3473b63e5b639f8e6a7cdfa8f7784d6186a9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753874, "uuid": "0cf01d28-8235-4e39-8d04-9506910a4ac3", "comment": "Malware payload (Mirai)", "value": "9f6d8037041996c2df2b913ea8226ccb149388ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753874, "uuid": "35beafc0-2568-4374-935f-e230368b3224", "comment": "Malware payload (Mirai)", "value": "d2cbfe25fdee0bdea18b289ab2cd0e9131a51b4c1bca6aa3af74c5e1d00d3294c51412640f4bb03fe2b27ee2b9539a9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753874, "uuid": "834f20e7-52a8-4c0b-86df-328f494548a5", "value": "T1B3C2D1AD318B3E92D7700C31EBB843C6F6522F72D1D13163210C9A69EB5BC4A7AB5259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753874, "uuid": "666af6cb-c05d-46c9-9d62-f4fa751157f9", "value": "768:0NMEVXvE0emuxw+Qj0eHNZJ5kBZIDAicus3UozVB:JEVfuFmFbDAiwzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753874, "uuid": "e6631c36-f8e6-4f37-976d-ba98420d135d", "value": 26048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753874, "uuid": "52d6c2d4-e8e5-4bde-8059-1004eafecff8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753874, "uuid": "41d0f7ee-554b-45c1-ac5b-a4108b263b4c", "value": "789d09b7c9f597d909fa84882194f8fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4464ffe3-6621-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696800356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800356, "uuid": "8b22d2bb-28f2-47ca-80f8-5cbbf5a85684", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5119e57bb0c971d0fae64d0548c78ee0", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800356, "uuid": "b19b3264-b91d-4591-86f9-35345d9d4bb0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "98e2336afe9aed01d8859c988cb984a017800bf5a5760a643b9f5579c8936e40", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800356, "uuid": "d7eac640-437c-4c38-8d6c-1077c90074f8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "73b785b67e0d218cbfd58a7902193402ab88094b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800356, "uuid": "3a83a3ae-e878-47ea-823a-8faa08f82802", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "624ff09e7832279bd1e1e8635dbf5fe66821db3c1b40a5f63d2d10b58227143870abf973372626a815ba526978eb726c", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800356, "uuid": "3c9992e0-f730-429c-8643-72824ac257b8", "value": "T125E6E16CB396684AB672EEC39FD2E9A2C3D79378F3058D36300A539959734F0D91242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800356, "uuid": "04563db9-9eb7-4820-896f-d6e9d508cce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800356, "uuid": "3f8b6253-8de5-4af0-bebf-44989a9bda2c", "value": "196608:MOmSIaIgCXUXYGU2MYWZ3mpejjiAN8Y/IuHB+q9LOKd/VT7cRRbYc:Ml7JgCkX1SZ3pniI9hZLOKd/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800356, "uuid": "3c83c316-19e4-41a2-ae96-7e835afaf2cb", "value": 14080512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800356, "uuid": "63ebc32a-deb8-4a99-bff2-dc5b39d4c6fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800356, "uuid": "414315db-9539-4439-a14f-4d695de29ef3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300909bf-65e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696775411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775411, "uuid": "b9494f73-926a-42e8-b3e7-f7bb4dd632d1", "comment": "Malware payload (RecordBreaker)", "value": "51322e3471267349a562287242db3b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775411, "uuid": "9d289f30-8123-4e35-9c3a-5c3bdf8e2bef", "comment": "Malware payload (RecordBreaker)", "value": "9952affcabbccc681e03047df87b05548324026730cb851fd5c89387036d4cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775411, "uuid": "28fddef6-b7dc-4cc6-a136-ed3d681e03a3", "comment": "Malware payload (RecordBreaker)", "value": "6870bd7b87ee39339072770ee19b7ab24911dfd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775411, "uuid": "11d5db67-0508-4520-97a3-9c952cc86ba3", "comment": "Malware payload (RecordBreaker)", "value": "7d7c9fca353f016409fb74932e4cb5c10be52347d32d42277f9410a75313c93163f6e6d15e049f7988a866b9907555b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775411, "uuid": "9a801d90-9c2b-4bef-8a90-3f5becdcb27d", "value": "T1B0A3D6D342B89302EB90187316D3ED737A59EC3E0D66BED3AE51CA5381ED55009DA2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775411, "uuid": "12577626-8c74-4152-a4d6-c3bdd42da49b", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775411, "uuid": "59c17243-3819-4b1e-89dc-d1cac202149e", "value": "3072:zANfQKMuflyKX9FBFya6mob2lsL6RJ//5OU:k0O9FBn6pb+DRJ/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696775411, "uuid": "bc25dde0-c45f-48bf-af59-f941e137e35b", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696775411, "uuid": "b0603910-30bd-4ec1-aad3-b3b7b723269e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775411, "uuid": "358f825e-386c-4c0e-b222-301404e155b2", "value": "51322E3471267349A562287242DB3B45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef43d4-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808561, "uuid": "78f77ac1-8628-4b44-841e-f56008f27e05", "comment": "Malware payload", "value": "781f2735b980b567aa07fec41e6d4422", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808561, "uuid": "26101f15-6896-411a-a073-89b9e0d7e753", "comment": "Malware payload", "value": "99f88559c1bad41ce0c963c16417f308cd40daea673215f25b0f84114aba957e", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808561, "uuid": "aae8583b-b85c-4ac6-8e32-ef25c78c0246", "comment": "Malware payload", "value": "14e5f7fc65b6480aeab549c602706eaccb5ec588", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808561, "uuid": "9f55fcd6-1d7e-4dbb-ae37-79db74f3e084", "comment": "Malware payload", "value": "814c103f7aca6a12f42d8101d1b7393531c77d287de65a4d189ec8b895300e490d1048feadf998e3a4dd6046d74f58d1", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808561, "uuid": "354ec0cf-86e9-4e5c-9609-63b40fe8c188", "value": "T19A210D26208A4226D877EBC445C73086721F955A24CE2B39D8FD095466300217DDFFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808561, "uuid": "ceb65226-03ea-44bc-ab37-70942bd326e8", "value": "24:O7YTIlXXPlzG7Qj7M1lz8FLfnuwYxFlM2cauMcpOkTlzW3yQe:CV/Z12Z8FLfn2+2ruVTZge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808561, "uuid": "a14e1afb-20ed-4277-a093-5e6bc5f284f5", "value": 1120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808561, "uuid": "582b7148-897b-4dbd-b6e0-21465e9f1c98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808561, "uuid": "fcfdfe23-0114-4267-ba5a-715caa39d125", "value": "Steal_BrowserPassword.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1721ce98-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773651, "uuid": "0b150868-828d-456a-8f21-26b8b015c77f", "comment": "Malware payload (Mirai)", "value": "25148a67d4a633d2ecb4e4b88017e0c6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773651, "uuid": "a6f71e43-3e81-4930-838d-fe68cd8454f2", "comment": "Malware payload (Mirai)", "value": "9b840b89f921d1da241ee67885317188163f68c3c41e1f48c34796f89a96b07a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773651, "uuid": "b0ac8a90-8485-4720-b1ca-6d674fc1c1ff", "comment": "Malware payload (Mirai)", "value": "be09ab65625a1f2fd48969773b77d99c9c61ca6f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773651, "uuid": "b9613e26-46f8-416d-9dfe-4e7fd163ec44", "comment": "Malware payload (Mirai)", "value": "6a3f8e916ca40f9f18520271efd6cc19d96d23e1a1ca6f1e6be31e6c4bb6878c0f8a251aac41bd3d18a57cd635d4e932", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773651, "uuid": "e33c7110-cf61-4c9c-aeb7-a9270b3980e6", "value": "T1D2632907AD8085EDC089E1B802BF7179C066F1BC2775B1CB6BD4FF2B2A15E601F69949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773651, "uuid": "39716aae-ddd4-44ec-ab75-6c24b8e6c75f", "value": "1536:T/u7iGGEUDUmclqukZVyeKDkGM1bPXim1UzvpgxU1O:at1UDUXlqVVUkGMB7qzvUU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773651, "uuid": "f4bb2b9d-af1e-4d52-9ad1-3ad1c04c7a73", "value": 68544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773651, "uuid": "50cbaf56-0665-48f5-83e8-d2d562391a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773651, "uuid": "e188e67d-189f-4a1d-ba0a-b533375b4fa4", "value": "25148a67d4a633d2ecb4e4b88017e0c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a27f516-6633-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808177, "uuid": "f52510dd-3d05-4ac9-9691-ebb1c2798222", "comment": "Malware payload", "value": "c0d8c09ff9858de9ff33eb720414c8b7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808177, "uuid": "23b50184-db4e-44e2-a882-0bf2c34bc301", "comment": "Malware payload", "value": "9e101940dbd206578c80cc81888c2698a36a12f533361de8dde57aaf2307a3b6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808177, "uuid": "58147c37-5d57-4ffa-b80f-c3578c064b78", "comment": "Malware payload", "value": "7a32af88daeb81cb3e1213316a2d9c07937121a5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808177, "uuid": "6d8dcfcb-af07-48ea-8efc-a16fcc999a33", "comment": "Malware payload", "value": "431a1027a7dec600995c798fc5492331087c88e1c4cf37bfa14f0e3a9c80311343aa8f652e188941eb373bfb53ea4204", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808177, "uuid": "bea68c39-4bc5-442d-879a-52f88da4d007", "value": "T1D141094BB502852F80F71351E61298B2C89EA110B7080220FE69C11D798D67E42ED6CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808177, "uuid": "7fffe940-e5a7-4ab1-88f6-48c5c687163c", "value": "48:gm6VvaPCCRkk5EYNDQZWu+sYHmEF6X1wR8CRujMINwYtA94:grabH5EYpiwmqoSRVzI3KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808177, "uuid": "7e417d94-afdd-4040-81a0-8f0071e97a24", "value": 2214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808177, "uuid": "40548742-16f6-457a-8d17-cfbffd743038", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808177, "uuid": "a94d3623-f062-446e-af33-5c7c74f41fea", "value": "downloader.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec1591f-65f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1696779435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779435, "uuid": "0c9b38b9-3ce2-4a9f-bd76-4132efbe4337", "comment": "Malware payload (PovertyStealer)", "value": "a201f27403498536139e57ef617b0f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779435, "uuid": "d6fbd773-f487-467b-891d-4f3f9129a570", "comment": "Malware payload (PovertyStealer)", "value": "9ef083691ebb3375aab30b253a6592673d24c3efdab0363457037b9a54d2caae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779435, "uuid": "62557416-de97-4bf4-84fe-93c8fa0bb919", "comment": "Malware payload (PovertyStealer)", "value": "4cba22ab7e3d9a5cd10355a1f4a81d047df04382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779435, "uuid": "67938832-4638-4a80-ad41-2591d478bdb1", "comment": "Malware payload (PovertyStealer)", "value": "c14b1c2d9066db6522173175d383b7be51e1bc540acb60d76b0d09f29b907b06ed20232e5f33c869df0878dd2d36601f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779435, "uuid": "14e6f1d2-e176-4779-9230-662b94f1c9fa", "value": "T1B8449D01B4D18432C473193209E5EBB59A7DBD610B619BEF67E43FAE8F303C19631666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779435, "uuid": "44fc2304-0f1c-436a-b290-b5eb94b52d82", "value": "f5f86efbd827b8a05e7f7115d12623f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779435, "uuid": "7f6d016a-2305-4c5d-8771-a53346b0f821", "value": "6144:m87rvJO8MKEpAmIQVdGKKmy4AO0mIgLJq2SXS:merhO8MF+m1RI5XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696779435, "uuid": "f4306401-2e21-4613-ac22-12a971e2b442", "value": 258424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696779435, "uuid": "c62df770-a214-4066-bad6-83c85638426b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779435, "uuid": "73ac4dcd-c9a5-474b-904e-eb4b2f12d5c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5bb9cc-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773658, "uuid": "436e6015-985e-4d75-85b2-84b8645bfb69", "comment": "Malware payload (Mirai)", "value": "b51fa81a6fa97c91063e4094fffe8735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773658, "uuid": "cd48a438-c6a1-4273-8d31-5d713cc0bd3a", "comment": "Malware payload (Mirai)", "value": "a057e02759c8a87a3310012cfa5c950a13a8954eeefdc8f5ed148ddfd6369521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773658, "uuid": "18d9bb13-f665-449d-8858-34858a4114d6", "comment": "Malware payload (Mirai)", "value": "ffa1267e82ed5ec8663be0a3ea1b4f638a73b814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773658, "uuid": "a6adaea8-119e-4189-963f-92f212f54641", "comment": "Malware payload (Mirai)", "value": "8d870699426b869d32c6e79b316a283a3955c6eb71aa9e6fe00880009ac691e60760e664222aed93ff4e51e98c1ef2d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773658, "uuid": "e14e86e6-40e5-4945-957d-b879efa1228d", "value": "T1C7534AC8A5C3E5F5EC001D79307AABB1A973F53F2035EE8BE79A25639903603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773658, "uuid": "02510ea2-8181-4ea9-9439-0c3d08302b7c", "value": "1536:V5Vn4pXoqVExGxRP3MFnKiwjGKO18HKaPW+uSUnDJEAG9M:7R4pxuxGxB3MFnKrGHCHK6N+NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773658, "uuid": "bee8bda4-eaa8-4647-9dcb-cdc18647925e", "value": 63696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773658, "uuid": "1b438d70-572b-4779-ab3c-d3c706830082", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773658, "uuid": "8c615dfe-eb66-4df4-8570-9d31eb0fa96a", "value": "b51fa81a6fa97c91063e4094fffe8735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69029f66-6619-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696796981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796981, "uuid": "87bd4588-be31-46de-b350-1947f5af4bc8", "comment": "Malware payload (IRATA)", "value": "d3a88d14ba47f24914ba276e56761414", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796981, "uuid": "16c0bc78-7234-47b6-8021-9607b02388b7", "comment": "Malware payload (IRATA)", "value": "a2eee8aa7f3402efd3a2211897525604e62b3140737afb427316d02c1c960619", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796981, "uuid": "5b72347a-81da-4b9e-ab07-a91307bd3240", "comment": "Malware payload (IRATA)", "value": "ee74b16db142550f494c594cbe4366173c2a39eb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796981, "uuid": "cab25892-dccf-47e9-91ae-02664be3aaba", "comment": "Malware payload (IRATA)", "value": "86a99829697d3fb4dd1ceb28a14544fc2813478aaf8d791e34d246d8f0fef7228cc374c1536a2d30940b52e4bef4f568", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796981, "uuid": "5c7a0048-cd47-402d-97cf-eec973a04899", "value": "T128851243F266A907C831C1323445263A66064E19CD42FB5A395D37FA2BFBDE84FC16E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796981, "uuid": "e0b9e81f-e35f-4625-880a-ce0ea4e108f1", "value": "49152:qs/0kkp7XQouzfAz+A2Lrdfc56guyzpNu8z:r0kkpXOfABsBEYgLNu8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796981, "uuid": "ae85e779-0827-41f1-a39b-e1665b12588f", "value": 1834237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796981, "uuid": "5125b83a-f896-45e7-84f7-46754840ac94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796981, "uuid": "474cc46a-2a63-43d0-9080-55d3d28123bb", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f62a9ca-65a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696748405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696748405, "uuid": "762d579b-7f5a-4194-9949-41523fb65bf0", "comment": "Malware payload (RedLineStealer)", "value": "c5c3fb662740756e54e3d9dba9cb2911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696748405, "uuid": "be8ef2a4-0a07-4527-9c51-1d59191daa49", "comment": "Malware payload (RedLineStealer)", "value": "a3e882db2dd600a2dd0f594b781f68235af8b91c6a5e98ef68a5a959e97ace2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696748405, "uuid": "371eebee-d8a4-44e8-bd4e-aa251c67f510", "comment": "Malware payload (RedLineStealer)", "value": "f5287a8771f0ef2b3370d6f9d85076e329428822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696748405, "uuid": "0e534bb1-000a-45a8-9375-8eec61548a14", "comment": "Malware payload (RedLineStealer)", "value": "0ed0421f06e489b56b44e0f1d07038ddcde0cecd62bb41124ea71b50d90ab1a1875d03b495cf68b5c368d8622ab3b77d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696748405, "uuid": "7fe8202a-4cd7-4070-aaed-d67397008ee0", "value": "T17D352303F2E54437C9B42B7098F206D70B3ABDE46C15829B179B5A9E1CE369564B333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696748405, "uuid": "39993124-b9db-4115-b2d0-07c0655f3c1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696748405, "uuid": "4e7d3840-72c5-43f4-bdd8-ff22ae79b394", "value": "24576:syoVpjJRTQtgh+y8Kkbson/sRsbGdnXgVhYAxVvYwDAw:boP3TQtgh3kbdsRsycOAxC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696748405, "uuid": "43a676b2-be8a-4d0e-b097-9cf41d9d5d25", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696748405, "uuid": "55c43d3b-5dbf-4f2a-9238-cb9f18a42406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696748405, "uuid": "1edde37a-70c3-4345-9971-c2394163989c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f920adf-6586-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696733910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696733910, "uuid": "729e4b3f-2dc4-427a-a333-bc3874ab62bc", "comment": "Malware payload (RedLineStealer)", "value": "b0b7a384e4f2c1a2929ae7fc4b6a82b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696733910, "uuid": "5c60704a-3870-4000-9536-17d688a670d1", "comment": "Malware payload (RedLineStealer)", "value": "a4ade75c3ac6dff3aa5bb1ddc149e98414c8b995512c025c098831c0721450c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696733910, "uuid": "27694a97-f704-417a-a7f4-231cedb83d7d", "comment": "Malware payload (RedLineStealer)", "value": "97ddcc622794802f999b39695f54fd8a6634d3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696733910, "uuid": "3e6fb279-333f-42f7-ae6b-6b7a05c80fb6", "comment": "Malware payload (RedLineStealer)", "value": "c1f2e8fb3446091e9f9a40feafc9d6a6d88212f5248eb9c85ea3a79e288d79413d9bda701ffde24718bbcf0719ff0cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696733910, "uuid": "3b5dffb5-9c13-4568-aacb-b6e9490a8c5e", "value": "T12C652349F7FC14B2C2FD67B092E503C30F38BDA09D6C166B2767995A59B23906132B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696733910, "uuid": "c27982c6-ac82-4eec-856a-29d0f2d1303f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696733910, "uuid": "5e6b775a-ab9f-49fe-ac0a-2ef8426741e9", "value": "24576:lyWgBAzjp4m+sFuO8MM/aAQRaLZ/SPXn2TtqJFmwsuk/W7TORNyjYEERhgXz:A4zdRuO8MM/aAQRiSPmpqHmwsLkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696733910, "uuid": "99025615-dc1d-44c3-b445-9044be7cd44d", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696733910, "uuid": "a8870cb9-cdaa-4b29-bfc2-b57ecbfb97ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696733910, "uuid": "0808a6da-d07a-468a-9877-db0f506a4e49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0669122e-6574-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696725949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696725949, "uuid": "3435a516-8a01-4363-9102-3f78926c2b0b", "comment": "Malware payload (RedLineStealer)", "value": "de95159f954cb304dffce2f2e166e52b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696725949, "uuid": "10f8e6dc-3b4c-4b2d-83bc-a1d8b7b7e002", "comment": "Malware payload (RedLineStealer)", "value": "a4e165fe64e7a1532d3cf76c244df3c227811827845647f0eb4ff543f17f681d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696725949, "uuid": "5eacaf60-1be3-41a6-a579-2f49e1e87cb5", "comment": "Malware payload (RedLineStealer)", "value": "0b99ba42fd127d01ea2255d56e3c1ea2dcb70cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696725949, "uuid": "f01a62ce-85b4-4e68-91f6-dbca9093bee2", "comment": "Malware payload (RedLineStealer)", "value": "1b8257c803f378082fa248d86f4811ec5946028ed35066914c6792fef5c7528f49b05815770e9c86e2683e2e4a96d38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696725949, "uuid": "00e1e173-0d7e-44a2-8122-2c9af6e0f7f2", "value": "T1C4652343DEE454B3D9B52B71DEFA02D31C3AFC752C64421B6753A88E1D326A0B874B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696725949, "uuid": "33841780-3e4e-4fab-ba32-a01124d34d52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696725949, "uuid": "6a7d227a-e07f-4bf8-a35f-d47fed930497", "value": "24576:+yS3H4zu4OF83Dk63NvV4Z5rWLmhlvrAMbMixnSGsqW7Gy40TIXoQwtudmFBu:NQH74RT5vV4mLqfbBS9UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696725949, "uuid": "021d7a9f-d0f1-4bed-8ee3-def248349909", "value": 1544704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696725949, "uuid": "eb0bdb4d-fee7-4649-84b4-38ff7d8c1c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696725949, "uuid": "5e17f59e-bf55-46cc-8407-519410097a1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6610c901-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808573, "uuid": "2fab81ca-949f-4631-8f9e-ab25465b0aaa", "comment": "Malware payload", "value": "57252ba067d81cfbe899c0605515e889", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808573, "uuid": "22849d70-2105-4104-ba0d-bbe8c02c6faf", "comment": "Malware payload", "value": "a4f643930f7dea2b36b3dcdf3bf572009e3d3f80eb413f7b554f1c0fc1454e2e", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808573, "uuid": "515856d7-ce78-4722-8ff1-fa0bb7d01643", "comment": "Malware payload", "value": "65ca8ef93d31f3a2a7c6274a890206f15ea155b0", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808573, "uuid": "127861e4-be15-42be-877a-44e3ac6ee95c", "comment": "Malware payload", "value": "3e5db1ac0bb842eb9aa540df6d7b9b10ad997e50ccb4b5f817b77ddd1f203a358c1321424a85a8d4b6015f08c232d1dd", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808573, "uuid": "e6b3be90-695a-4d05-a62c-22dd0abd243b", "value": "T19561F1267DCC62388BA3D2D486D5E105F4A4411B5FCF2651B3EF24488B24514FAEEF6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808573, "uuid": "c744196d-baa2-4851-a810-cbed2b50215f", "value": "48:b1/5LaK1pgUkIpgUk2q1pgDsGKSvDBsGKKb1pds1pX11pX4+FzDaayx1Gt6tZHFj:bll3vqUsdS1sd6xsxNRyx1GEzHFth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808573, "uuid": "bd4d96fa-39be-4bfb-970c-7fd8e0d349c6", "value": 3302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808573, "uuid": "63aa4bcd-4172-4438-8f04-d694909327f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808573, "uuid": "fd4016cb-5948-46b4-ae49-57694414b5d8", "value": "browserData.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fde5a24-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773666, "uuid": "89ece842-8c57-4817-bf68-bd0ac8a14809", "comment": "Malware payload (Mirai)", "value": "7ab8f242e463616fb5d55584c0859fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773666, "uuid": "5e38c20b-4383-4d0c-8a5a-6215aca28ece", "comment": "Malware payload (Mirai)", "value": "a53c98cb1084db2effd3c917ab76e6d40de8bfac0348c3bc23939bc8bee27c3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773666, "uuid": "c3522ded-d36c-4a55-b450-e1102c030289", "comment": "Malware payload (Mirai)", "value": "b6033153b7dc94a442ea2f659a17b2c21fdf89c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773666, "uuid": "e79f4c60-0d73-4b20-868a-46a9aab82aba", "comment": "Malware payload (Mirai)", "value": "d4e2fad1f55d09304bb1d4a225afc8138b4f4ad00716045f5d8ea4331854adefc032776fa312c87adda7a04baeb0b117", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773666, "uuid": "68fa0ce0-d0e3-45b1-944e-c4371729f02b", "value": "T19DE34C86FA408B13C5C61B76EAAF42493312DB55E3DB73068D185FF43F86A5E4E22606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773666, "uuid": "09d56150-7381-4e43-a57e-483083126eaf", "value": "3072:FYbSBhRoVvDsalYqNI3I4oZuyXvj8Xr6azWZSM/9K/r:Kb6R+vDs4x4oZuyX78+azZM/9K/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773666, "uuid": "39ed335c-abb5-4964-9582-2cf5bb278838", "value": 144103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773666, "uuid": "edcdddfc-17c2-4572-b90d-9504942781a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773666, "uuid": "7524f238-5a1f-4250-9c47-d41829569c53", "value": "7ab8f242e463616fb5d55584c0859fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0105fea1-65bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (StrelaStealer)", "timestamp": 1696756864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756864, "uuid": "d491d303-81ac-4594-85dd-6c6d5fec0a7c", "comment": "Malware payload (StrelaStealer)", "value": "4f1a3f18ce454beeb5e4963704e71850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756864, "uuid": "2c60918e-807f-4a69-85d2-df62a4f48ab2", "comment": "Malware payload (StrelaStealer)", "value": "a5e88d8ca5b1b3b3ed3bf107256ab57c03fef11df6c45e521e8d11cc6303c3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756864, "uuid": "1460dead-b83f-45c2-95a1-d5373e61f598", "comment": "Malware payload (StrelaStealer)", "value": "7564e2df4f7d5f4cd25f76e457d08479a5c3dc7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756864, "uuid": "68bba880-eaff-499b-90c6-cdd4a7d53379", "comment": "Malware payload (StrelaStealer)", "value": "9d49ee6a71018409cfece1f1a6c392eca6c0a4000b1b6a3fc35216c850aa594cbbaece12c9dbc2070258d822da682e04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756864, "uuid": "f09ce920-0a17-4d88-b4bb-1faaeaa47a20", "value": "T19B547E12A3A1AC21E56A4A329D2DD1A4773EFC91CED9779B33147F2F08710E1D663B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756864, "uuid": "55bfe3bc-eb3e-453b-b67e-f5762fe30278", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756864, "uuid": "a85065d1-13c4-4008-ba5f-e69a89fe4024", "value": "3072:5cSvCG6eEBW+uI/wWkA2fY7VYcgikSGxSrSuf+6SYJaMQqSO/a9:pvf0WhuwWdj0iVkYlSY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696756864, "uuid": "f794fce2-9557-471f-bd34-3af454e20792", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696756864, "uuid": "f6bec1c7-3eba-45f9-8ae0-f8ba2fc0975a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756864, "uuid": "33670336-b21e-4941-b40d-9810cc1e8fb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b209ea-6620-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696800009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800009, "uuid": "ab5f2708-84f4-475e-82e4-3806e5a9659a", "comment": "Malware payload (Stealc)", "value": "fe42d1444fc4a6c0b566f7f8a74fcb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800009, "uuid": "3655c9b5-7f0c-4fe4-82e3-046a63819c83", "comment": "Malware payload (Stealc)", "value": "a754eb655af6114a85fe5d32bc3a42b0038fec86c2d557fef2d3f2f92d68b942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800009, "uuid": "9d3b4611-498e-4e84-9b0b-7643b289a0c0", "comment": "Malware payload (Stealc)", "value": "b4f9b8ee619176cc826d2db5936d35904a81bc3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800009, "uuid": "1c1a7335-7a09-4f08-9aae-ae055b501b93", "comment": "Malware payload (Stealc)", "value": "de1299279180b3628ab3957b7415a1900c1e97820ecab170c87007b09b7a747ff711d9345151cc8f8681100ac474c848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800009, "uuid": "e205519d-389f-4c2c-83ad-a5a37ebea543", "value": "T1B2E6E16CB396684AB672EEC39FD2E9A2C3D79378F3058D36300A539959734F0D91242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800009, "uuid": "447e7723-cc9a-4453-b805-1104ad6df862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800009, "uuid": "c23b5510-32e2-416d-a0f9-37ef5777278a", "value": "196608:HIgCXUXYGU2MYWZ3mpejjiAN8YrOmSIFIuHB+q9LOKd/VT7cRRbYc:ogCkX1SZ3pniIzl7XhZLOKd/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800009, "uuid": "91444bae-df5e-43fc-ae8b-d59cb8639e5a", "value": 14079488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800009, "uuid": "8ff7c982-6d6e-4087-8bd0-a04d9a067930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800009, "uuid": "7907ad2f-9a63-46c8-9dc9-9ae58c679be9", "value": "fe42d1444fc4a6c0b566f7f8a74fcb53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf2f51d-659f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696744480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744480, "uuid": "7a49b3ca-ea45-4b25-abe2-b278a129981a", "comment": "Malware payload (Tofsee)", "value": "6d0675ac2f94ae3d2e981552e8bbc0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744480, "uuid": "5a0d1d82-4b39-4b33-8cfd-a7b6a7d81472", "comment": "Malware payload (Tofsee)", "value": "a79407f883f599612892487dd932daafaa9cb1233bb74681d4bf48971f483949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744480, "uuid": "2a7142b9-ddb2-4e80-af52-b1a4ce6e81ac", "comment": "Malware payload (Tofsee)", "value": "92de2ba894f110ea58df76240f50cf9d2ff9ee1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744480, "uuid": "6ea65117-965d-485c-a79d-1da1ee2869aa", "comment": "Malware payload (Tofsee)", "value": "dd70fa9a7bc68bd048be9cbb1bb4f869a7caba0a0cd1b3e3e879418762e3b97a96ed59e419e7fdb8d164b7f67f9d064e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744480, "uuid": "00d8626e-6bfc-402a-8df8-a54284943929", "value": "T181548E02A3A1AC61E5168B328E2DD6A4373EFDA1DED8779633687F1F04711E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744480, "uuid": "4738d77e-22d4-4345-b5b0-766473b4e4c5", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744480, "uuid": "0dbb754b-924a-4d4a-982c-cbad553a6d3e", "value": "3072:PRgo/+H8lWMXCgsvF3xoF9TSp/iOPZloPinHT8gzWQv6bID/a9:PX2yWpZvRxmBSpZPZ/nH5Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696744480, "uuid": "4ee5a6da-163e-4df5-b67e-2858352d633d", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696744480, "uuid": "c5c8659e-2882-49ee-84fb-23f5c0b5a258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744480, "uuid": "6c400e32-d4a2-467a-97a7-302b440852fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317bac9f-65ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696750502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750502, "uuid": "180bb615-7a33-4f3f-a55f-c3cc5b45d339", "comment": "Malware payload", "value": "f6dcceabb984130f8509bbbb54a0505b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750502, "uuid": "384ff1bc-0190-4204-8dff-f570dfdb595c", "comment": "Malware payload", "value": "a8087a176c0e38813e698c29b074c0b6383e237370e9cca3128fc02a27912733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750502, "uuid": "78370ad1-dff4-4f76-8b11-62e380bcd789", "comment": "Malware payload", "value": "e6cb5bdd02e116120da9c3b1decf908d49daecd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750502, "uuid": "10f80a52-a9d6-4d04-87d5-e61bd5db9a66", "comment": "Malware payload", "value": "f5b38ec06489947e90bcce53c866d331119d0c4bbd7cc6097bdb3a5a95f9831c44336703bd2c7f99afacd53405b0e4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750502, "uuid": "ccbc1092-cb78-4e89-839e-cf16601d4e70", "value": "T100546C5417DC8A7FFE5DB2B9C098584DB7A6C5951A8FF78A9AA12CFB2D23381C403053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750502, "uuid": "11db245f-0c5d-42a8-b1b7-2d9ac1d43d37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750502, "uuid": "336d52aa-214f-47aa-a5a3-5c6df2b7d953", "value": "6144:dh1jK06gWBkd4D/jgY5h6jh2GwfRMwL/VJQVTgnQh+xOBryq87vHi:drKlrBkCDjl6l2GRwLfQ9Qy+xMsHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696750502, "uuid": "fc3747a0-6af2-46bb-9da7-d14490628cb8", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696750502, "uuid": "0b41f816-a4ef-426a-a1d6-3826fda041c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750502, "uuid": "c0f76afe-e4ea-4d61-835f-f76a7d90f331", "value": "deliver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edf41c0-6621-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696800427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800427, "uuid": "07ecad22-3b17-4eb7-b8e9-66796879f6bc", "comment": "Malware payload (IRATA)", "value": "d7e7f68357ce42a943db9a6548de4257", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800427, "uuid": "b785573c-1c34-4db7-97c1-b0687c052800", "comment": "Malware payload (IRATA)", "value": "a93f02b8dba9167f9950ae3487a91fa09339ac2de12539723b30b0ff3b4f1a3c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800427, "uuid": "360bbc2c-7679-4c0b-bd92-8104243cf1ab", "comment": "Malware payload (IRATA)", "value": "eb2fd204f1a5f79cc45eab41c38678e8c7570fb9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800427, "uuid": "6ef5c333-8a9a-4402-8f19-424e6a276474", "comment": "Malware payload (IRATA)", "value": "e04fe8602e9982208f250ad132a63bfb988e6f7f22f6c27e11ef2c71bd0777368827bb6539b02034d4c2e75dc9dabd94", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800427, "uuid": "07f910fb-c5bd-4fb4-b946-ec54b8787eef", "value": "T195F5ADD7F395686BC4F39372817613A5515B0C228F83AFC76D28763C28BB9C41E59AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800427, "uuid": "0d3493bb-d071-46bb-8893-6d32a12fd2a9", "value": "49152:IL3na9BRaOLUgjFgLCrg4mvSoKvZDGkUq+yTs2APh1Q9x:IL3nCzgLCrg46SoI2yToPh1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800427, "uuid": "ba38a979-27e1-4d22-95e9-bff11e4c1dcf", "value": 3501071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800427, "uuid": "b3576a03-f703-492a-8604-8c5b251b7b41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800427, "uuid": "e0775f7e-235e-4754-abc2-f88742b0787e", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8c28a1-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773638, "uuid": "3af6be78-8f7a-4121-a735-e46de9d92121", "comment": "Malware payload (Mirai)", "value": "8321fbb0e3b978096b7036b64723bae1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773638, "uuid": "fcc0266a-c9cd-4f7c-a038-b598bde9080d", "comment": "Malware payload (Mirai)", "value": "a9cc08105d31a274c783583a4b5e4a8d8356f1a0c45d0cffbc87b5664a740da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773638, "uuid": "5bcaaf77-2360-43eb-aa07-e98d20c5dad9", "comment": "Malware payload (Mirai)", "value": "86d8ded21cc56a5e38c5723f32c4593fe9b7849d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773638, "uuid": "426c7b0c-a20b-44b9-b832-6971342673b5", "comment": "Malware payload (Mirai)", "value": "2eb097cc29b8495b12186abf4882798d6079dc4f8fd0a2cd19d07ce992c8ea8eb948ad0c1c44d2e9c93ea956dde69631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773638, "uuid": "63abda86-55c4-4cc0-b320-93465bef10d7", "value": "T1E893504E6E714F7DFFAD823897B79E209309339616A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773638, "uuid": "684cd649-09fd-441e-b4a1-6da46714f388", "value": "1536:/UNyqwipEXzKt4kKSdkVz+lW8QYExjSk7IB68wqXgshfpQEHlJ:cmkKSdG+lW8QYExjLMvwqXgshfprHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773638, "uuid": "038c6eed-3023-426a-a45e-a860822b5f16", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773638, "uuid": "41db6a80-1d61-4fa2-9829-8d61474851d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773638, "uuid": "86f5044a-e2e4-4508-be42-378ec7d9f23e", "value": "8321fbb0e3b978096b7036b64723bae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de06602-6627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696803029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803029, "uuid": "97c381b5-07eb-4b21-b903-8262dc48d2e6", "comment": "Malware payload (Mirai)", "value": "3c24369a6dcb228463c65bc1e31c02b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803029, "uuid": "6e4dad2e-c71b-494e-90e4-0563ff1a1372", "comment": "Malware payload (Mirai)", "value": "aa687a209e1ffb256775b8cf3c28ec3b189c4fe276c197f3388a1653bac41b1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803029, "uuid": "9adb236b-5082-4ad5-b875-dad56e816a9b", "comment": "Malware payload (Mirai)", "value": "74285598cdc9fd35b727b299e47e290d2fa357b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803029, "uuid": "26bbcaaf-d5a7-4220-aae3-a77fdf961057", "comment": "Malware payload (Mirai)", "value": "590cb5afb702cd11087c0b66337cf0624e36e22240794d8d81cdf2d593ffe975c3638d28bea1ab24f3c53ead1f7f3217", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803029, "uuid": "047ed371-bcbf-4ae9-8347-1f7761a18f76", "value": "T1C9431645BC918A12C5E062B7FB5E818C332523B8D2EF7307ED212F55779A81F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803029, "uuid": "b043648e-a4a6-4b3e-9941-a5685e37ba4d", "value": "768:m85PX6ueAQR+XGbEpd3Y6A/ZqVHkPgtKfoaS2oOd1BbJHPvt5CkcsfpbNyXy0JKi:LPKuBd3YtEVHk/1BbJvvt5rcZXDJvDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696803029, "uuid": "cfe2158b-2b86-4a4b-965f-f3337e73a832", "value": 57000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696803029, "uuid": "b9cc3ef1-7983-4264-a16c-a53b2c8f6d91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803029, "uuid": "f486c67f-f983-4fb2-a6cd-ca637c91042a", "value": "3c24369a6dcb228463c65bc1e31c02b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9982f9b4-658b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696736074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736074, "uuid": "f078492d-8da8-44a1-9ad7-c0014b69f9aa", "comment": "Malware payload (MysticStealer)", "value": "08af1f1118760f98b5664fcc5c8a37aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736074, "uuid": "df411c33-5b0d-4d74-ba71-26e9efb13459", "comment": "Malware payload (MysticStealer)", "value": "adad848bf6d7a20eb9faef8413be0071b82fc7b237c867e15e05e7d5600d23ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736074, "uuid": "6c3443dc-9798-4c34-be13-fed610d01a0c", "comment": "Malware payload (MysticStealer)", "value": "de58d242c88a2f4137175709149915bd35233d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736074, "uuid": "9447c3cd-8659-4a31-b5b8-95c20298c28c", "comment": "Malware payload (MysticStealer)", "value": "40798be6564b4c17bd2dee189fe9983d21df8715e405c20b725114c57fb22ea39928e4542c252654a81fb5a06a6cd6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736074, "uuid": "5a06247b-7f9c-4b8a-97d3-41e5ce4a46c7", "value": "T157652347EBD94572C5F01FB018BA43C39B367A60A960E38E37C78D8A49237D4613677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736074, "uuid": "d43cc87a-5560-4479-84f2-32599c21b2c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736074, "uuid": "84a7cae1-9442-473c-8e97-45e625c19c23", "value": "24576:oyM/jPkItGiV2GEIWG5JsSSIFLW204aC2wAm0u:vKPPtzV2ZXGBLW/90A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696736074, "uuid": "86a1a86f-c694-4674-8a3f-4b04486fb0bf", "value": 1540096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696736074, "uuid": "9d0007b4-6861-4af9-80aa-744af921f85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736074, "uuid": "20038723-e795-4b6f-b575-e2e8448d567d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f51e08-661d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696798806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798806, "uuid": "e93c1509-ecf1-472a-8363-8c2e6bf482d6", "comment": "Malware payload (Mirai)", "value": "c985943e58be92aff1269118ab83f51c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798806, "uuid": "adac8805-7849-4f01-a7a6-454df3b18319", "comment": "Malware payload (Mirai)", "value": "ae665ea19292989900ced498bdc73e1497c33093ef076f38278f7565b0e429ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798806, "uuid": "3fdff3ad-b223-40fe-b685-5792f4fc8e4f", "comment": "Malware payload (Mirai)", "value": "42cb5881435d945636e447d3de46fa856ca77a68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798806, "uuid": "46a9b9b9-3194-4c81-a3a4-1f6b4a43b24f", "comment": "Malware payload (Mirai)", "value": "957fe329d38b8699fa9400e245467d2949615a47c6669631df083fc49e93bd7ace3c2e6a71b3c8c16f85ac2563ee3aba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798806, "uuid": "d824112e-bf02-4118-a5bc-5e09d3ee5d31", "value": "T1E0333AC59683D8F9EC1655713173FB338A76E53F1159EA87D399EA32BC82901E20728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798806, "uuid": "46b4ad45-8e4a-4ae1-8e76-3551c10bfe25", "value": "1536:Xklva7r4N7sBDTlOBh7vNJ88qZGSsvBeR:XkFgr4NgtWh7vNJ1eGvv0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798806, "uuid": "163ffe3b-63ec-4e8f-b766-c4575ef531f6", "value": 51228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798806, "uuid": "ac404b89-c5a2-411b-b318-184737560d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798806, "uuid": "fb54002b-2cfe-4cf9-82b2-2b547ced533d", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a15a76-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1696753949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753949, "uuid": "9b576a4a-9703-43c7-b3b3-aab24e07df4f", "comment": "Malware payload (njrat)", "value": "d85e69803221016200d9c029d390554f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753949, "uuid": "c12fde0e-7d2f-4ba5-982b-036a886a4611", "comment": "Malware payload (njrat)", "value": "b02c3cc8be9da55c745c60521c8dc3d2c0a1494cfc8127b6785b58496a779383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753949, "uuid": "764ef928-b9ba-4414-bd8a-909af2bf5682", "comment": "Malware payload (njrat)", "value": "1353f0125de814a9ab073f43ee113548f7b09bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753949, "uuid": "d3f70e59-abb0-46e5-9e40-8a24da4471bf", "comment": "Malware payload (njrat)", "value": "3064025517f9f686a7e006735224113756d5a21af7ddadb5f00f9be4fa2dee504955cb1f187a324c1ccb252ed8f0f46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753949, "uuid": "0bb6f129-d46b-45ca-bdad-b7d58a80bbbe", "value": "T13E033B4D7FE181A8D5FD057B06B2D41207BAE00B6E23D90E8FE564AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753949, "uuid": "631eea6e-87a2-4530-b3cc-6f4ca6103515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753949, "uuid": "22bb8433-f2bb-4990-b80b-5d1876313852", "value": "384:KcnM6ikLRxdDsyNyyszHQxvDe8mkzWrAF+rMRTyN/0L+EcoinblneHQM3epzXFAI:VnbeyNBszHQxC1kirM+rMRa8NukYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753949, "uuid": "93d30829-4220-4a99-a8f4-efb268617aab", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753949, "uuid": "3c32307b-59ae-4eb3-92b1-0543e4b49da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753949, "uuid": "dfcbec53-c405-4cda-a0e5-501ac4bea5f4", "value": "b02c3cc8be9da55c745c60521c8dc3d2c0a1494cfc8127b6785b58496a779383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5c4fc9-660c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696791541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791541, "uuid": "f9f93e0f-9a80-4945-b4e3-5b30fe93e569", "comment": "Malware payload (IRATA)", "value": "4f72a718bb1cedf71a296c39ba90e6b6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791541, "uuid": "7195a776-55b5-4e85-9693-4a001f83ea18", "comment": "Malware payload (IRATA)", "value": "b0b2c57915b37687bad9a7848fb142080364d125f6ca2ab803510e26b5a303ae", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791541, "uuid": "6a464c86-28c6-4b42-8787-d9f1d21a97d6", "comment": "Malware payload (IRATA)", "value": "d94c6274a95a187ea581d5daeec0ccfdf55034cd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696791541, "uuid": "3e3619b9-d355-4913-95fc-dec0ef61b9b1", "comment": "Malware payload (IRATA)", "value": "7dbbe7b0395c2c1a584c2353ccf2cb763d2a8822b0dbc4fcc51cca29651cd616d7f84ba5d2f2615309472d1679dbade7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791541, "uuid": "73c251cc-6ecf-4361-a60f-e241d17fd126", "value": "T174851243F665BA17CC32D13231412B36521A5D19C942F78A394D37FA6BB7EE84F842E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791541, "uuid": "17aff38c-6aa2-42e8-8199-71405d109fbd", "value": "49152:6s/ikkp7XQoyynd1KCUgB6c8WIRCNpksmako+mEGAV55anq:7ikkpXfnd1kij2Eksmh0cjanq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696791541, "uuid": "19cae0eb-d4b1-428e-a2ac-7d3654322e17", "value": 1866998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696791541, "uuid": "ab570cb0-6afa-43a7-9d34-81a77505cbf4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696791541, "uuid": "fd861c0c-f954-4683-8c5a-0029986d05b8", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e08f41-6621-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696800310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800310, "uuid": "ba533a50-be79-4ef9-b6e5-2f348043d8ac", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "39888d8c3490d982398d136e9e0a4581", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800310, "uuid": "cbebd614-2dfa-4b5c-9660-160265d04e58", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b115ad95814af3c46b71fd230d3b2a224c8a8f356b27e0367b0f98d4948b2b60", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800310, "uuid": "824c510c-9c79-400f-b734-e55b2eb1d3a1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "737a7f7e308cb3a2152f296cc3a7d44d14a675d7", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696800310, "uuid": "e8df3bca-faeb-444f-824a-c96cc0f103f2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3f8f6ffbeb669cba04ea1f12a8027928bb8998334680f0671fe036a8d16672bc0b7b06f44fb43f35b8635e2c75ecc982", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800310, "uuid": "c24b8ce5-ddb1-4a2c-b1b2-7507d9c3a241", "value": "T1B7E6E16CB396684AB672EEC39FD2E9A2C3D79378F3058D36300A539959734F0D91242D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800310, "uuid": "f45a05e4-4c79-4498-aedf-95cc152d9bd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800310, "uuid": "3ee61a15-dd0a-4caa-b75f-27f8ab80217e", "value": "196608:JOmSIaIgCXUXYGU2MYWZ3mpejjiAN8Y/IuHB+q9LOKd/VT7cRRbYc:Jl7JgCkX1SZ3pniI9hZLOKd/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696800310, "uuid": "8c4da410-bea3-4b20-9a42-401838b514dc", "value": 14080512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696800310, "uuid": "8be17545-c993-4d78-b32a-8f44de9dbf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696800310, "uuid": "2890f2c2-3664-4668-8af3-a677746b256f", "value": "39888d8c3490d982398d136e9e0a4581.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5609ca-65d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696768263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768263, "uuid": "c469714f-2bed-4986-b77e-11c7d7950274", "comment": "Malware payload (RedLineStealer)", "value": "9cad4182d25b774ed3d69305a84f0d14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768263, "uuid": "7aae41d9-6a83-4b45-99eb-777c007fadc0", "comment": "Malware payload (RedLineStealer)", "value": "b15e8f35b848a0cb272a4d480235baec025dab7887409c0551ba810e3a15f7fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768263, "uuid": "6bf75c5d-5f85-42ea-9dfa-6d0ff18186fd", "comment": "Malware payload (RedLineStealer)", "value": "4cffee5301b04894df53c50b54684e24619d7dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696768263, "uuid": "51e9c2eb-08f5-4043-a3e6-766a3ce2e206", "comment": "Malware payload (RedLineStealer)", "value": "02b107485bcea271ebca28666a4d651f542ee64c52a98c4b35acb762a97ed3514a8e9bd7b17da4f46f43a3a698d86f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768263, "uuid": "ec7a6ea1-55c3-47fb-b218-cde476902d57", "value": "T156945B104CFFBFA1F2A9D4F34EBAB3D26CA524351B14D6F60A6512305162D684F6BC2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768263, "uuid": "1efef721-267f-49ff-9c51-b1efdb6da08d", "value": "cc85afa907c18d45be6a9d16f3a8941b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768263, "uuid": "6b289f7c-7f45-44fa-8890-94a04787955f", "value": "6144:hJoZaCmR6LXtdAg0BtU6DMHtJ5j/X/c0oa337gADC:hCm6mDMFf/E7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696768263, "uuid": "311baa99-e962-40de-b8c2-b38e3feb00b7", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696768263, "uuid": "b30f2329-2c9d-4e0e-8463-cbb1f39d0303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696768263, "uuid": "7e263ed3-08f1-4544-a31e-103fd48f3371", "value": "SecuriteInfo.com.Win32.Trojan.PSE.21EV88.16745.19460", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c484a31e-658d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696737005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737005, "uuid": "0952e4dd-ad72-4d03-a738-f0809e989544", "comment": "Malware payload (Mirai)", "value": "809581542a34acce61c1c8560be81cda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737005, "uuid": "12fad415-5d99-4924-bcc3-190bcf128404", "comment": "Malware payload (Mirai)", "value": "b2023db89fe219f3fc0ba8ae0abc51737d86d11c9c147447c01a41fd33dbff2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737005, "uuid": "4084151c-f3bd-493d-800e-0992eff385f1", "comment": "Malware payload (Mirai)", "value": "089487423b3e6e96a16bc4da41ea9bc02439f98f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737005, "uuid": "c0e2697f-8ee7-4e08-a52c-7fa47552592e", "comment": "Malware payload (Mirai)", "value": "06d10c67ba8edd7d450bd4c3919f6f793af0c8e59fd779132118428cb00eccfe183cdd4292720819720f8b84b8f75503", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737005, "uuid": "d153e938-7973-45da-a79f-bcbec23fa256", "value": "T1A2936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737005, "uuid": "080dd3ea-bfe5-4d91-aaf0-54371613d2fa", "value": "1536:xpmWc2AcighsZ82fJxfcQHH1mSsM8y6Q+gBQ9TnkISGtAdh0xZ:xpmX2riED2frf3HVmL1Q1Q9kVTh0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696737005, "uuid": "19a1e0af-98d8-4dce-bf07-c75f58be65e8", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696737005, "uuid": "265566b5-dee6-403d-9f0b-4fcb66b2fc79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737005, "uuid": "5e30df51-6df7-4633-9875-ba0adab6367f", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6a882-65fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696785176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785176, "uuid": "d8e3555b-73f6-4873-b360-3eae1c94efbd", "comment": "Malware payload (Mirai)", "value": "e2a36486c0b815cca2f531646bfcee7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785176, "uuid": "c72fdf64-816f-44f4-8ed0-400384ea6731", "comment": "Malware payload (Mirai)", "value": "b4b05e3a33dcb4b421c96051a06fb0be638c8f16e5dce7c45842175d1d52d713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785176, "uuid": "290b17d8-391d-404f-8eb9-ad6ce312e31a", "comment": "Malware payload (Mirai)", "value": "32bd46b42c373088a6b8cafc694de8113a9dec46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696785176, "uuid": "6e9bd875-17a9-4593-8170-c5bf26550d8b", "comment": "Malware payload (Mirai)", "value": "aa28d5df336904e3910a5661677f3ae339443c280cd5fe56f0d7552e75aa4cc975d1c4268b49c83fe5dc0d66bb58675b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785176, "uuid": "047668a3-4593-4a20-909a-a992a5f05f17", "value": "T12AF33AC7F800DEBAF80AE33748130916B130B7D115825B376297797BED3A1D92967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785176, "uuid": "063c3557-c0c9-448e-b8a8-b2b363ec9a43", "value": "3072:LEItcJkN7tPcFRTY31EPRFwdf1pWZG3ZSjXg3IlVrjbi7LJq0L7yppdDiXO:L7cEq4QZGpSU3IcLJq2yp7O+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696785176, "uuid": "d14da5d5-56cb-449a-8aec-123a89106e42", "value": 161952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696785176, "uuid": "693e8b68-d4ee-4887-952a-3506c3028041", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696785176, "uuid": "5a9981c6-474c-4179-9304-34b16bfc1014", "value": "e2a36486c0b815cca2f531646bfcee7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7dd43c-6605-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696788562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788562, "uuid": "fa1843ad-8ec3-47bc-9736-82fa56b86704", "comment": "Malware payload", "value": "4cd4786a3b615b2c884865ce1db051c4", "object_relation": "md5", "Tag": [ { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788562, "uuid": "8978050d-1639-4610-82aa-d61dd0f385b1", "comment": "Malware payload", "value": "b6abf8a3d5e865b0968637b92642fbaaf328dad7f7e750284c95c68600e293bf", "object_relation": "sha256", "Tag": [ { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788562, "uuid": "ac5635e9-a278-4b59-97cf-bdcaad6cae60", "comment": "Malware payload", "value": "0fb49e1aa32c0bf257425724886a7760c79f763e", "object_relation": "sha1", "Tag": [ { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696788562, "uuid": "f84b64ee-5875-4fd0-addb-07ae4b845b49", "comment": "Malware payload", "value": "6ceaf7def990241398abdf0ecc8e70c70ae3212b003e66a69d783475b9a01fe8d5140b052a776d82d0325cc07c1e4d52", "object_relation": "sha3-384", "Tag": [ { "name": "pw-123456", "colour": "#E2C0E8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788562, "uuid": "62cd9ee8-6377-4521-9613-b773b6134884", "value": "T1E8083339FC07D9015EDDF88FEC04DA0A501988C5A9EF5AFFAE4886420F90F56A981DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788562, "uuid": "391de447-8076-4b34-9c89-312aaeefade1", "value": "1572864:y87OYjPb/eWnmtmDpqKdUbxAzOohf+g9WpoX5j4R5bsWtF4fgabM:y87OM/eeDpnSbx2Odg9CoXt4RD4fgaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696788562, "uuid": "fd128e71-8b73-4df5-97eb-601aa6b390bc", "value": 78974445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696788562, "uuid": "ff4c90fa-b733-4f19-9ce1-33e81154ded3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696788562, "uuid": "5bf16c2f-e534-4ec9-b03f-1246d13e3748", "value": "Reservation information (date, name and etc) (1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66c40ed-6607-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696789434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696789434, "uuid": "63ea3fef-19ba-4a9d-b399-6249cda76f22", "comment": "Malware payload (RedLineStealer)", "value": "0c93f1ade7321b02ece62fc15df8c703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696789434, "uuid": "caef02ae-9bd9-4483-b1c0-1fc9783ab55e", "comment": "Malware payload (RedLineStealer)", "value": "b98c3411958080b61695a145dea91b8572e6bf61aa9cb40bfc382986df089071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696789434, "uuid": "25810d7c-126b-4c71-8a28-fed3f8b11efa", "comment": "Malware payload (RedLineStealer)", "value": "910d44b0e2fcd9afcf02918dac1f6e9a2e3d9137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696789434, "uuid": "4b2b6b6a-cfcc-4b42-a55e-9c12a73bb6e7", "comment": "Malware payload (RedLineStealer)", "value": "f2d1e7e2495cbe504a2c3fca997a1c0a33afd8658db361e59539296ab9f6455aae54d36f635307aeede6125430f44062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696789434, "uuid": "76b56e1a-c457-4265-b9e0-b301acde72c4", "value": "T190452393A7D6E852CDB467B04EFA46C71A727EA14DB4D72B2289654C0C33A44BC3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696789434, "uuid": "570a50f2-5b58-4c95-9e5d-a64e3e8bd9ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696789434, "uuid": "5cf8f1df-024a-4e0b-8dfc-7a66b11d38e7", "value": "24576:OyjjI0I5PoHsD0NPlDTtYa+UvqeCMuotPjNZk2Av+Jy:dxI52sD0NPlDTtZxrCYtr/7Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696789434, "uuid": "7f94ec15-0d8c-4aa5-8875-319a1f9601d4", "value": 1188864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696789434, "uuid": "ee779ef3-fa79-417c-a4ea-f2780211f02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696789434, "uuid": "9477d1bb-e21c-4f69-99e7-2a56b2e80cbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9222693-65e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696776607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776607, "uuid": "4f0ee9ef-016d-4dbe-aaf5-a561f6ac0052", "comment": "Malware payload (DCRat)", "value": "429943cfb42511a2f5931774e21060a0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776607, "uuid": "1f8b7887-b761-4bc5-b794-9c8f51135411", "comment": "Malware payload (DCRat)", "value": "bd5b96ee1c0e001cbec2c1fdcce33aea7f0ca8359c7dbc701d34dabe81a2044f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776607, "uuid": "0208eb91-0998-4081-bf44-f5ccb25325a4", "comment": "Malware payload (DCRat)", "value": "9a0e05e9da6d85e1f293bbdd5d5801b22ee15c21", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776607, "uuid": "c335cb6f-803a-44e5-821f-3b631e7e5f9c", "comment": "Malware payload (DCRat)", "value": "fa4f96f39bcc842c59e32b0650c6f09acc3ef0ad83d70d7c5933331233b4bcc7a25dc1bf7e6186b79155a63de92b2054", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776607, "uuid": "2463f653-10d5-4cc0-9f60-f06f2c6bb28c", "value": "T15D455B01BE44CA11F0991A33D3EF46444BB4AC512EA6E71B7EB9376D56123937C2CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776607, "uuid": "b70912bc-6dbe-4246-b1eb-674d9821ed31", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776607, "uuid": "39700016-4702-4579-8bd1-511e03e3cc56", "value": "24576:u2G/nvxW3WieCMzRGI8+3pr2bZCfwUkZP7Hkz:ubA3jHWije", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696776607, "uuid": "b66f150e-1e84-4348-83e1-6d8eb1509988", "value": 1254524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696776607, "uuid": "aa258b12-a582-40ba-a2ed-e85638d9dea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776607, "uuid": "37a95b3d-01c3-4f12-80a1-49b58277c26b", "value": "429943CFB42511A2F5931774E21060A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631456a9-658d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696736842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736842, "uuid": "284b1a15-272a-41c9-90a3-0fdb48b13b5f", "comment": "Malware payload (Mirai)", "value": "8f5c93c8b82e5c23b48f590153dd8dac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736842, "uuid": "56a798f9-34fb-4494-b8ce-0f758b4d7ffe", "comment": "Malware payload (Mirai)", "value": "bf6e7231f70ec8670d764dcb44edc25476898f7b9d946f97c38331bcbc7ce4b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736842, "uuid": "98c3ec12-e5f3-4443-8fed-629c3703e55f", "comment": "Malware payload (Mirai)", "value": "3d98ace929d5f5f24808d7b4cb2318e6e95cef77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736842, "uuid": "65d7bca3-af63-46a4-870c-4ca739280238", "comment": "Malware payload (Mirai)", "value": "fdf2afcac29d376b26d39add0f1a36a87a5a487e89bc78ab6532e025008dfc94db66ba7c1522258fb54ce74dfa5e56c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736842, "uuid": "821431c0-8750-4d5a-966a-62d17880726a", "value": "T107042A46EA404B13C0D627B5FADF42453333ABA497EB73069528ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736842, "uuid": "62b3faf4-8754-41cd-8be4-59d56bcfe063", "value": "3072:wf/Ql2BbBLHcBCkAabwdyqkkUbH/6EBpMS/hJjogM/RqyfqQ:wf/VBLHElAabwdybkQ1BiS/XMgM/RqyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696736842, "uuid": "0fb85864-b058-4225-b4ba-0314968068c6", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696736842, "uuid": "50fb3779-466c-4c4b-969f-5f80f52d2838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736842, "uuid": "fb59b50b-0599-46f9-98e6-f5cab5eedcbc", "value": "8f5c93c8b82e5c23b48f590153dd8dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e77e8f5-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773717, "uuid": "04c76465-beb8-448f-a2c4-5923ed6bdf34", "comment": "Malware payload (Mirai)", "value": "091182a64b66434dae7ed41594bdfe60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773717, "uuid": "f6b6bddb-758f-4826-a6b6-db6da560d948", "comment": "Malware payload (Mirai)", "value": "bfc9c5ad6a3f8c3e9b373a4e6fa22e08ab4d2caf17609769f7053297bd3e93f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773717, "uuid": "137060ab-4c56-4a48-94a5-98ab87d162e4", "comment": "Malware payload (Mirai)", "value": "7ccbf38c59acc0e26c52e9c4256f88dd7ade493a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773717, "uuid": "65a64a5e-0f02-4020-b670-767144747c99", "comment": "Malware payload (Mirai)", "value": "1a790a6fb414ccffb1c74b862c97580d57704409aafba7c6f3acb155f8f54f21eda0ccfd73f0d982951306cec3a61245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773717, "uuid": "68b9dd8e-adce-41a0-ab38-8acda5e17c8e", "value": "T187537C66D4B85D60D49849B0761CCDB44B93A904AA933FF1C683CF694407BECF509BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773717, "uuid": "55355467-31b9-456b-8fca-8f93cd88e51b", "value": "768:6/BAQypMIaeXB+qSwBwFm1UHzF8vIkDiPV44g5N2tS7STtEL5QTSv0QD6in3kU9L:6/2HmIaeoi+BQjESOA8YU6/WlYCU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773717, "uuid": "ab4b0318-c6f0-41d2-8ea8-a629df7fae61", "value": 63860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773717, "uuid": "d4b02420-092d-48e1-99ec-80895d53dc23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773717, "uuid": "9e4b516d-bd49-495a-9551-3cc76ff3c140", "value": "091182a64b66434dae7ed41594bdfe60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0573a3b7-6577-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696727236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727236, "uuid": "22ca847a-3128-41af-8405-3ac7a9ee77b8", "comment": "Malware payload (Smoke Loader)", "value": "3c29699ff426a7720ac14ee6770d21fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727236, "uuid": "a8a0fb40-913d-4b91-9b82-e495a324f808", "comment": "Malware payload (Smoke Loader)", "value": "c19d2477f7198a11bd56e4a8ab32e0041bb6999e544a0427ebc8e1b2a5b9c0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727236, "uuid": "a81a336a-5280-4e81-8bbf-2684a8045a22", "comment": "Malware payload (Smoke Loader)", "value": "31fd5805150ef508ed0aaf2f6c1ff2ba7b4fe8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696727236, "uuid": "8732e0d2-4c3c-4ad9-ab3a-0736a8a4d610", "comment": "Malware payload (Smoke Loader)", "value": "fa0aa20bf5ec85df1bea05cde334b064f0dfd1b041344b01ac1512b569806e763c55289cc7f9665a508d6c4998dce27f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727236, "uuid": "f62a7bb2-c056-41f9-8a20-f05b6150a540", "value": "T18B65235AF6E45833C8353B7069F90EC70F39BD219C58463E29475C9989F1688AD32B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727236, "uuid": "fddab3b4-3947-4707-b938-d5d6409f5f6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727236, "uuid": "46e5e3f2-d4dc-4a7b-88e7-35d4fce924cc", "value": "24576:KyP5Jfu0ILp9RJYz4uGOtyd4rqUSFHDAocuMNOYlH71kT5jNT02fP+ZI:RB05Qz/btyaqUSFHDAUzH5S2fPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696727236, "uuid": "6ef7a40e-4ed8-456b-be83-2e1fcf89d915", "value": 1542656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696727236, "uuid": "b404563a-d138-4c1e-a0f3-65ce0dae098c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696727236, "uuid": "688b550c-3fd4-48d1-9487-8148f410659b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f142606d-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753831, "uuid": "77fac7ca-26cd-43be-8c92-2ed705b88b83", "comment": "Malware payload (Mirai)", "value": "7c2fdde4f3b8826205ee63abebabd6c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753831, "uuid": "ea4ee5e0-5af9-43f0-b38e-1b0fa6e0d582", "comment": "Malware payload (Mirai)", "value": "c375b09f8826a327a40e299081a99c86fd6928000cf4f10360084125398e3c93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753831, "uuid": "9ef89fcf-c78b-4a6e-a471-3ac623790f8c", "comment": "Malware payload (Mirai)", "value": "6da6c4f35f88c7396f108df0e4cee8e43a2469dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753831, "uuid": "ceaca79f-664f-43c2-bcc9-add6fb744560", "comment": "Malware payload (Mirai)", "value": "c4829836336328ae2596603906c2d0f7cf217e40a093d88470bed5dcdb7c24440b8f1120dfb77003f1661d9f9d0b7cd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753831, "uuid": "f816b37d-5a3b-4caf-a712-765ec8ffbf2c", "value": "T157D2E1C568DD9879CD6753BE73AF5AD900B182C43B9983822273E4D0B31E12DC7621E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753831, "uuid": "e3896c2a-a5cb-4133-8371-0fd4f5a8e6fb", "value": "384:MFZXl/PEC4AwNcybmLxaICkXh5oTn96X2zvH23MjCeFkxTXBi3myz4DRGUw+v1RE:cs+wnbmUICkxyngMvHo1KTz4sWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753831, "uuid": "afc1b16f-c9f4-4a4d-8e4c-f292c5919d8a", "value": 30220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753831, "uuid": "1065bbdf-f0ca-45a5-a9be-b07888ff9597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753831, "uuid": "855714f5-0906-41dc-920b-33b5f95a516f", "value": "7c2fdde4f3b8826205ee63abebabd6c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d67590-6617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696795983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795983, "uuid": "62cc5fa9-7dbb-43e9-adf8-978e992db2f1", "comment": "Malware payload (IRATA)", "value": "746827a518b756faa9fd86210a752a99", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795983, "uuid": "4f5d00e6-f022-4555-a727-19ef33e082b8", "comment": "Malware payload (IRATA)", "value": "c3e0dc9487b8ca7ee2e959fc7ae5d9100106a8497fc08d3fa13d676edae0e317", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795983, "uuid": "f0a64678-91cb-4ee0-8b0c-87b50d39538f", "comment": "Malware payload (IRATA)", "value": "4f168fd3921e4bc01d052950a5a5e55ded74d691", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696795983, "uuid": "52c791f5-ed9b-4bbe-9f81-8600b64e27e5", "comment": "Malware payload (IRATA)", "value": "c44ff723a387135c56dfba5c814b0e25cb7442aaa662c724591109925fa78d82ed6eaff5e4f298c8c5a0718051ed8baa", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795983, "uuid": "a98e52e3-e6d2-40b6-ab42-23ed61d971af", "value": "T1C7A53396E325AA26CCFB97B8112683911D770CA04E27DD9F792C337D0977DF8974A180", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795983, "uuid": "999270c6-57ee-4d24-a783-f7db8b36c42d", "value": "49152:AE9Q6t+3vtttMwzvwpycRLJ3Bjlo9Opyc59ms9FFMFl1U:AoQ6tK1vVIscRl3BpowpdfNLio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696795983, "uuid": "f5227af2-55b3-4466-b44c-d70da83c7de3", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696795983, "uuid": "482a171d-4c1a-43a6-bffd-531aea1f680e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696795983, "uuid": "ae3ba21e-34d7-4b3c-a587-69ffc7b22e20", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90207be-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753844, "uuid": "0632951a-aa0e-476f-b1b3-6c2c01b0d140", "comment": "Malware payload (Mirai)", "value": "0718f015652e313091010bea93861728", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753844, "uuid": "0da753ea-93bb-450d-82eb-caee2a54d3f4", "comment": "Malware payload (Mirai)", "value": "c473597bfeec0f37cd173872c442692295006472fb350375054ba9968976c00c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753844, "uuid": "82d2d98a-3125-48f7-8a09-06c89cdbab48", "comment": "Malware payload (Mirai)", "value": "ec187dbf55d43b8d8cc968b25d1d517841b111c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753844, "uuid": "74dbb086-5c20-4f97-b875-0422713d5193", "comment": "Malware payload (Mirai)", "value": "350a6f7098bd17ff0da9744841510365a5671bdb5bfc99ee7b4f8dc726326a2def6282f1758f8075c1009e3e351ca10b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753844, "uuid": "4b534626-3642-45bf-9c81-b80752d6aa34", "value": "T140736EE5E8025E7CF55BC6BA85174A08AD21A7044BD30F2BE767FCC77CF21989A06D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753844, "uuid": "eb7dbaa2-33a6-4d1b-9c22-c34949a5d15b", "value": "1536:4l0EJ1/RrCTQ3TY4Ge/l7tJwuHQRc3Dbm+W1d86wIC:4QQDb/l7LfwI/Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753844, "uuid": "a8fe1307-2cb0-4b69-a98d-f22c3e2063b1", "value": 79204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753844, "uuid": "f189bdef-8ac6-42ca-a272-8bc0da9ceb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753844, "uuid": "f8e17459-483d-4787-ac0e-90a880cc0ed9", "value": "0718f015652e313091010bea93861728", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0651f29a-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783931, "uuid": "97a93705-5725-44d5-b460-b0197f0f6b19", "comment": "Malware payload (Mirai)", "value": "484e5038f9bf528e971755d81c157f72", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783931, "uuid": "824396e6-99c2-4568-b465-747ea2e3719c", "comment": "Malware payload (Mirai)", "value": "c5a896f797b9085daeb2efe54e1dee79eeac60fe3d7eb274f18df78781b52bdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783931, "uuid": "951cc4b0-ed94-4bdb-8b81-768f848d2b24", "comment": "Malware payload (Mirai)", "value": "2543cf4477656e96e5547f6379a853147bb857af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783931, "uuid": "4d9e25dd-e233-4160-8a27-28d9f2f69082", "comment": "Malware payload (Mirai)", "value": "308c4278008832342aaa781e91d83fa809f8b8be2f59bc28cdd20a92928eef41d837af618170726788855e29a76df9c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783931, "uuid": "79311cf7-afcb-4388-897d-9f9bf6cf9c6e", "value": "T102A37DC0F783D4F5E89705B12076EF369B32E4B9711AEA42C3B96E329C51911DA0BB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783931, "uuid": "4c9dfaad-cfa6-4639-8e47-f4f155810633", "value": "1536:JAvzSEzEgKlM6/qXM9nWvHDlOElO6vLGbVkMSPyX75o9BrfDN:JUzSpgKlM5M9nUgELLKKpO2nrfDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783931, "uuid": "e6ead34f-6b3c-4b73-a9c8-68437198b17e", "value": 102760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783931, "uuid": "0fe896b4-912f-4689-a9fa-96af112dba0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783931, "uuid": "ea1f9775-5d17-480b-be31-d42a0d6763f6", "value": "skyljne.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d07a94-65f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696783465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783465, "uuid": "caa8bcbf-8573-4281-bae8-df3c2d327327", "comment": "Malware payload (Smoke Loader)", "value": "75ea13f371b1b24565a9eb41a7a8a5fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783465, "uuid": "aaa39284-2e06-409c-8146-050b104777d6", "comment": "Malware payload (Smoke Loader)", "value": "c5cdd5442277cadf2c11aa3122a70608c24db1a457b79923d8bf208b8d63e826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783465, "uuid": "fbdb571c-3026-419a-82cc-916800bffc59", "comment": "Malware payload (Smoke Loader)", "value": "b3b1cfbda85b6922ed57b88917d893870c9c622c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783465, "uuid": "e5c401f2-7567-4e67-844a-1d122b80618b", "comment": "Malware payload (Smoke Loader)", "value": "ffbb39bf89043c5020ff09cd03bd5c33fccfd92ba1b3f7ce139e69bf03c5bec5b34cbcda8c717f7aedc4fd0bbb219962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783465, "uuid": "1bd0e5f4-cac6-420f-8475-f49826e63236", "value": "T11A546E1363A1AC65E5268F319D2EE1A4373FFC91CDE9779A32187F2F08711A1C662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783465, "uuid": "a0b50016-cb59-4a92-8940-94a813b01062", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783465, "uuid": "4e031fbb-7b40-43db-99b7-1c587e67148c", "value": "3072:OLq02r09y4hMEjnCW187d5gsAE2tB7QEG/L5QC/aT:iM6ygMEZuIsAFz0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783465, "uuid": "bd60051f-29bd-41f3-b596-9db6aa904af8", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783465, "uuid": "585b6f21-6f35-446d-a23e-79431b75dd54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783465, "uuid": "7532e75f-0267-4766-991b-2db110199bd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb0c72f-6617-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696796234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796234, "uuid": "3ecd3cd6-05a1-4de7-84f8-ae17b327e50b", "comment": "Malware payload (IRATA)", "value": "cbc18902f159c1bf4a3a2b62c615a263", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796234, "uuid": "4f97148b-c4da-4902-9ef4-f8e4034bdcd8", "comment": "Malware payload (IRATA)", "value": "c779df4193bd0ea9481199fb606b8b8b48513e1f59f0e4fe1285f874fad25c53", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796234, "uuid": "b324a2f4-6472-4458-a3e2-6f6ee0763485", "comment": "Malware payload (IRATA)", "value": "51ed5cb44ed7f7f7c2685d0ef3196a14b37c9b40", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796234, "uuid": "07e07adb-c9d3-44b5-9d8e-1c2d8e9b44b0", "comment": "Malware payload (IRATA)", "value": "7783a778767ba09c5a554da7071b8f596e88e2310950f5c6c68d4f013e1d93b8c5953149c197c3c2015fbdb5425e0a4d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796234, "uuid": "b88ae832-9028-4fa1-bb94-38643de4a13e", "value": "T1A9851247F66AB907C831C0323185263A25164D19D942FB0A3E4D37FA2FB7DE88F856E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796234, "uuid": "ff5afa57-a5a5-4833-aae4-e95caa0b0cda", "value": "49152:vs/ikkp7XQojNwE2e0zBTw3kXQ/QKDwUqQ/LHe/kl/gRz:wikkpX9wE2e0zBT2kXQo7AKY/gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796234, "uuid": "0c0bd3d6-b4d0-4b29-a243-f65f569f170e", "value": 1858937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796234, "uuid": "4633f1d9-103e-40ab-8261-59c5ca3af7bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796234, "uuid": "7c0361b1-3030-4b91-bd8f-25b52e8b0bc9", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0baa85-65ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696750978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750978, "uuid": "5b096f73-6915-4093-954d-52bf4d786746", "comment": "Malware payload (Mirai)", "value": "56289a2210aa175394384ed3fefaac9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750978, "uuid": "ee7652eb-ad14-44bf-8cd1-4b7b4bccd819", "comment": "Malware payload (Mirai)", "value": "c966b2dad5629d43604b5124f95b2f1bfd09dece7c8a3588616d8f9230ad5e2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750978, "uuid": "c6b9f8d8-a929-41ee-8ec1-3d860e2b5789", "comment": "Malware payload (Mirai)", "value": "dbdabb59785a6769cc05d4a58edac76ebff1df4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750978, "uuid": "716fc73b-ed39-42b0-8b56-c4322933b61d", "comment": "Malware payload (Mirai)", "value": "f570ba67f921612cbf68cc3659cdb5686ac314913dd626576c3e73d4465b68fee39fa475d86eb8f58da543933682497e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750978, "uuid": "41cae6d1-79c1-4658-b338-bb6bfd68374e", "value": "T18AD2E192CF1A1E8AEFBBDE215C4583E27F7045DE33A69BD000E957012137C632C599EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750978, "uuid": "407b32aa-ecc4-48c1-a798-f989e463ad43", "value": "768:8QsKfwRBBC8B+F9o2MpzJ99/4uVcqgw09D7:uKfwRC8B+F9s99/4u+qgw09H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696750978, "uuid": "842d943c-089f-4668-a27b-76823688197a", "value": 29352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696750978, "uuid": "194dd1c9-53fd-415e-8513-436a493cbeb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750978, "uuid": "f472d501-b525-41d3-a6be-d250f95b95d2", "value": "56289a2210aa175394384ed3fefaac9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e571b69-6627-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696802896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802896, "uuid": "93581195-b2c2-4e91-8cc1-480af1362d09", "comment": "Malware payload (IRATA)", "value": "5658c8839dd4707b8d77201155123dcd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802896, "uuid": "f49b639a-dbd9-4613-ace9-263971310df5", "comment": "Malware payload (IRATA)", "value": "cd004f29c09d77fd0759c1377fad9d143066482981e16ea4e263b70ac8a9fd14", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802896, "uuid": "e5c0bf17-8a2c-4cc7-a558-af58d3765e96", "comment": "Malware payload (IRATA)", "value": "70ad50975d5bf136ad76da12047fbbbdaa796580", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802896, "uuid": "7e01bcd7-3f72-4f71-8a62-5849d1573cf0", "comment": "Malware payload (IRATA)", "value": "867d14114b74bc9dc848017f2d78de769a2a84ef055a8f32ce36956f3e5024c50dac93ab2fd737e0eaeae2b325d9ee86", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802896, "uuid": "c869f4f0-6395-4818-ae04-0a0318c7634e", "value": "T182851203F275A84BC872C1322442263965175D19C943FB4A3A4D37BE7BB7EE88F846E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802896, "uuid": "04f57cfa-b58f-405f-abbf-0c2f2afd8f9f", "value": "24576:Ms/EI856pkp7XQoeqCYKUIZ39yi6VxpxP23LBnmoWzG1cCfeS14C/0kCzS5cfENJ:Ms/ikkp7XQo7vo9P6V123L3h1cGZ8kCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696802896, "uuid": "3ba63441-3d06-4404-b3f2-2dd8d88e314a", "value": 1866998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696802896, "uuid": "1d9d4d92-8e5e-496e-ac9b-a09eae9fa298", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802896, "uuid": "81c3fe2c-7051-48b9-8713-adae3bfebbab", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed9cbea-6618-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1696796696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796696, "uuid": "33685b92-349b-4af2-9f94-80c7cb122832", "comment": "Malware payload (Stop)", "value": "f49c53a4db7c7a6e0ef1e9243cde5ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796696, "uuid": "ee3e7370-f5d1-46b5-a48c-086dbf25bbef", "comment": "Malware payload (Stop)", "value": "cd1e5d43202f27d75d48c1d6963ef572eb3321e1ca3d6510c6a999598db09a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796696, "uuid": "639e5f1b-969f-414b-8103-554677581bd0", "comment": "Malware payload (Stop)", "value": "86e2388514f7f4c2a7acd09c03325b0ed690ef83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696796696, "uuid": "d7f82874-955c-4566-abdf-cea897f9607d", "comment": "Malware payload (Stop)", "value": "9b2c0e68570c8349ec78a74148639c429472b72346c3cc93a96eb54878b3ea534fcbe07fb5e8faaf02c14f3cf604c557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796696, "uuid": "59cc2b4c-6238-43d6-aab7-836cff1f8fdb", "value": "T194050213B7B0A860E5269B325D1EE1E4372EFD51DEE9776933186F1F04710A2CA72B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796696, "uuid": "3a06984b-7707-4f80-ba6f-4928cb43e9e8", "value": "b5c6438640df57092a1d264477a39c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796696, "uuid": "585242f7-a8ee-42d9-a592-9956891a93a5", "value": "12288:TOZ8mfnnY5jT3ncoNw7JePBRZ20CohvlPMWaRUyunKH6bkhT0J:4pY5jwo0JGBRZlNNGtuKHEwT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696796696, "uuid": "ee150645-5790-4ae4-830c-81c959941f92", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696796696, "uuid": "4d3da0a5-f446-45c8-bba9-0f4ab3035d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696796696, "uuid": "8a3e18e1-be68-423a-81d6-69df1c65be84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cae2499-65f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696780505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780505, "uuid": "7d9d89d2-91a5-4873-ad3a-51b20928ee77", "comment": "Malware payload (RedLineStealer)", "value": "acfa4a6dc200d4233ae9c236a34c154c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780505, "uuid": "8975c9b6-23c8-4d68-a0ae-9abe7ea48764", "comment": "Malware payload (RedLineStealer)", "value": "cf254832f21bb77a35543ce4e9a0871ff448205a35cd572300d0e3dbd0049e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780505, "uuid": "f4ca2920-9ab6-4c12-9dff-e0f1cd298d0a", "comment": "Malware payload (RedLineStealer)", "value": "6b5f4f5a44b1ccc56906b9cf75b9d792e7254a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696780505, "uuid": "ba0f73c1-26aa-4ab3-a0a5-2e038e4e0bb6", "comment": "Malware payload (RedLineStealer)", "value": "99bc7a5a70cf6844690cb720ef9b511ad10de7fde9eca93f366e75baf758592eb923c2bcc8295e34f9b5e4d5ae3230d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780505, "uuid": "fa387392-299e-492c-8aea-88f81fe165bc", "value": "T145857B6038F3CD25DDA21176DE9FBCA0166DB0E00B2A46E376DC8DEB95211D27E35983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780505, "uuid": "ef26676b-8858-425c-8813-822ead4ccc77", "value": "e367cd2cd00d41816448f9c2b20f0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780505, "uuid": "6899355f-cdf5-466e-bbe2-ff48cd733c59", "value": "49152:KQ76B3/m38tkaZdOLOFXSvjfTb0b9bB8wsu8+6LQbK:0+ckaZdOLOFXSvjfTb0b9bB8wsu8+6Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696780505, "uuid": "9e087e5c-c490-4939-b6f2-f777ab6946b7", "value": 1827840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696780505, "uuid": "22f38ab7-0e3a-4bcb-b84f-babc2c6eb506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696780505, "uuid": "2f275ca6-3d77-4d7b-a618-eafa0b24f838", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95049cab-65e8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696776010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776010, "uuid": "4bc2e734-7d6f-429c-8330-5b994e155fb9", "comment": "Malware payload (RecordBreaker)", "value": "4dcffcee1408fc249e0d85d8587739a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776010, "uuid": "5a175e7c-8b6c-4427-a0d8-3eaf23a451b2", "comment": "Malware payload (RecordBreaker)", "value": "cfc7f90046252458d74eb83b86392549318215caed0e7ab105e8954858a3c7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776010, "uuid": "e46a55e3-c8f3-4e2b-9da9-068cec95b331", "comment": "Malware payload (RecordBreaker)", "value": "5d3b0c8cab3564e105b1aec00723bf6be3582d81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696776010, "uuid": "b574cb6d-a7b1-44b6-9e5a-7bdd05fde829", "comment": "Malware payload (RecordBreaker)", "value": "f4d0d77dcc29ac8d1aefdc32947f4c8dcbf0245350d6a78f44fce45583119842e97a4d231ddbc1fd0f25721588b76668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776010, "uuid": "7c29c497-a65d-4470-bc6a-f26605d564cc", "value": "T1FA45D022B6D04632C2A3137CAD4753A99C36FD00372C65866AED4D8C2F39695B63F2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776010, "uuid": "d9e446b3-af8d-4695-bb29-fdc58a1f7a82", "value": "87114088ed4ffa639326480d6d4a3193", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776010, "uuid": "b1116277-d634-4f4e-9eb7-3f778cbbb9ba", "value": "24576:JL8rxwyhjDZjFTgYTpseCu7RN6BakxUwIVTgcp:JL8rGKHYYTyeR7RN6RIVT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696776010, "uuid": "09df3dc5-66df-4258-88d3-5846aab7bdb5", "value": 1222133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696776010, "uuid": "5cb0cb0a-f033-4618-9bb3-26673574e352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696776010, "uuid": "3c2d23b1-7f02-462e-b88c-b4cacf297095", "value": "4DCFFCEE1408FC249E0D85D8587739A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9259fa7-65e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696774809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774809, "uuid": "0dc61219-0fe1-444d-a1cf-a7f699616c5b", "comment": "Malware payload (Stealc)", "value": "13c0e62872d5853a3dd11ac7dd046993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774809, "uuid": "c5c77040-8ff3-4def-ae73-119abc8b0d5f", "comment": "Malware payload (Stealc)", "value": "cfed1055308a270f28b7a63c778d679d73124d5ece12a6223a5a595a95f14dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774809, "uuid": "f346eed4-b54c-4304-acfd-12f14e1a667f", "comment": "Malware payload (Stealc)", "value": "a67863c1bd8b79ce3ad7e38dbf0f1eca92a5b607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696774809, "uuid": "166674b0-2b92-4911-b868-6179e8f5f88f", "comment": "Malware payload (Stealc)", "value": "4c7775dc50187051f96d73e9ee2f290c3abb8b15f2b3ba4b1f7236a3af8d99840466abf9c5dbb974abc0acee6d750418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774809, "uuid": "91fd653a-f150-47c2-ae6a-01fccf5f5fb0", "value": "T14327238B1C8780D5E9C109B4D72B37E703B2B5DB8DD948756AC93445E1B2EB3702ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774809, "uuid": "280c9e6f-043b-452a-abb6-5d85373c5cce", "value": "dfc137e2861dfb09e1a7251fabfe7796", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774809, "uuid": "2ab882bd-0b8a-4582-a28a-1570410e9627", "value": "393216:+z0Yf1qLN6WphlO/jm+jEzjnW8NKoaO20ijGfVoOXogzw/Q3tarVvXO0oPR9TP:eaLN6GHObFkW8Pax0yGiOXofIOVSJ9TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696774809, "uuid": "08fd8c98-053b-4cbc-a719-791971c9e072", "value": 20750336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696774809, "uuid": "f745bc8c-d0af-4d8d-95c9-8f910fe58eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696774809, "uuid": "3f36bd47-732b-4695-87a8-71f117b878f4", "value": "13C0E62872D5853A3DD11AC7DD046993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153f923a-661f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696799418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799418, "uuid": "b7bd76e9-cb31-4067-a645-c0ddd359040f", "comment": "Malware payload (Amadey)", "value": "473769143d643c8b0d538cf8f788862a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799418, "uuid": "44fa49ce-5d3f-4f3a-93ff-fbfe207b3966", "comment": "Malware payload (Amadey)", "value": "d00b0d96d88522cc802359e5dddf7e03692a67060dfa17206e5f4f1ef50b35be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799418, "uuid": "7483fec3-8ffd-4d11-b17a-e992c8b7d367", "comment": "Malware payload (Amadey)", "value": "6b4e57efb63d46e166b8a375c6382c1c88e69a8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799418, "uuid": "a1cbed42-aca0-4e8e-9245-c5127742d4ce", "comment": "Malware payload (Amadey)", "value": "1d7f0827e39c5a40f266df215c1e9594fb4af9c5e3d8b3a50637dbe607f14c99f797e54ef637a3f5c892b0f4db63b5c3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799418, "uuid": "2e887011-a562-487c-9a7d-23740db108e3", "value": "T12A452326AAD88432C8B95B7094F707470F333CD199B8DB5A190AE4591CB1F46EE723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799418, "uuid": "c0a45a9b-88ea-4a1f-821d-5a6671fe7bcb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799418, "uuid": "ae511b37-8c48-4df8-8503-df34e1f63086", "value": "24576:LyukP6qvDDPrU83zefXTCHB+HNNha1eQBf4QQqPnboUpaZ8Y:+ukCIPzUwzefXTCwZa1T14QQQbppaZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696799418, "uuid": "30b32fcc-552b-454e-b055-1de99123c1b7", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696799418, "uuid": "981d747f-2274-4ef0-96a6-0638e5bfde39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799418, "uuid": "6d1bcfd3-7fa7-4052-9270-9861d7063474", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e398481-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696773851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773851, "uuid": "8940d2bc-49b5-4d62-a20c-f919a33f704e", "comment": "Malware payload (Smoke Loader)", "value": "9dccc78a139827cdba0f4513b995fbde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773851, "uuid": "661ec0b4-9477-4bfa-8beb-8af510d864f5", "comment": "Malware payload (Smoke Loader)", "value": "d1f5fc183f814979d2e6aa2b83f932d65130ad3cab1bb08cda380df4d3af6619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773851, "uuid": "4d5289cc-4619-466a-b8de-73c0be394936", "comment": "Malware payload (Smoke Loader)", "value": "de037d4dd120445c6b8eb5e9c5e2856b17e7312f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773851, "uuid": "befdf791-cd98-4f20-934a-706d24bc5f2d", "comment": "Malware payload (Smoke Loader)", "value": "3350769824ac3e60e315f9b9321cb197608c9327533a272f19f8f890ec6fc249c645bba5022a4000c2d01c4ed7a76757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773851, "uuid": "f7f9929d-8e4c-4e41-a7f6-809f9ed2e6f0", "value": "T141547E1363A1AC21E5668A329D2ED1A4372EFCA1CEE977D733186F1F08711E1D662713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773851, "uuid": "e5f813de-178c-435a-bd73-5555f10cb0d5", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773851, "uuid": "8309a4a2-ff1d-4f74-b028-7d7072433605", "value": "3072:ScS8seHSpBWARcDi9LcNkJAPedRljDHNaD4WAg/a9:k8J4W4ei94hPwrHsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773851, "uuid": "de5a4662-b8ec-4e61-b8b8-d997879d2016", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773851, "uuid": "eb836f5e-111b-4c4a-bcad-5086dfd289bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773851, "uuid": "2f8cab78-32c7-4ed2-8080-ee7c9ddad782", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17922082-65cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Babadeda)", "timestamp": 1696763344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763344, "uuid": "ecb9e0b1-e77d-4340-8afd-c238a3cbaba7", "comment": "Malware payload (Babadeda)", "value": "c9d469547ba8f1f21f2c1e23d03e2a14", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763344, "uuid": "c864cc22-b0cb-45ea-94ec-e33f0c4a11b6", "comment": "Malware payload (Babadeda)", "value": "d3b1261ede6d43ccac79efdff0ffb53befa10e85032aa9e9e1661cbe6ea5d219", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763344, "uuid": "08030165-66c9-4493-9a04-abd726831eb2", "comment": "Malware payload (Babadeda)", "value": "d1fc65dbee83678b847469b79867f283dd64b712", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763344, "uuid": "3498f8f2-d7ee-470d-b288-b6f024f3401e", "comment": "Malware payload (Babadeda)", "value": "748d4bccd4d5a9f8903b33f657bc0578723cb821701aa1755087ae478e251a7c366628be69b4f6775688ad67e5e0a341", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763344, "uuid": "5ae9f3b8-24ac-4889-915e-51293c2b5df1", "value": "T1EAA37D41F3E102F7E6F1053100A6663F9736A7389764E8DBC74C2E429913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763344, "uuid": "34d5277b-8cfe-4d27-bf63-a4740bd4d796", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763344, "uuid": "a65d6f2b-1a0b-42ad-8dcb-7e2c41313a91", "value": "1536:j7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfiwvLzWKdcON:/7DhdC6kzWypvaQ0FxyNTBfi8eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696763344, "uuid": "4060530c-5672-44cb-bdb9-d7b900f5e076", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696763344, "uuid": "850ff25f-cb8a-415c-ab03-0f30f29dfa86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763344, "uuid": "934dff1f-9f4d-4469-ae26-9884d06937b7", "value": "setup.winxp.64x.professional.english.build.2600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e617e995-6630-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696807069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807069, "uuid": "9a2f9091-8899-40ff-8a4d-488cece5164a", "comment": "Malware payload (RedLineStealer)", "value": "5016a5a45644b49b6bae6e7ce132cd3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807069, "uuid": "3cee972f-270b-4282-8d14-e59705104f9c", "comment": "Malware payload (RedLineStealer)", "value": "d3b9c170432d7cdf33aa81f353af0739368f274a4aaa7be30884e64f591891b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807069, "uuid": "64d3a00b-bd03-465f-9cb7-9a0a2b10dd34", "comment": "Malware payload (RedLineStealer)", "value": "4c3d8e9189e84ddf270a6e62d9948d8801041646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696807069, "uuid": "6def623c-62b2-4c74-a31c-574c39a128df", "comment": "Malware payload (RedLineStealer)", "value": "45c98b1909ac963735dd81607ae8a928f17f21149eb13809078b1e3ed0bc308659645ab517f6909992ead9e37cd40e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807069, "uuid": "96599a16-1b4d-42b1-be4d-d68667185e46", "value": "T177452317D6D844B2E8F23BB44CFF13931A3A7CB145B49B1B1A44A95A09B7B04B53272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807069, "uuid": "e1e0a9f0-bef3-4eb3-a3b6-391db3d567cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807069, "uuid": "42e799ab-cbbc-4674-9b88-255119892684", "value": "24576:yy0buLhjF5EvjfYJy+rp0Oc6j0GTjkH51/8BRztri:ZKgp5YjYJy+Lx70H5h8BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696807069, "uuid": "3f506466-a7f3-443a-b910-4a2151f60264", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696807069, "uuid": "6942727e-f080-45ff-b3e5-1813c7b9a674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696807069, "uuid": "edad1461-f39b-4e73-bcbf-07cb5f90775a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e5c0ea-662e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696806021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806021, "uuid": "782438a4-4a8d-43d0-b576-b6d70abaa225", "comment": "Malware payload (RedLineStealer)", "value": "16f382a36075cbefd0f918f576751e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806021, "uuid": "d1636c94-4b0a-4c85-8816-cc2e20f299a3", "comment": "Malware payload (RedLineStealer)", "value": "d561ee4d6657d9e465885281abb1589efd2828d47f5033ec10b04a85446f9930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806021, "uuid": "fd25e324-3f11-44a6-975b-d82eaa6f211b", "comment": "Malware payload (RedLineStealer)", "value": "a2933c1f9197bb2e6ace2a91fede69ecb6753a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696806021, "uuid": "f3d1b051-c102-4162-a662-199ac06a8003", "comment": "Malware payload (RedLineStealer)", "value": "df331e34dd62626ddc5d66ff311399800cfd979b40749074d3e1ff42bace36e64f9075860745efd27b2d6ee9be1df5dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806021, "uuid": "e1fde6a9-5718-43c4-952e-cd8944ea99ff", "value": "T1B67418C0238675CECC4F8BF1616917688A71D442B657BB537C8BACF63C5A3D4AE412E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806021, "uuid": "98ce63d1-4461-47cf-9d1c-1bb9b968ab57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806021, "uuid": "42a42097-5f9c-40b7-934d-4101e303f6c0", "value": "3072:Rjd0cYqfU7e6uNPaoLe4Z2BAYG2w2/vQEeNLbA/i666I6m6i6E6Y6Hq6E699f6SR:Ruqc7q/y4AAx2LvON3/hbRumEN1afTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696806021, "uuid": "cb81926f-878c-469a-a00d-cb0723872ca8", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696806021, "uuid": "d65d04ed-1215-4159-8747-97dc79b26524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696806021, "uuid": "fe435a0f-1ee7-46ed-b148-ce60c5a90006", "value": "16f382a36075cbefd0f918f576751e19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3fee6e-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808553, "uuid": "68b815fd-3802-43bc-bb87-77f0f9ce010a", "comment": "Malware payload", "value": "6362dfd677e55426ff7bb74ac8c9a352", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808553, "uuid": "00c38631-31c0-4dfb-86a5-3d53be1d14a2", "comment": "Malware payload", "value": "d6036e25b3a80afc1cc736b62338458b5f9d6643903df3618817e4db71e26314", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808553, "uuid": "127f8058-53d1-4523-a337-8399b6f47e69", "comment": "Malware payload", "value": "fd916c5fead4dbe0af4828ab9aa9e8d7632e4e33", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808553, "uuid": "1a56e96f-bfce-424f-a86e-c4c1e29f413a", "comment": "Malware payload", "value": "fadb4c9ef37840363f0e69c2220f152bed6cb77a738bd2d95bb7496bdf70ab3d082657c4da414155e3baaa8d24a413f0", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808553, "uuid": "ef9cb592-4527-452c-9643-6ffe7c043e00", "value": "T1FF21EE73A4C20622B067B1E58E9F1448215A8647A15CCB4CB8ECE74DCF0916D99EEBDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808553, "uuid": "20934b94-911c-4114-a447-fffdbe71516e", "value": "24:IQ4DqO8bX55lzGxQj7Ma5lz8/QWuyP5E32w8juuR8XgPezY9Tr663yxjeJwb+e:Iuvp5ZBB5Z8OF2w8CuR8XghX6djee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808553, "uuid": "3451b9f0-a963-4725-9a61-fa3e8aec8349", "value": 1401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808553, "uuid": "b4381652-8193-4876-b99b-fce3477c580c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808553, "uuid": "7491dcbe-6ecf-4d94-9bb5-4a18d5011ad2", "value": "Steal_Doc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a208ae5-65a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696744880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744880, "uuid": "4ba81364-2795-4617-92c8-151ebec38fee", "comment": "Malware payload (Stealc)", "value": "13e337865071713f83f29ef12f7d5838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744880, "uuid": "63b02328-6ccc-4094-a635-a564260826d3", "comment": "Malware payload (Stealc)", "value": "d6170783f0f121c452c5d140ea9692c8e96906acedb7f774d814160a22a312b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744880, "uuid": "ec5ad569-5eb7-4f3b-86eb-f2a474b1c0d3", "comment": "Malware payload (Stealc)", "value": "2a4ea6490e807a39f5413bb8b22db3cf7e50621f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744880, "uuid": "34ddb443-c409-47b2-ab25-f4a5bc27f69d", "comment": "Malware payload (Stealc)", "value": "c5259721f657228e9c9c6514622f27d6294cbddc52b37855c19c6b89a53a99a333404e11a46a5353df55f1d002bd100b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744880, "uuid": "9cba406f-465c-43b0-9487-5b57c5d426be", "value": "T185548E1263A1BC61E5264A329D2DD1A4372EFD61CEE9B79B33547F2F08710E1C672712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744880, "uuid": "726065a0-ca95-47a3-ab1a-303b0a090375", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744880, "uuid": "8840d2d6-3fbd-467e-a4be-22e4d7156af7", "value": "3072:qgo/ENyhUu1W+Jg8jMHftBKhA/nXbfDhCPWNqxzS9Q1Id/a9:+MgjWaJjgftB5L7hCPep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696744880, "uuid": "d3814fa9-f226-46b9-bd1c-9fe0035fb35b", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696744880, "uuid": "9d641787-0f1e-4961-b93a-6ee16cd415cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744880, "uuid": "e1e6cc06-efde-4f57-836d-7ec8db4ac744", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52982f8f-65c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696762154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762154, "uuid": "181407cb-79aa-49ba-9c00-56a5699ebea5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7e28394ac9bdb30cdfaf9ccd1865942c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762154, "uuid": "fc7c8e2b-5ffa-4cd0-8ccc-dde29cd3e935", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d822320e69cb0ddf07bd762ddf9d56bf46bae93a37ed1abc7d37485faf56761a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762154, "uuid": "edbde076-c23d-4161-ba63-883143bd5d28", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "252c08cabfd5cded14011ea601c272205b4cffa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762154, "uuid": "d86b52a4-3889-4678-a17c-f3d56c24c04e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fa6b8162e9a52e329eb23cfe03712849223e97cf31c522409f4fc421f6bf322961752f93328d6eaf05101676c9c1cfef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762154, "uuid": "afb813e0-c9bb-420a-8dea-fafff85e27d6", "value": "T15BC6016069F4CAD29AA11D445AF87E839A7173202E5DF1CFC2B35B9D0E11B604DA733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762154, "uuid": "b83f16bb-2543-40a8-bed6-dafb229ba63c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762154, "uuid": "7976ffca-d2a6-4d2d-a618-b9351904d263", "value": "196608:p8EDcJCh90yMctMnJ2CLQODLSD073wbl9UkG86MF3GDkMKLTeNdTCX/CKmj/PcOo:p8EDE090yXtcYODBef/GyF3ibKL4BCXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696762154, "uuid": "8157e30a-bd80-47d7-aef8-a334c0fe1e23", "value": 12068864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696762154, "uuid": "4d670559-ddf5-41b2-9d0a-294f9f6c2305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762154, "uuid": "d47725b5-4524-41c0-9c99-70e2691f9c90", "value": "7e28394ac9bdb30cdfaf9ccd1865942c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb473fdc-65b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696752532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752532, "uuid": "d27f689f-381e-4cd4-b4e2-f57f277197a4", "comment": "Malware payload (Amadey)", "value": "5d6ff5d0018bdb2c27708e7d8a8aaa25", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752532, "uuid": "1e10d078-15d1-4d6d-8a92-5dc6eedfefcd", "comment": "Malware payload (Amadey)", "value": "d83f98749c81b50324b8c43f62e1762231d3add9cc46e46d2815d81329f00b85", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752532, "uuid": "f500d831-01f2-4d26-969d-2339c30388de", "comment": "Malware payload (Amadey)", "value": "3a19c74f122e15d517862f35b9a22a243b90f45a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696752532, "uuid": "ae09d021-bf0c-4cd7-ad44-5bd428546107", "comment": "Malware payload (Amadey)", "value": "96dcd6d3aa98a8eeed3c200aa9ffd53608f26d78de13b742cdcd314ed5851c38faf1986bc2ea6f9e0ea5cc287eb5f072", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752532, "uuid": "b58f4038-b130-4dea-8de0-b5d41d32011d", "value": "T19F35234AD7E80A73C9783BB158FB17C31E30BD906878836B2B95E95A0D72190653377A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752532, "uuid": "faaa4c45-aed6-4bd5-bc2b-ba900543fdf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752532, "uuid": "e700be68-92dd-4dee-ac24-d715883b2b7f", "value": "24576:Lyq5WM+8RoeilURboUh0MUCxk/OxzTckSWfQIm9d+Qc3N:+8Wh8Rvx9oG0MUd/ezThSWfKnXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696752532, "uuid": "3291c643-c68b-41dd-80cb-fa5331ad4867", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696752532, "uuid": "ae507ee3-9da4-4e87-aa4f-f4ebd9513e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696752532, "uuid": "5d259149-bb70-4b93-bbfd-6b18f2099ab2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57eb1004-65dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696771183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771183, "uuid": "7983dfbb-6c83-44fc-aa4d-53fadb24cf4f", "comment": "Malware payload (Amadey)", "value": "1e9d25a1c34c3c9e46f28190fa51aec0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771183, "uuid": "9e6a811a-6698-4b6a-b45f-f303063f9105", "comment": "Malware payload (Amadey)", "value": "d9b12d7bea8e74da64b5f0d7711cd7f1653a0f49896f9865422e57fe0e08762a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771183, "uuid": "5593dc3e-af8e-43a4-aa07-22f3de08b308", "comment": "Malware payload (Amadey)", "value": "b958609ac0e54e693b6fc16eb5f70a69fecb0434", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696771183, "uuid": "a40483a1-9d55-4b86-aa9a-841e4b2b1d74", "comment": "Malware payload (Amadey)", "value": "489b5475dd43d4e691b3f4b757af946cd906086174bbf94d3eee749818222ea4e5f7736ac5070d717def44c44037dfee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771183, "uuid": "e9d0031b-1aa5-48ed-9d1e-850f94c72ec4", "value": "T10A452341A6DA89B1C0B16B3014F715530B3B3FB64BB4675B5B46AC3F1C32A94A8707B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771183, "uuid": "ef345264-edbe-426d-90a3-430eb9f13662", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771183, "uuid": "71fe7b18-f3ea-4354-92db-7ff7b10e8597", "value": "24576:dyCNg6aM/iKTkEhoU5FqRngy9Jci2jBpb0zKX4m:4ZKTbFqRgeJcljXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696771183, "uuid": "86eb19cf-7efb-4534-8e01-015abccb5520", "value": 1188352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696771183, "uuid": "2918377d-4de5-454e-b810-4f7721576518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696771183, "uuid": "bf8ee989-0261-4b4f-adb0-653462ec806e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a917248-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808527, "uuid": "d966ad6d-1d4d-40b9-8383-e0ee5afbfe4a", "comment": "Malware payload", "value": "ab20b0eb0c420beb74ddbc5a69e31b85", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808527, "uuid": "66d67f0d-fd21-4a39-81d0-28f6df7e7510", "comment": "Malware payload", "value": "dad42acaceb845bc18d8530ad5663a770ad222646c52ae495042580b3857a140", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808527, "uuid": "850fbfac-43de-47e9-be68-c11f1660f1a1", "comment": "Malware payload", "value": "5d9f173e665a92098f85041f5b7a48d97b20f1fa", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808527, "uuid": "e5d24fb9-a4f3-42e9-9119-c3d431afb545", "comment": "Malware payload", "value": "a43fa9bda1567a9a513432991eaeed15d578a6aa950ccf594436e5c06ef397bdbada339e364d9b1ac21d007d11bd61c5", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808527, "uuid": "4c934248-0e5b-4997-96bc-df73cc2d477e", "value": "T1DC21C93270C10426A17BB2E9DECF514820568587A16C8B4CB8ECE7948F1612DE9DEBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808527, "uuid": "741e66ae-bced-4ff2-9d37-2d9e956ee208", "value": "24:IQ4DqO8bX55lzGxQj7Ma5lz8/QWAQCGGUaezY9Tr663yxjeJwb+e:Iuvp5ZBB5Z8gtGGhX6djee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808527, "uuid": "33e65ae5-9f45-43ed-82b1-934074194603", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808527, "uuid": "6ca50cc5-6f97-4b91-abbf-081d687fa594", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808527, "uuid": "1e731a43-d8db-473a-96c6-836ab44db4f5", "value": "Steal_Key.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083ee8b7-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783934, "uuid": "8705a79c-c4bb-4b3a-9922-774aefe24dd4", "comment": "Malware payload (Mirai)", "value": "70ba52207adc6af5263f9b1659bb6cce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783934, "uuid": "be79df1d-b7a2-42e4-90e7-90c3cb69b662", "comment": "Malware payload (Mirai)", "value": "dc38aecb283439dd135378d770c754e3d58c45745b99fea4671b2d0dd06f51e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783934, "uuid": "83821f75-ab2a-47ba-9461-e7df12bb18b4", "comment": "Malware payload (Mirai)", "value": "78e4ff4ed3422838636568d2260266164a40cf65", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783934, "uuid": "132688c9-4b51-4316-8844-69f6f9073144", "comment": "Malware payload (Mirai)", "value": "57fde01c42bb08834567688a26d58b15a8fe8aa1d1eaf3bc7017b75f46d2bd005cc03af9ac9d70a90fb17adf25eee689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783934, "uuid": "dc15c8ac-a467-4b62-99b9-f9ccd6b8463b", "value": "T19604C81AAF510FFBD8AFDD3706E90B0239CC555722A43B393674D528F54A60B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783934, "uuid": "e87c4438-e039-40b5-9f6a-56aa3a35f5bb", "value": "3072:Cg4kCfrZFKFhq+w9weW5bAONlOZDq2WDy:C/kGFK6+wCeWlZmtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783934, "uuid": "fae368e4-eba4-4293-bef6-529e007b17ff", "value": 189452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783934, "uuid": "61f012cf-0396-456c-9eb5-a9260d311252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783934, "uuid": "5a913bc0-55c2-4fe9-ad95-2aa554c6e299", "value": "skyljne.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef57213-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808588, "uuid": "6185c125-97b4-4684-a2e5-1f964460f88e", "comment": "Malware payload", "value": "c026480f3d8d49b24c7481342579f87c", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808588, "uuid": "4d07ab7b-7025-4128-a72c-c0b6dd0cdc86", "comment": "Malware payload", "value": "dc488f3616dfd7d0c1f1c8f50a33f7d898709e40a45b832979c9e3f38f738996", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808588, "uuid": "1cd5208a-a56b-4e89-98b7-18ab463cfbda", "comment": "Malware payload", "value": "bf94202b179fb325e5c53e36fcde2307eb00623e", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808588, "uuid": "533e8382-7f58-4103-9182-13b77a89005d", "comment": "Malware payload", "value": "278f56a775a433f6b8f4bc73fdf4796df4b751a5aea17f625b365bb68b6d61ac6816ee4385e2b76ad984b93f34448391", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808588, "uuid": "c933bf56-8403-4771-a9ef-e0a9929d8186", "value": "T12CB0122CE8B0E78A456DB0DC8031AE2310853A71AFBA4D4DCA6A05345CE574ECF793CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808588, "uuid": "225fc396-2c2d-48b9-9c72-8641c0e8dea5", "value": "3:wdUp/CnJksTnQkQIhnCkuTFkoGkYkFM/Y:wds/CnJkOyIxCVMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808588, "uuid": "8152b755-556e-48a6-8df4-8a821e56548a", "value": 108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808588, "uuid": "c8380bc1-528a-43b0-8a83-2c058c093976", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808588, "uuid": "3dfb597b-529c-47d1-a9f3-25aaa966f2f1", "value": "B64.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff73b072-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753854, "uuid": "67c8811b-e7e5-4af1-90d6-d512213128cc", "comment": "Malware payload (Mirai)", "value": "c50e7f081d01a1c7730d91f6ba2b7f84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753854, "uuid": "6ddca8b3-15d2-444e-9c77-96eaad811d89", "comment": "Malware payload (Mirai)", "value": "df54d9d1a43aabc8a739e6766dc27e0b332f09be45955e051e4375241252692f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753854, "uuid": "ac320321-7e79-4ef0-a5e4-d311a6f67912", "comment": "Malware payload (Mirai)", "value": "e31f76b5c1d94c63435e672465845b6eb1e8ffa0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753854, "uuid": "d0aa6e7e-a046-4bad-833f-9297a429c819", "comment": "Malware payload (Mirai)", "value": "4b8085ff847c4da069388db7630947ed2d8312ab03d888fc438f561d329f6097c968aecbd7e04ec7435afd689c10bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753854, "uuid": "14b5b131-366f-4406-87cc-11a0caabfab9", "value": "T10433F148E1C61C9543925E30CD3E85CA6E4B1EF8EAE874F32668C2586DD08C53EF72C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753854, "uuid": "fb8aab79-bc43-49f5-b71f-dd22b2c23939", "value": "1536:P/NsLyQiVUjUU9sJBoDbMARLmMgE46q7ik:naLyQiVkUU9sroDoARLfn4L7ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753854, "uuid": "947574f3-d27a-45ad-bd64-137390836651", "value": 54868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753854, "uuid": "0eade299-4e76-4c42-b55b-6dd83e460b64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753854, "uuid": "5207cd69-90a2-4b20-ba84-cf7d28b9a388", "value": "c50e7f081d01a1c7730d91f6ba2b7f84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb37c67-65d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1696767543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767543, "uuid": "0a66d5dc-622b-433f-b324-aaaaa1d35c44", "comment": "Malware payload (PovertyStealer)", "value": "6d984458711b579aee9325c73d2fdf22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767543, "uuid": "97676fc7-01e5-4b3e-8a28-c5966b687af9", "comment": "Malware payload (PovertyStealer)", "value": "e076b2f55dbec4cba1a43ac977596ad5c6a72a468e5d5f99468872ecffd18ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767543, "uuid": "beaf6585-2a02-46fb-9467-9a9fb7963306", "comment": "Malware payload (PovertyStealer)", "value": "ebe9bf1cde3254a4c3775bc8f06c629baffc6247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767543, "uuid": "4e64af64-2395-4660-b271-416198fc42d7", "comment": "Malware payload (PovertyStealer)", "value": "6c188a746f979456f736cc11d283006e6773dff79f06d1c2e35cee661047e88b0aa17736fa0ceaf2de626f634f45768c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767543, "uuid": "ee6b2b79-6fd3-4293-a09a-5c9ab6cfcb6e", "value": "T12BD29EA1CDF0D0B7C0630076B79EFBAB5DBF6526032818C727B2095548966C1E6AB3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767543, "uuid": "f3bc68bb-ed7a-410a-89f1-b3f2b9250701", "value": "8995d522de22f9685bfb9ecf82fc5160", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767543, "uuid": "91d9090e-f70e-4289-8942-e91653e3c978", "value": "384:n3NudP6s4SEms0F10yEVlOtxtx9gN8cJkgQXkxbc+urVbgOROp/adpZpTJHabHhq:n8UtP704OJnVkxbcTrVsOO/iBC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696767543, "uuid": "fa832b56-79dc-42fc-a96c-99883e78160b", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696767543, "uuid": "35e002fc-1143-4e6d-a9ea-863fd322f164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767543, "uuid": "4368e6e0-ea48-42f5-afdc-2eb680b19720", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53746e2-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753837, "uuid": "52a0f852-d604-45f5-8ba1-7fe3f08b66a6", "comment": "Malware payload (Mirai)", "value": "1159bfb88f35dbb2fff07a7f946e78f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753837, "uuid": "d2fd4178-f71a-47dd-8b03-721789da1498", "comment": "Malware payload (Mirai)", "value": "e08338aa4f59caff7bfb6386ddbd0dd55aed99715fbb743c6601b4ed32cf3de6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753837, "uuid": "9da0f6be-1e19-4c16-bd38-5a70d6ac759e", "comment": "Malware payload (Mirai)", "value": "0d9315d3f037ae54b0ad75075534beb15fd484ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753837, "uuid": "b8c75dc1-e3c3-4052-9ae8-d7045742eb7c", "comment": "Malware payload (Mirai)", "value": "a834544274934cb7566a33b6fef65e93af6c1b49c39556b0a0cac6e18386b1fa1bd6e634c7d31684d4729e0228467eb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753837, "uuid": "0bb724d8-907c-4d82-a1a2-01cb8f6501f5", "value": "T1C863AEA2D8145ED0C509423861F18F7D1B53F9486B1B1EB08E8D84A6940BEECF71E3BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753837, "uuid": "f000974e-09f0-4f0c-afcc-8b5863e10207", "value": "1536:Gad/KDe5uxjUj1OfBs7Fdec9q91YCO7SLg+QPVdC28UE:GoSGqjUj1KBudW92ClL5QPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753837, "uuid": "65fd2d8a-8066-4873-9808-1b54aaaaf14f", "value": 72412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753837, "uuid": "8fce4d71-8ee9-463b-9fc6-842308e74985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753837, "uuid": "43785f49-bf90-44df-835c-09667bbae226", "value": "1159bfb88f35dbb2fff07a7f946e78f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b52c4-65d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696769613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769613, "uuid": "0f5fcd6f-9156-4a3b-8a1a-7e7d4ad95068", "comment": "Malware payload (Smoke Loader)", "value": "e2322ec8f797456ee621139e2398160b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769613, "uuid": "3dbba4c8-4950-4f1a-8f99-c9e3a16e0370", "comment": "Malware payload (Smoke Loader)", "value": "e24594aea71eb049bfe6bca5a8288426f0b20076d45c18fc06486843c9f6b16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769613, "uuid": "2fe318eb-b893-4f7a-9e64-285c24a8922e", "comment": "Malware payload (Smoke Loader)", "value": "1c96326e94fb012b8dcc1e6f5f24340f0fce8a8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769613, "uuid": "047e4368-e1f9-423e-bac9-7898d3c7c0a9", "comment": "Malware payload (Smoke Loader)", "value": "9fe8d04e20da7ac6bc32658ca67c3b0b5035a516f21331c48ea4db7bcfb1474d9c83c25e22e25d03410f0ad24442ac89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769613, "uuid": "c76af820-d89f-4e84-8fb2-8f7794c3be0c", "value": "T188547E1363E1AC21E5668A329E2ED2A4362EFC91CEE9779733147F1F08B11E1D572712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769613, "uuid": "e8bdecd9-e6e9-465e-934c-8d9107b3fe5f", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769613, "uuid": "beb34227-cb20-47dc-ba75-ea7a705f3435", "value": "3072:rcSqxfeobpBWFBYcDiPH6fLzXuyfdND0eBg7acD7TsZAIAF/a9:TqxWoWIeiPazSyfdNB0s6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696769613, "uuid": "39365181-e1d7-49b6-b434-4cfdea5e9ad4", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696769613, "uuid": "69e314d1-1dbe-4c37-a1b2-baeb24c20c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769613, "uuid": "f4a2fd00-15ec-4c28-abd6-c57acec72153", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d7a316-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808812, "uuid": "b98657a7-570b-4351-87a7-0e77aa0f678d", "comment": "Malware payload", "value": "16c2498bbdc411aa90fb3e414a385b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808812, "uuid": "f46fcc34-a059-4a2b-8606-7b735595881e", "comment": "Malware payload", "value": "e561d32bf0e6539601b7d39f57dad16b5aee2e3408e7707be171f5231cce5480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808812, "uuid": "5ed5c741-70e1-433f-a558-37e2ef455056", "comment": "Malware payload", "value": "2e2504a09f0739598a77549443031988e808dae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808812, "uuid": "78565b33-863c-48b9-9507-ad30ec32b1b8", "comment": "Malware payload", "value": "c6c37b80390277ccaee69173bdf9765dcb623c80ed986dd2a7eedf76c84ea7574ffb033cd9865576c607c02246ae4046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808812, "uuid": "75686776-4da2-444f-b0e8-f64b53c94085", "value": "T17C452313BFD9C023D8E017B01CF205A72A327DD2947053AB162959AF1D72A99B1B47BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808812, "uuid": "2305b953-f356-475f-b8b0-f6f579c94122", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808812, "uuid": "2f417109-25b9-4b2f-a327-9e379e8be6b5", "value": "24576:gyw8AZvCGXYTgnXOKH9IBjgaQQ3u5/d8GgFrBeB9:niZvCGXGgnXOKH9btQw8GgpBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808812, "uuid": "f1a822ce-2157-46c2-b027-4dd4ab9aefc1", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808812, "uuid": "2246e617-834f-483d-80de-effae0476504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808812, "uuid": "7b8ac896-4c3e-418d-8f80-70cee7c8d1b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528090a6-65d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696767308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767308, "uuid": "a3735ed9-6d06-4314-8fcc-8ba17c24ecb1", "comment": "Malware payload (DCRat)", "value": "06fba625c288f665c6b8e8896664b079", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767308, "uuid": "30dc1b93-a305-4260-a92c-01380ee7bf36", "comment": "Malware payload (DCRat)", "value": "e636dccac74f9d2123b711f1b69eb2187edf22238cec372a0d550978ae196bbe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767308, "uuid": "d0a932fe-d1cb-4da1-80b9-5688665265cf", "comment": "Malware payload (DCRat)", "value": "0095257fb901ebdcb9bbb334ea8090d358e71fd8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696767308, "uuid": "6aa0157c-5a3c-452c-9eed-f53331b522a9", "comment": "Malware payload (DCRat)", "value": "ad41d46251c84a3ce17e5049e50b7be3821d66d6002074bf614f790efa18f9810c9248222ed5350f1d24d8bd338f0592", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767308, "uuid": "8595f6ef-f400-46fa-896d-56a7dd512428", "value": "T1CC152A01BE44CE01F0991A33D3EF46484BB4A9516AE6E32B7DBA376D16123973C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767308, "uuid": "8497d232-6dfa-40b3-9d4b-adba0b033b6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767308, "uuid": "cbf73016-2791-42f5-b427-27f787e3e645", "value": "12288:Wv7RGI8+cNCNFvvAMfcJfbhfYoCfwUJeZP3rrLO8k:WzRGI8+3pr2bZCfwUkZP7Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696767308, "uuid": "b9ded716-a9e5-4ef9-9fb3-9869e4042808", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696767308, "uuid": "1e835ae6-a4f9-4385-9550-d81cb95a3115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696767308, "uuid": "273c6965-a4d1-48c1-9fdd-a8c514492491", "value": "06FBA625C288F665C6B8E8896664B079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bbdb1d-658e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696737360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737360, "uuid": "628ce5a8-7979-4190-a011-397627f91835", "comment": "Malware payload (RedLineStealer)", "value": "707617747134adcb80d3b406809e7621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737360, "uuid": "504abd9b-f64e-463e-b5e9-8926c8b333ec", "comment": "Malware payload (RedLineStealer)", "value": "e6e34973f51bfecb0dea2825753f1db7414549d9e794bcdf8191b1d8486ffcf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737360, "uuid": "833017d8-43a6-4801-b768-8cd2a3e8f356", "comment": "Malware payload (RedLineStealer)", "value": "6063915eacf6c04d28444b7b31d812d2bdc7f306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696737360, "uuid": "e1796cc4-06ee-490e-b882-4b66a35baf1a", "comment": "Malware payload (RedLineStealer)", "value": "6dcb566a3d3b00baa7b4895cfe1c19c533132e282398f22fece73615eee36d91c6beca7244959ec5a6e9d34198fec643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737360, "uuid": "1857127b-0d9a-4415-9ec4-0c630edb6412", "value": "T1FF652303AFD55832C9B41BF08DB502D30E39FDE56838A3666F539A4E09B24D425BA377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737360, "uuid": "22b6a55b-0824-4143-973f-8c1ad1ca494e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737360, "uuid": "29f25789-c787-42e1-a8de-872beddeea1e", "value": "24576:CyaEoVcMQQ/DoJbp5A1vxhAC/9z/oYBuwn4TzFTyfQkLdLlCJlE7:paE9M5E4bAC/9zQYkw0BT6Lxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696737360, "uuid": "2de2f306-a022-4485-89c8-1f574d454d20", "value": 1544192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696737360, "uuid": "088a1f51-2592-48ce-8e92-419e15b8a48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696737360, "uuid": "69f67c84-63b1-44d4-a9cf-9aa56fe3c1ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39449de0-6628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696803344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803344, "uuid": "8d349dcb-cd12-4245-b548-735b65973d1f", "comment": "Malware payload (IRATA)", "value": "b3eaaeeeb51f5ef12e760dea50b41d4d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803344, "uuid": "66113e37-8bad-4549-b350-1338d5dc3418", "comment": "Malware payload (IRATA)", "value": "e8b0f14297b687d9e62fc3ff6a08507e081272af955b65531f7848f6544a2b3d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803344, "uuid": "e3fce90f-08e2-4bec-88bc-930e8231354c", "comment": "Malware payload (IRATA)", "value": "d38af03c63569caa5b0a39f084b1a2079d976595", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803344, "uuid": "8832efb7-bffe-441d-8586-dafcfa0943c9", "comment": "Malware payload (IRATA)", "value": "c1b5e10e4cec38e4c53edfbf64698fd5ea6257cd315df35d7ca7d67b143cc7d194d589f996f699611bfbd5dbe487a6bd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803344, "uuid": "d2313c94-10d6-4a52-bf57-013d145ed215", "value": "T1EFA533E7E7B194A8C9D77F322114A3E8937B1DA24E1368837440B7795A327FEDB44281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803344, "uuid": "c13bdde7-6b89-48af-b422-a71678892fa6", "value": "49152:gEdX5dmMXtHYN8cGpCiTayAs/10i4kwIrmY6OEb+cSUcbsqnaz:gkX5dmItHgVsdiZb1jqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696803344, "uuid": "29d2dc13-355f-4166-b8b0-4223cde6c552", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696803344, "uuid": "c76a7502-9065-42a3-b712-5ebe68ec4104", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803344, "uuid": "d18806cf-bb2e-4d05-8b06-4b055358ba34", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb2925-661e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696799103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799103, "uuid": "c1c271a9-9582-4d67-bf7d-d67afee4c037", "comment": "Malware payload (Smoke Loader)", "value": "f4c938b171b29f26a4964b45425bfcfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799103, "uuid": "e6567531-ad13-41fb-880c-896f54df80f1", "comment": "Malware payload (Smoke Loader)", "value": "e9142e3ca7865f56e7d0c881b8eab627d77d9e08102191f1e55fd074a7e44fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799103, "uuid": "cffb6f8a-6ee0-4968-9127-eb2042ccced1", "comment": "Malware payload (Smoke Loader)", "value": "11f049d298c6176d250f99dc83bcd17c0fb8a0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799103, "uuid": "99b3f6bd-0d8e-4355-9419-27a30f3f3723", "comment": "Malware payload (Smoke Loader)", "value": "08841e0b8313865ae9ff9bacc02a926f673f4ff1289f59b60788a0b5f748bcadffdcccf89a8bc2e8f652c9b727a42496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799103, "uuid": "0fc7b988-2e41-499c-9a4b-61c0bc31eb62", "value": "T145546D13A3A1AC15E5668B328E2DD2E4373EFD51CEE9779A3218BF1F08711A1C562713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799103, "uuid": "a439f838-8721-4c10-a2e7-4bca48c0dc75", "value": "9d37df760655c3ef5d6cbf6ba5a52e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799103, "uuid": "c10b8d57-f8a3-42d7-b660-69a912ddbf81", "value": "3072:Lcgnn46CUg6i+KZRacUx4S4mh4j1xw+74E7HCDypHTsA6dJQyT8L8wd/aT:LcS44ti+K7aDxd2xFcgHTTmdL3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696799103, "uuid": "0fdc6cd2-03ba-4ccb-aafd-b0aa0e103e38", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696799103, "uuid": "08418c0f-3156-42e2-a074-290cf2d637af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799103, "uuid": "01797ff5-5e06-4280-bcae-1c6ba609c461", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff708c-661d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696798808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798808, "uuid": "f55afb15-6986-4fbe-965f-a68b4e9e37b2", "comment": "Malware payload", "value": "2f5cf3c55e58b53f0a62c80a1ee078c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798808, "uuid": "0938232b-bd1f-42a6-ab04-a5c02c8fe18e", "comment": "Malware payload", "value": "e97946aa507c48f1eb6edf2209f9f60ee1c5016ff0c706921fe66ca0bd00159a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798808, "uuid": "74f91656-061b-4034-95ea-25ed5235117f", "comment": "Malware payload", "value": "2f324f254ad688d8b1e830cee064849072d9ca8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696798808, "uuid": "e0f88d02-91a4-40ab-8c72-12b1bab5de5d", "comment": "Malware payload", "value": "92f78eb06d4c24d806370cf73dcc842e1b77a3866e0f48ecfa77130f3dcc223547c65b518411ea6db6c5ff68a9dcfc50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798808, "uuid": "7b93b555-f7d7-4b7f-904e-63afb49dd22f", "value": "T1CB431645BC918A12C5E062B7FB5E818C332523B8D2EF7307ED212F55779A81F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798808, "uuid": "9b22003e-782a-4a8d-8162-47a657206262", "value": "768:m85PX6ueAQR+XGbEpd3Y6A/ZqVHkPgtKfoaS2oOd1BbJHPbt5CkcsfpbNyXy0JKi:LPKuBd3YtEVHk/1BbJvbt5rcZXDJvDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696798808, "uuid": "5c86a415-25b6-4f97-a5f0-c4e9b07dea10", "value": 57000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696798808, "uuid": "2fb423cc-502a-41a2-8b06-81da8b00f812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696798808, "uuid": "28cfb5f7-7649-4796-bfdb-7046dcd22ff2", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b84807f-65ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696762948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762948, "uuid": "a5df289a-8ea2-457a-bb78-2a73aebee6d8", "comment": "Malware payload (Smoke Loader)", "value": "799bd744fd2f36cd35af2ad698e40924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762948, "uuid": "aceefe15-00b4-475e-bba5-9dc35c8aea58", "comment": "Malware payload (Smoke Loader)", "value": "ea3c57beba44f6c55a756624401781f91ff6ad81d2070e9a1ed7e777f8596902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762948, "uuid": "ae5c2505-a01d-4386-b6bb-45fdaa95b383", "comment": "Malware payload (Smoke Loader)", "value": "224f8753dc51e988d032b0e691b5be6bf2fb7295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696762948, "uuid": "c6777cf4-0706-41ac-9df2-a06296b7de3a", "comment": "Malware payload (Smoke Loader)", "value": "1f8311dd017d68a6fb3cc22ab25b39c6213d9eb969b327bbc3c1e3d513addb95a651b3d03060df28f5d3ea97975bd3e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762948, "uuid": "cb6010e0-219f-4d45-84ed-465d577e4060", "value": "T12B548E02A3E1AC21E5264E329E2DD1E4663EFDA1CDE9779B33587F1F08711E1C662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762948, "uuid": "2a468448-fffc-4aee-a19b-b7830447596c", "value": "58b4037134287758faa5dc792dc5432b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762948, "uuid": "549ca644-58bd-4d4b-b71e-dc3bf1124075", "value": "3072:KcSqvr6krxBWX0I/ehSK/cJn0Bff/cKgwXbOTRse50qYQKSc/a9:8qveMWEuehSK/cJAXVXbOB5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696762948, "uuid": "7a35ab44-8813-427a-9cc4-da49c32d041c", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696762948, "uuid": "31bec941-e571-48c7-9d4b-11081b0e271b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696762948, "uuid": "9bd92c41-a028-4702-97bf-d51ce3dcd17b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf31e211-65d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696769209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769209, "uuid": "7a2ec567-f522-4139-ab6c-e822decfad20", "comment": "Malware payload (Tofsee)", "value": "d1de288c58de023e8aad492868da3b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769209, "uuid": "ebefbd83-6b77-4945-a967-ed973268fde4", "comment": "Malware payload (Tofsee)", "value": "ead20c77e005c89bcc2a699892caa8775d7a7aa2c15d5170fd3d4b783f8f3ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769209, "uuid": "7bb51a15-4dd2-47dd-8511-a271b0cd66a8", "comment": "Malware payload (Tofsee)", "value": "530d8675705fee02d103c076706585f8f7a97de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696769209, "uuid": "1f2ddcd2-3cb2-4b48-881a-2e9ae5fbe2fb", "comment": "Malware payload (Tofsee)", "value": "e97efce4c69aaa84824ba31f8e6acabd443d35695500d5d43e17b90eea499f12173ebda9a42b049f7b03e8b4fc59f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769209, "uuid": "2e0f310d-1818-43b5-94e0-766e98b68745", "value": "T1B9547E1263A1BC21E5268B329D2DD1A5772EFCA18EE8779B33187F2F04711E1D572B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769209, "uuid": "d97b8f21-ae88-4b11-9baa-c6723bf159b2", "value": "063991b36ce5c55cb08604d3f2a50255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769209, "uuid": "dad7c07d-c752-4cea-8316-228ae858aa97", "value": "3072:FcSalqHSwBWbacDEgFAdpW1Z8AZLJDAM/a9:taYlWeeEucpCZZZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696769209, "uuid": "a00387df-d04d-4fc7-b34d-acf3746d575c", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696769209, "uuid": "f4270e96-0834-4b30-9c07-ffab40a720ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696769209, "uuid": "2e25ece0-f31a-403f-80bd-06ac52f49aae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaddd63-6628-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696803648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803648, "uuid": "07ece008-bca2-41d9-82ea-ea1580a4bc06", "comment": "Malware payload (IRATA)", "value": "95c7d1c7f920fe94e8f1904772601bc0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803648, "uuid": "0ff6064a-79ee-4d09-aa2f-5b60eec43775", "comment": "Malware payload (IRATA)", "value": "ec09764fb54e9aebeecd787011193ef601ff65ff07d3dd74386a3e8282d029d0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803648, "uuid": "02838526-d286-4015-afba-1521ed210a1a", "comment": "Malware payload (IRATA)", "value": "896ee97b35b65c438a2c736209110caad550e7d3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696803648, "uuid": "659d2826-bb0c-4977-9a60-e42a035efecc", "comment": "Malware payload (IRATA)", "value": "e66549a07f877aec3bc4488633c09537576528b69b25572f195da42058f1d7063ddc005a006b606eefa9e996912362ab", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803648, "uuid": "f9e200d8-c55e-4ae7-9fbf-4f1e2b64d3e3", "value": "T1F6A53347F6244832CEFF97315529824198BA3C615B63C78E6A21F7BC46B3BF4DB46280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803648, "uuid": "e72c5c6c-44f6-4ad9-ad4e-415ed1cf732c", "value": "49152:AE+T6UdmGdtXtjB0SZLn+gWhEk+xU/oMHpBjXKBznHZDP9FF3Dcq7bA:ALTzdmGdFtjVL+gWhEkyU/okBTkn5LLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696803648, "uuid": "450e9ad3-6fa6-4d2a-89d0-1561ee4f4ee8", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696803648, "uuid": "982de317-75fe-4e49-a3ae-8631bfab8bf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696803648, "uuid": "43fa2b52-a704-4dea-ae38-b5cf9f296beb", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed715ec1-65b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753824, "uuid": "9a236854-7e73-4218-90da-c6f8ddb991ef", "comment": "Malware payload (Mirai)", "value": "b124f1318683fa44f778b271a241b038", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753824, "uuid": "8f43dad6-460d-42e9-974c-3087cea7e1b0", "comment": "Malware payload (Mirai)", "value": "ec23f13594a87c646f58850df65da8c94c77bdbde2a226efc1df4afc63cabed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753824, "uuid": "d8507439-570a-43d3-8898-b4095220a90f", "comment": "Malware payload (Mirai)", "value": "9ee843537e8f23fd3a93b3b1f2bda7535a430cdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753824, "uuid": "e9c3441c-808d-4ea5-84c8-410e15a2e023", "comment": "Malware payload (Mirai)", "value": "157b9fc9140e835c00b433b5cfa56bc1bb7938e27da335bdb27665d361abef3ff33c324ebcc88b27e0e12cee733c3f9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753824, "uuid": "bc485b81-7af0-4862-84a3-63b837acfe2d", "value": "T1CFD2E1114A8D5C9BF2B5D43E8AFCD35B07720AB8D7DA232234644A7CF9D208A41FD796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753824, "uuid": "6e50aa68-97ad-4dc0-abbf-5545652f1441", "value": "768:hsRovSdgUHiX0SQzwbVQyzxj/Wb2RQ4FCJs3Uozf:WiuD60SQzwbVQyzpWCPzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753824, "uuid": "85cd982f-c220-4992-bd5a-7391db555f5c", "value": 29972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753824, "uuid": "28e21e73-d19c-4d31-957e-d01bbc4ae68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753824, "uuid": "beb60c13-b4de-47c0-8681-5f59fc4147b2", "value": "b124f1318683fa44f778b271a241b038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6002ca05-658d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696736837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736837, "uuid": "1e70daf8-9692-44b6-88f7-0c09a13daf25", "comment": "Malware payload (Mirai)", "value": "ab421b02630e731916ce6628ebbbb54e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736837, "uuid": "ab10fcf9-e30c-41ef-9d85-c9fba21d4974", "comment": "Malware payload (Mirai)", "value": "ed1aad22129c66ebfc83eec87608b498da99dd580fb95ae85cfbb6f97a377b2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736837, "uuid": "6c890c1b-24ba-4f10-91b7-9a05693baa4a", "comment": "Malware payload (Mirai)", "value": "a25fee8719dfd16319610a2f192217c7d9f58dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696736837, "uuid": "d5d69e51-cac8-4de3-891c-9b366eae1e3c", "comment": "Malware payload (Mirai)", "value": "0ca802e1ee41fe41c5d16b916f5ff978120f117af12d329bfb46f95554ec41f414e72841d6cf5b6276721b1fb3a0c814", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736837, "uuid": "c594945b-9991-4dc7-91dd-4efc09062729", "value": "T1D3D30945FC405B23C6D612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736837, "uuid": "fdacf2ac-ab55-4d61-b5ac-f1353996bd06", "value": "1536:EHQeHIjFlPz/rUwQsl/lFcAPWZf4VTyqsTgDdw4vb7u2/IIdWl1k9wyw2FR4soWt:EHQezwQ+9FcT4YZMDdw4dAIcIFibm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696736837, "uuid": "98febb74-1890-4975-896e-c26d716bf686", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696736837, "uuid": "ab4c7545-0fee-4224-93d6-b60c407d10c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696736837, "uuid": "e13c9757-53eb-4939-b72c-7d9bd42d70f6", "value": "ab421b02630e731916ce6628ebbbb54e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43620618-65cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696763847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763847, "uuid": "0f063b43-40e1-4383-b106-1bd4a7b1772d", "comment": "Malware payload (RedLineStealer)", "value": "8a1adc510fa96e48c8274255a0145917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763847, "uuid": "d3627711-1a38-4891-a52d-20c22e3e050e", "comment": "Malware payload (RedLineStealer)", "value": "ed96c9649afe2141b7b7fe413f96f0206cbe20003e5f94ce0383f085502ea49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763847, "uuid": "652ca1a8-32e6-4486-bca3-0030244222f2", "comment": "Malware payload (RedLineStealer)", "value": "f6f3b0feee7313db0f880f775ccedec94514ddc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696763847, "uuid": "8317be7f-92c7-460b-80c7-a3949eb28fc9", "comment": "Malware payload (RedLineStealer)", "value": "dc5f01073e10b09cbe89847da6fa30818bd0a3d74b9bc7912ef800e62f72e58ae82eb03c0e2ab34bd65f4b62a095b725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763847, "uuid": "549c036a-9002-47f6-be76-def67304aa1f", "value": "T149452312E7C55423EC71237129FA13830B39BCF199B492575A61EC3E0D73A51EA3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763847, "uuid": "3baea0d1-4d38-46d7-b1b1-f562c8eb1311", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763847, "uuid": "7df15c99-ec90-4cb6-bc92-d5aa5cf34fe5", "value": "24576:YymJnb1nTBLutMb6QxCSUO6PxnOR/Z+kDuKeQyvCpHyFP:fWnb1ns2hr6Pxn2/Z+kDrZyvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696763847, "uuid": "94af1a3e-3f1d-491e-bfad-b308af41efbc", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696763847, "uuid": "b446b1eb-6c26-4f01-a999-acde7ed19a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696763847, "uuid": "ffe17322-d474-4a6d-b39a-756b797546a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e5f28e-65fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696783950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783950, "uuid": "6cb053e1-6b23-4c9e-8fc6-379ea53798eb", "comment": "Malware payload (Mirai)", "value": "f4a42304ea932deb48a15867906f1aed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783950, "uuid": "3b828eb7-959a-4257-8c61-b3938ebd92c1", "comment": "Malware payload (Mirai)", "value": "f0d56f48ab4ee6015bc63bf4805b7ffd4ebe4dd7165aa4a6e964cb6449dbc374", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783950, "uuid": "c6892ae3-1c2f-42f2-a1a2-23b5cdf03e48", "comment": "Malware payload (Mirai)", "value": "4ed9dcd17054b605039cba1be8c09b2623c0b109", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696783950, "uuid": "acfb9e54-98a9-4d02-b24b-7c99b7dce971", "comment": "Malware payload (Mirai)", "value": "43ceccbd60955bd994a77fd49dfa2a1774fb31dbd9edcd1985b446deeb9b1a7cbddc60604486586c3488907d02c3943f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783950, "uuid": "c3758134-d652-43bf-be82-4c0ac4694406", "value": "T1D0E30A56F8819B12D5C311BAFE1E124E37131B78E3DE72029D246F657B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783950, "uuid": "5c771e8f-cb87-459f-a782-ebd0d25ad047", "value": "3072:oBAXzTU9Lg50hXV8lBw4a3BVCU1/BMCVYrrPNDqR:EAXX+L7hXqlBdaRRcYYrrPNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696783950, "uuid": "2c658d9d-87fc-428b-a5f9-da091bb5578c", "value": 156476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696783950, "uuid": "55f4bb4c-389c-418e-8bee-13caa48ddb68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696783950, "uuid": "cb7748ce-1b45-4f80-b7c0-8f03269c3f31", "value": "skyljne.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00bbd41-659d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696743843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696743843, "uuid": "f9233b88-9312-4969-9aa7-17a43c739b80", "comment": "Malware payload (Smoke Loader)", "value": "84ecfcc95a4c76f5e4c96e26c2fbf851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696743843, "uuid": "57767fb7-ad74-4614-a48b-38f1b865391e", "comment": "Malware payload (Smoke Loader)", "value": "f1e65ef292a881bcd0b8bb82bc9f386cf78195ad04a4c139b55f359a5aa1f0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696743843, "uuid": "da7f5859-6984-4099-8743-ece332fb98e7", "comment": "Malware payload (Smoke Loader)", "value": "7d6d36af2f808dc95c6c5b319999a405db4323ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696743843, "uuid": "fdf1f927-019f-4798-b7c0-0ea2b9f19edb", "comment": "Malware payload (Smoke Loader)", "value": "85ead162e1a728a6088b2b61e690d60c3672d1a786f349bd7c03da83d5c28fb54565fdd78d1842e4bc8f919e590c74e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696743843, "uuid": "bb420ce4-af4a-4403-b662-4a1fc1c1f8ed", "value": "T1FB547E43A3A0AC71E5665A325E2EC1E9772EFC92CE19679B33147F1F08710E1D663B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696743843, "uuid": "362a0472-0149-4b51-9446-d54fcf567b6f", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696743843, "uuid": "fdc2fa37-4e96-40a2-b32b-e5f4ec3b8598", "value": "3072:S7auSyfIJ1WPKgorWpsneXKjN4O4xP69c+o2345Oln7kRI84E:SGujaWCVr6XKqOgwNg87ku8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696743843, "uuid": "724fa6c3-46e2-4044-a3a1-d2dee550cbf6", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696743843, "uuid": "5527f0ed-cd78-401b-8a9b-edd2b3224664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696743843, "uuid": "b399bf5d-3f71-4846-af5d-7a8c47e31c3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341f33bb-65ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696750507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750507, "uuid": "45cdba1d-9f45-4a99-9fd0-783858836ba7", "comment": "Malware payload (RedLineStealer)", "value": "c23f9e3dd9ff15e85f19b5aa4005ee9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750507, "uuid": "65ef2268-8c86-4939-8b74-1eff529cc912", "comment": "Malware payload (RedLineStealer)", "value": "f1fe88116edbc6e8e2947c1db46bcd155ede1509d2fff76ece83cdb34439a4a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750507, "uuid": "22d573da-4e2c-4ff8-b340-550dab267acf", "comment": "Malware payload (RedLineStealer)", "value": "5f935b17e9f252e6f476d2e3f49a565a992dd150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696750507, "uuid": "0d651e72-40af-4f5f-9530-ffbd605b66e4", "comment": "Malware payload (RedLineStealer)", "value": "6ee35eb6088cacb018de05641574e8bd2936c50361fafc8350e3c36364d4432952cd8be3f38efd5c885cc7cfef21ab2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750507, "uuid": "24104eb7-c290-4e81-a39c-73b458386cd1", "value": "T1F7352356ABE40932E6B4377055FA03930E397DA4DC3843FF2AA65C890C72385747A77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750507, "uuid": "ea5458f2-eef6-4e3b-9260-4cb4ae374a98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750507, "uuid": "f3af0afa-2f25-4403-8ab6-ab5e7158dcfd", "value": "24576:DyQknmWoaH89EPLQxJBi+rVUyVfMk1Db1ovwR/jR:WD0+8Vi+rV10sdR/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696750507, "uuid": "06a986a6-7afb-46aa-90ee-63e0d05b963b", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696750507, "uuid": "2b851658-0bf4-4966-8648-f11d4f279f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696750507, "uuid": "4343bbfd-c63e-4f08-8cf4-8286d6582e05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ba8cf2-657a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696728637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728637, "uuid": "4584d67d-dcd2-40ec-8ce2-3c9e042fd70d", "comment": "Malware payload", "value": "7c118e71370c611654aa56050cfed046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728637, "uuid": "713596ce-f54a-4971-b2a2-2caa9e6e8f03", "comment": "Malware payload", "value": "f24d2e4001bfb78adf27b9dd028cdedc0e81ca00d1093521d374a2ea4b36e978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728637, "uuid": "c2ef31bb-bee0-4742-9b93-0fb8ecde7422", "comment": "Malware payload", "value": "ff3150b3c810ff440118d3b24388acec0e83eeed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696728637, "uuid": "d707a76c-ca91-4965-a572-afb566faea96", "comment": "Malware payload", "value": "281dbeb737d2f45ab87f22be40a902a5f54b497bdcddbd7f65b978d47ad071b3f650260d6c2ac10afdfd9058bb61b120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728637, "uuid": "d5f4c530-23f7-4d0d-8a73-55ec44c64df8", "value": "T1AF8533155EE953A3DE42E8BC4E32600792623322E8940E5255FE3A75B68F7C1793CF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728637, "uuid": "5e8104cf-f0f2-4b0e-92a5-b96e928aca0d", "value": "10f1bd31eb864aa4f02738deca4b5815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728637, "uuid": "53e01a12-02ee-4386-935d-6d2970f632ef", "value": "49152:deZg2iuRJhQkI8qznrJTZTErDdj6lQyjf6XRvVykf:eJiuRJhAnnrZVqeBOXRlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696728637, "uuid": "0104bf55-3793-4cbd-b9ca-dba1d54a03ff", "value": 1823456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696728637, "uuid": "efa2a717-cf93-46b3-bce7-e73e81e5ac83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696728637, "uuid": "4c02f016-6107-4778-90c4-d92f753c7ab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775893df-6583-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696732581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732581, "uuid": "194b6fe6-bd89-4a85-8a72-9e388dc6099c", "comment": "Malware payload (Smoke Loader)", "value": "38fdc1b9e75e4bc4ac47e8a595443108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732581, "uuid": "bdd94b32-a829-4b55-b80c-4b891b4038bd", "comment": "Malware payload (Smoke Loader)", "value": "f24d91ea2d2167918e32dcf65495af793981b103eb6c908ed51dffb42c76b3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732581, "uuid": "5fbce6d2-5375-40b5-b8f1-c57cff846f1b", "comment": "Malware payload (Smoke Loader)", "value": "0e755af10850f03cacec8f46f2c46c5783280b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696732581, "uuid": "d233cbeb-380e-4cd6-a4da-b328268b10f0", "comment": "Malware payload (Smoke Loader)", "value": "a1e115d764d74d9368cbae0f865bb3971dbbff62134baaa8940874e5b611afb158c73c970cfb89dfe0f449cf1a8c146c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732581, "uuid": "b531170f-270b-4e5c-8ac3-87e960ccc50c", "value": "T1BA547D13A3A1BC71E4264B325E29C1E4772EFCA1CE68679633587F2F48711E1D662B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732581, "uuid": "e00b72e5-8458-4db9-a506-cb335adce861", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732581, "uuid": "f145f447-7c4c-4cae-a8c0-9f747ed3f1dd", "value": "3072:naG5S/op1WWKgoUsjwx1/JFXhT/JNvVUYVHx+A7oCIi4Z:aGc6WZVU+wx1/JthT/jvVUYC06i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696732581, "uuid": "ef46f978-5c6f-4265-8c0f-0fbaf9ca31c8", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696732581, "uuid": "a9965f78-6867-4c63-a61d-85ed535684b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696732581, "uuid": "563afc11-c91b-48ea-af7d-4f4137bf6e84", "value": "SecuriteInfo.com.Trojan.Siggen21.37167.15858.16479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d093d2bf-6633-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808322, "uuid": "1f024a49-6050-4239-b43a-669a185c5ff5", "comment": "Malware payload", "value": "8fd84942190cf91e2182d552b3df80f8", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808322, "uuid": "b6a5ff4c-527e-48ef-94e0-649767df9a1f", "comment": "Malware payload", "value": "f31d4be2ed36280868ff07df2eea5b9f5367784c2bbc273690233523a1b0e3f7", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808322, "uuid": "21df6a7e-1274-4c78-90cf-0d674ee4f5b5", "comment": "Malware payload", "value": "9824aac5311f8977114274f33679979f76be2e65", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808322, "uuid": "d6edf707-05af-444f-a0c7-dc82936fa9fc", "comment": "Malware payload", "value": "fec9ef9ebee372dc4afbbb4a61bc670747fedc5538a63ff6c12f2fa85204aa2e0d0393d8042cc90f6e0710f33c218819", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808322, "uuid": "17f85803-14a2-4146-91fc-627c9ff5a550", "value": "T17FB1B70587E84336F8B34B32AD73524157B5F720D8368B2F38C6190B6D276148923F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808322, "uuid": "8b07eae2-3d95-4646-8513-f7f00aa74146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808322, "uuid": "fe6d5c58-19ab-4607-a6b0-65837742e1bf", "value": "48:6ZRd8ZnyEh/6NMalLcJ7EyiQ/7qIt7ezZqwIqWhLpF1L/A4Is2oepfbNtm:W8DulLchEyZ/7yxd4rizNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808322, "uuid": "65609ec9-503e-4a88-89b0-cf513d10d0e6", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808322, "uuid": "37191c2e-c85f-4326-894a-6fe3dced1770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808322, "uuid": "edb1dcf6-47c5-4a19-8706-70f451c8959f", "value": "allergy list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69978121-65ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696756180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756180, "uuid": "9c356861-576d-440f-b9a5-39fa22c1e95a", "comment": "Malware payload (Tofsee)", "value": "c5a29b2ac13e9b724ead74514c65eb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756180, "uuid": "95a3c3ff-11f0-48b3-a278-bac1055b926b", "comment": "Malware payload (Tofsee)", "value": "f36163041b9be37f71e3196b12bc3e372bd05a10f189ce4348acce5a72cbeb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756180, "uuid": "1367f0ee-0c12-450b-9772-137ba4d43f70", "comment": "Malware payload (Tofsee)", "value": "e6d5d64bd2e48758a14944b1e8eb5bff037fb719", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696756180, "uuid": "cf62fdcc-67e4-4f94-8703-751c0e02a306", "comment": "Malware payload (Tofsee)", "value": "2affaa77abfd838fc34278fe7b49e41e155965c7ac8248e9b848457d438665f2f2d41463cbde1122bd0cbd6a25754055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756180, "uuid": "8d53afd2-9d85-47c3-b80a-a57db1cddc94", "value": "T1D8548E02A3A0AC61E5268B329E2DD1A5373EFCA1DEE9779B33187F1F04711D1D662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756180, "uuid": "0e3e40e1-7150-44bb-ac63-ef96f61ed384", "value": "99d7d9dbac9e758617de32e3b7e0aa88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756180, "uuid": "b499e54b-714d-4e8e-a7c5-a890a3cd2b4f", "value": "3072:NHDgofgIyBl/1WHjg89OAYBuTlKKKzGRwuE12ZAOziEStT+lZE/wzFdQvHpIH/a9:FhI5dWDJ9OA5sGRwuE1Czi1t+ZzFm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696756180, "uuid": "91e027c2-0d57-47dd-b535-1806157670e7", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696756180, "uuid": "c31d35cd-5d00-4a6e-a8dc-4b3946035cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696756180, "uuid": "e93eccd9-34b9-4265-9ef8-45d779503d6d", "value": "c5a29b2ac13e9b724ead74514c65eb64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3598cc1a-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773702, "uuid": "9f1cffbe-973b-4d3f-8924-7271a6badc59", "comment": "Malware payload (Mirai)", "value": "f4591fe71773cc49af74b8238d3ba051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773702, "uuid": "9b00a527-84dd-408c-91fe-87baa2ba6446", "comment": "Malware payload (Mirai)", "value": "f552c0f10c63ce08dcfcb8d423f0a53c840d4db0723cdbeb1c7a59f1b8b97664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773702, "uuid": "244c0f66-d812-4f11-8710-27301ba76bb8", "comment": "Malware payload (Mirai)", "value": "16898d6c982cb646f5247c589ec8f1a176f9e9de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773702, "uuid": "0e7604bf-7048-4ce9-a24c-4ce954593919", "comment": "Malware payload (Mirai)", "value": "299d244aab62f72e3264d819f741d546168d48ab91ab6a6c7f681e49a156876ed7deaff20f2ce0ed0742e5afe3a8c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773702, "uuid": "b4c9e24f-1199-49ac-b0cc-79c6ad95b8a4", "value": "T10E53E582BC40A629C7C04777EE6F509E3311A7DDD0EA3742DC250BA47A9AD0F4D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773702, "uuid": "241ae365-a601-4c97-8e6d-94581fbb62ea", "value": "768:urzym4B/1vhcZ4fJq0GnD7O2xrdA+mNNr/o1icy0uiDz701T1fj7NSqtUut65aQE:5FB/TRftGnvRxrGDrtcB8t46Dm8Q5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773702, "uuid": "ad40dc5c-ed46-4212-8615-a94f6977e342", "value": 61208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773702, "uuid": "f72e3294-725d-4808-bc35-2887e41e33e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773702, "uuid": "180600b8-2881-4e3f-b1c8-7c43994b8f24", "value": "f4591fe71773cc49af74b8238d3ba051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9cf332a-65f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696779991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779991, "uuid": "276dc8fb-3d31-4611-8729-4ddd69aabbd8", "comment": "Malware payload (Formbook)", "value": "f6328880dcf017c12d46c41f4894ee7e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779991, "uuid": "e31e11c5-f5b4-4880-ae82-9be5b5f023e2", "comment": "Malware payload (Formbook)", "value": "f6d7139261fa6e4b9c7b204b0a55af5d2c3a41fcfe7ae0dbb49f8d7ce45bf387", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779991, "uuid": "9d90770d-755b-4184-b1b3-c83b8be060a4", "comment": "Malware payload (Formbook)", "value": "89273321198b7219b3b7f74377f1269de18f6355", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696779991, "uuid": "c46e523e-3f9b-47c3-a7d4-5175630c12ba", "comment": "Malware payload (Formbook)", "value": "3fa3a0506c1dfeafc55ea4d77f01e5c09f96de99aec2ad3a4149df1098f6e8e8fed536729819651731e29f6f81895e57", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779991, "uuid": "5875b327-d7b9-4a4b-a7d6-2b1a66f3b19e", "value": "T17E151202BAC25872C4732D325A757B21BA3DB9201FA5CEDFA3D4492CDA315C1D731BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779991, "uuid": "2ab22798-25c3-4c65-b563-289557a5c943", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779991, "uuid": "878a6a0a-7b3c-4ce9-873e-824590e36b78", "value": "24576:NTbBv5rUandnNrCCEX8FlaUFGa6mPcyGJzQfs8FiNGVDmh:HBjdndCCVFl4oGBQfoo6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696779991, "uuid": "26b7664a-635c-4733-b089-f047d9b7dda4", "value": 933807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696779991, "uuid": "908cd119-6976-494b-a0e1-69976b8da35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696779991, "uuid": "312aece6-a30f-4cb4-95d0-e0232f68eddb", "value": "DHL-071023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13525fa5-6626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696802421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802421, "uuid": "a9966c29-6f47-4917-972d-ac6f361bfca9", "comment": "Malware payload (Mirai)", "value": "78d675e6acf59903fc1a477838a6889c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802421, "uuid": "bf8e6747-df5a-42ab-9495-9949e9e48faf", "comment": "Malware payload (Mirai)", "value": "f7894468b064651dad72231a5dfabd0c37017c1d7556f90acd7fe1196ce859c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802421, "uuid": "fc5bb9ce-b29e-4478-a9a7-76a2dccd95fb", "comment": "Malware payload (Mirai)", "value": "690c0603e99cf3fa2e9084f9d5dafe5505a72d50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802421, "uuid": "15b9ee63-dfb8-451c-8f6b-a9a5a941dced", "comment": "Malware payload (Mirai)", "value": "dc9302d793b163b8f792d34e0538f2b64fbd9473b18b323da6f9c82e03e97b89c287f03476b681aadcd68ca9f69ba007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802421, "uuid": "65aa4409-ee54-4532-be29-f9aa8f759da3", "value": "T1EAD33A46FA818F03C4D5177ABAEF414533239B64E3DB730699285FB83F8669E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802421, "uuid": "0626e5d3-f506-4f36-9496-fc5d756fa3a2", "value": "3072:fEXNFLARLyT3XnSpw4yibkqWqd5wCKT9yCHb3M/9izDD:MXNF0lye/yqkqWqd5LKgCHzM/9wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696802421, "uuid": "1066eb92-6e08-4fbd-bd3b-496dd13ae526", "value": 130772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696802421, "uuid": "fc99d6bc-53ef-4477-a3f0-c38425cc6e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802421, "uuid": "18b14f4a-766e-4433-86ae-5b2c1d051eb4", "value": "78d675e6acf59903fc1a477838a6889c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecee0a4-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696808534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808534, "uuid": "51efc89e-7319-490c-81de-a374ba84cab7", "comment": "Malware payload", "value": "1533265f58b0e4cf527ded9e1b06920a", "object_relation": "md5", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808534, "uuid": "a1d5159e-05c5-4d53-8119-fe523d2be807", "comment": "Malware payload", "value": "f7ddaca98fc31549da88eb647b5905a895163dd426a06a4dc672ab829c74d225", "object_relation": "sha256", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808534, "uuid": "3d5d230f-9ec8-46ea-a964-f74119ee30fc", "comment": "Malware payload", "value": "aa9123b7c8437cc67e745b8dd579d30c62ad5b86", "object_relation": "sha1", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808534, "uuid": "5ec51c16-69de-40e1-97e5-ef4201e56771", "comment": "Malware payload", "value": "ddd86f6a9b13b01382794c004db854bb384c6db0afaae1741dc2e5966b4958d94bd40812b2275b34e6e2c701ec956535", "object_relation": "sha3-384", "Tag": [ { "name": "hackdev-ciaffa-net", "colour": "#07FF15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808534, "uuid": "7c4e51d8-37d4-47b0-bdf2-b6ba3bddec03", "value": "T1E221BE3264C10521E077B1A49ECF1008214A8147B09CDB4CB8DCE7998F1656DE9DEBDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808534, "uuid": "cb41f85f-6037-4936-8e95-a65768890c8c", "value": "24:IQ4DqO8bX55lzGxQj7Ma5lz8/QWuya2iwyjuiezY9Tr663yxjeJwb+e:Iuvp5ZBB5Z8OqiwyCuX6djee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808534, "uuid": "2982a825-8b0e-424f-bb7c-5ff77b372756", "value": 1215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808534, "uuid": "ff7bff06-5395-4da1-a10f-442e8bde8cc3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808534, "uuid": "5357b986-54a8-4198-bb23-b0e82e8abeb8", "value": "Steal_Doc-v1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b1afbd-6634-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696808488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808488, "uuid": "51e376ab-f885-41e8-be44-c84cca9b1b9c", "comment": "Malware payload (Stealc)", "value": "a5037fff57b72e317e15e24d07a139bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808488, "uuid": "3aef5be5-936b-487b-b14f-67ff6ca34bf7", "comment": "Malware payload (Stealc)", "value": "f87bf84d827a8c598954639c1207c5e721ab5cc6b7a62e5a3c0a57b5a355cfd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808488, "uuid": "0c4f627e-dabd-4a5a-a678-69c12b2ffaf1", "comment": "Malware payload (Stealc)", "value": "9e815fe9ea080579a243037ef0dc5763aed11f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696808488, "uuid": "dce60798-522c-43f0-8d3b-857f884fbf53", "comment": "Malware payload (Stealc)", "value": "356a3a1a7ec6cdd43f48dc546edf3742a9729bb5d4045d558c8c6041f63e38ea79be4512e00fcab9d75819383574ba08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808488, "uuid": "75a721a3-9e48-4653-845d-dab33213a68d", "value": "T1F4546D03A3A17C61E5268F329E2ED5A4773EFD91CEE9779A32246F1F04701A1C662713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808488, "uuid": "0ce02e26-b2bb-4533-8972-fd2050580ac3", "value": "9d37df760655c3ef5d6cbf6ba5a52e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808488, "uuid": "1733d04b-5bcb-4007-8791-33750d3516ff", "value": "3072:bnhodI4g6FeM6fxu+HY1UxQydYtCt/qmSTYnQu8L84K/aT:FoDtFeM6flHD9dGnTYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696808488, "uuid": "04f5fad8-dd2d-4eb2-a67e-dd916d035495", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696808488, "uuid": "9afa1b1d-4776-4749-9d25-e090b3590a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696808488, "uuid": "69249375-90d6-436d-b827-c14ff8654061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f22e3e7-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773691, "uuid": "6c71258b-29a2-4c93-a35a-5b9a0159b7af", "comment": "Malware payload (Mirai)", "value": "cd11ba67c7558cbd34b5bfcb0a69dda5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773691, "uuid": "1616faa4-95bd-4a00-ab24-a38f855d685e", "comment": "Malware payload (Mirai)", "value": "f886c28422526d3a0d438d9ff1c35fcee88a14cd39bf3e4c88a8061017289c8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773691, "uuid": "6ae701d1-5daa-4d6b-bdc1-f5c600d640e1", "comment": "Malware payload (Mirai)", "value": "27b7159505d62146057ee0de5da83c32eab1f49e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773691, "uuid": "9d9d4b7a-2fcf-4b0b-ba23-2f0745ae29c4", "comment": "Malware payload (Mirai)", "value": "15a45b7dbd5c6fa03bf167f1bebbe0687b9abacc50594a20ad4c1932f0f162b2d5759d88b0da4137b623424c625bd4c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773691, "uuid": "70cf0397-1f5a-433f-a2ee-505c6bdc1f1c", "value": "T171632AD9B401AFBCF99BEAF941160A0DF421A25460930F27B32BEE937D710E1DD46D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773691, "uuid": "91d27894-495e-457a-bd20-5eae2099b835", "value": "1536:dTg9OuTOmUDIeAXgp/rOAyaJWu3ztKev/8Gd:WymUDIe+gNrh5E+KOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773691, "uuid": "77c0f645-0574-4975-9a4e-ac380c4913f7", "value": 67228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773691, "uuid": "5a79db8d-e645-49f9-a705-dd5d540317b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773691, "uuid": "2239270b-6bc4-40ab-aa8a-588290f246a5", "value": "cd11ba67c7558cbd34b5bfcb0a69dda5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caaad2b-660e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696792156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792156, "uuid": "38ccbbd6-4bd9-4745-a4b7-fe9119b7b80f", "comment": "Malware payload (RaccoonStealer)", "value": "ad6e31d84033da3efe4c9f14fa0af9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792156, "uuid": "efc2453c-c57c-4b09-a8cb-815b8d3f07e6", "comment": "Malware payload (RaccoonStealer)", "value": "f8d3db5f1e0853a50a59ae70fce7826d0529e88c913be21cce5098772581dbf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792156, "uuid": "7c13dd72-6d0d-422e-b77a-0ad5134f953f", "comment": "Malware payload (RaccoonStealer)", "value": "d2adefd5460f6c3df6eaed77c7c6276ee33a8a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696792156, "uuid": "9f802037-c69d-472e-b01a-2f6af453dec2", "comment": "Malware payload (RaccoonStealer)", "value": "0916181951761c83d14348c878d249f73b12cdc8f25d16c63d1dfdef0f3e1ac421cf316390b45bbb712052704e7a4b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792156, "uuid": "1b176285-b2e6-4d35-8840-f16fdc030e9f", "value": "T169266B53B2842E3ED05B0A3A4837A654993BBB21365A8D9B57F40C4CDF39580FE3B647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792156, "uuid": "6dbde851-9fe2-4f94-8097-56bf47a69c5e", "value": "d32ac74ff74175a30930b71116dcf55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792156, "uuid": "abbb5c13-62b4-421f-b107-443a59b409ba", "value": "49152:5NC9GaJlrM5JPZ/qyPFlmVM97HmPOSt5J+iXKFF/bu0qPfHdWxWAseHPKT8m5hVC:5Q9GQgliiRbu0qX0xWAlydfrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696792156, "uuid": "1707ecf7-24bb-4fe9-8a76-09cdb1fbbcc6", "value": 4425216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696792156, "uuid": "a84e51d1-2714-464e-b6c0-f3e82c0c0113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696792156, "uuid": "27f38823-31c3-4004-a315-99645f5e9621", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef163c5b-6611-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696793770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793770, "uuid": "0d938f85-9385-452b-97a3-a8ecb6565e0d", "comment": "Malware payload", "value": "0d3ed2791a6e2ad8e234c18b1a375c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793770, "uuid": "337f58d4-e1f4-496f-b926-3a7f70e510b0", "comment": "Malware payload", "value": "f9bd05615cea543cda53214f0f112d05ecbb397f0736bc5ebc3d0770bf605c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793770, "uuid": "f7bca8aa-75e0-4c04-8e75-ebb988d76f47", "comment": "Malware payload", "value": "15acab2b63f142140ec0e91383d5a2ae62dd76b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696793770, "uuid": "2eeabd96-6ad3-4eb4-a0aa-29be67fc774c", "comment": "Malware payload", "value": "cf9d8bb5d2f85d0ff451f220ff7e46794abbac8ec0f945b5f9e67a0f69e2613f75d6f874398c3653b98a2b0a320655ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793770, "uuid": "41139b27-dacc-4348-abcb-ad83127d59b2", "value": "T1DC9623218782C6A9EC8139FD74F5817EB235EE5429118703A3717A9ADD306B3FEA311D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793770, "uuid": "2b6ff014-4796-4387-bd68-4b9149ae7db3", "value": "1fe829430464ebe56df95e0914ffca40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793770, "uuid": "156b6d75-fb73-40e5-bd03-2396751332a6", "value": "196608:9N2DUn9I5Czm6d84WQVRZXCyP7liDMS2LveYPQu2lc6+t:9N2DHkO4LSyPphtDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696793770, "uuid": "daf0c373-eb36-4a15-836c-f9372a62f67d", "value": 9276596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696793770, "uuid": "81ec0c2e-e8b9-4b6a-9fd2-2c107d8d1592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696793770, "uuid": "60f24ec1-4901-48bc-82fd-4678955fb3ee", "value": "SecuriteInfo.com.Backdoor.Java.14274.416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df763bb0-6626-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696802763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802763, "uuid": "4e4165cb-1cec-4c53-b53b-87a2ef39c738", "comment": "Malware payload (RedLineStealer)", "value": "b0cde838c20d4daab661a7d387d120ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802763, "uuid": "e0aeec5b-46cd-49bc-b1bc-5e0e14516362", "comment": "Malware payload (RedLineStealer)", "value": "fa6f5769bb137d1ed325edf5a072c67e4876f6ef455d8b8f61eef29937725312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802763, "uuid": "5e2e416d-019b-4042-9185-49b9fda5cdc1", "comment": "Malware payload (RedLineStealer)", "value": "42fc2b26191f2c7c8f6a2883901f8724e733dad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696802763, "uuid": "723c0059-3029-4abd-894e-929a48c68a0b", "comment": "Malware payload (RedLineStealer)", "value": "4a10c48880dc888e547c29102614e6cb62d76b2eec5f9d63def369d24995e8b72d7d19bd2d4cfcfe3fdda4204d773746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802763, "uuid": "3d59a7e4-e3f3-4307-bf67-615b16798682", "value": "T198452303AFDEA072DCB95BB05CF613831B353D910574D69A1796E82B1873E69B03872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802763, "uuid": "df1f7918-2d0c-4429-8340-587eaa99ec09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802763, "uuid": "90f6698b-e7b1-4d9c-b24a-e6937a010715", "value": "24576:vy75Z2dt/SX5b/DC1MnQUPosZTElEnAqIeUg/NPvFmVWW1xK1E9XIXi:67Cdt/SbOyn9TTElEANRgRvFmVWW1xKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696802763, "uuid": "7bf936a3-8a09-4787-b36d-634323bfd53b", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696802763, "uuid": "f719814d-7a25-4459-924e-e872a6457482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696802763, "uuid": "699696f8-7beb-4b67-b06f-fc748dd607d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7186d649-659e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696744167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744167, "uuid": "f8aba9e6-8a30-4069-ad35-670c8b2b9775", "comment": "Malware payload (RedLineStealer)", "value": "c5c4bd33cdd7f0240a648a63669fcbbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744167, "uuid": "c1236075-13c2-4239-8e98-eb272ed409a6", "comment": "Malware payload (RedLineStealer)", "value": "fab96630e78e30cc55197968a1d7e024d7440d2f4ed9c5c7500ed4ec995a70f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744167, "uuid": "eb315e73-7f8d-4249-95ab-0f00914b3504", "comment": "Malware payload (RedLineStealer)", "value": "80d81e55b06112c79155607df2a44ea4f6fbea11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696744167, "uuid": "ec903663-53ea-4043-8190-cf1efbebbcb2", "comment": "Malware payload (RedLineStealer)", "value": "ac383dcaa00830d6329db4571eb7d4b1b5e31f3c37d41c957a0ce366f930c4cf0e2a3bfb02f85a7d206ff9f0d00365e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744167, "uuid": "981142a3-937f-4892-81ec-4b43cc0a3478", "value": "T14E6523076BD89A27CAF157B068FB03D30A77BCB52A29D25E33424D5E5A62598703037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744167, "uuid": "547c7769-2f7c-47de-8af7-0167af323871", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744167, "uuid": "5763c65c-4d59-487c-b549-e36a3eb3d417", "value": "24576:+yojusjQpOUDhIZe7ku/TOtAiXBsQk11wm5LQXkXYfPjHB0Sna/og5w1hG:Nsc1iZeIeSt5XqmwYnTU/bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696744167, "uuid": "66dd94f0-c01d-4297-ab0b-bcb9b00e265f", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696744167, "uuid": "d4b41b23-8339-44f3-bd4e-941f217472d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696744167, "uuid": "6bb9b07e-ce70-4b3b-ac74-c410459a0b9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e350d760-65e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696775712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775712, "uuid": "e01c4eea-3aa0-4292-8db2-6409b5e57123", "comment": "Malware payload (DCRat)", "value": "07ff87bc603b0c0c0c839068aaf09f78", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775712, "uuid": "087c0ec5-005a-4e11-9da7-843807acbcb9", "comment": "Malware payload (DCRat)", "value": "faf8f7128b7208eca7740b99f169cbf0a9dc2c1d589dbbfdc4846f75406d1b6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775712, "uuid": "56c8effc-aa43-4737-8159-a3284667e4f4", "comment": "Malware payload (DCRat)", "value": "c19eb7e3dabd20ed0502d72f19d680205aafabb9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696775712, "uuid": "f0ce93f4-3640-4227-9314-161927bf894d", "comment": "Malware payload (DCRat)", "value": "923e5866305c6dea57ee0c9be59d42555e168674b63f68b10da5d4539a8eb1e482ee61235c587ada27e84205e7154c84", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775712, "uuid": "730025cc-b1a3-437d-a1bb-952916f13727", "value": "T1D7E5D0117E44CA01F1081233C3EF458557B4DE61A6A6E72B7DBA3BAE25123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775712, "uuid": "cb0e9b5a-7f22-47f8-8290-b7489b2ba826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775712, "uuid": "bd059290-60f3-491f-9a9e-597495d1ec22", "value": "98304:/M0woQggbNhWxU68v4Xi3yAbFwHTE9J/i:90gOWfackHbFJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696775712, "uuid": "6fd17d42-1992-44f9-93f3-5564bd6c9467", "value": 3171840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696775712, "uuid": "0ec69663-8ec4-4ccb-ba7d-2a7120cefb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696775712, "uuid": "25a63bd2-dfa2-4327-b52c-2dc6505133fc", "value": "07FF87BC603B0C0C0C839068AAF09F78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97649e1-65ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696778621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696778621, "uuid": "0012e490-6ca7-40f4-ad9a-d3f89044644a", "comment": "Malware payload (RedLineStealer)", "value": "e12ed379b517b6185c464e217d609fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696778621, "uuid": "6ac91a06-653b-410e-865a-97acb48ff57f", "comment": "Malware payload (RedLineStealer)", "value": "fb73bc162e1b056035923034503d83146ef1e2e4026ff43927dc46d2d255c717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696778621, "uuid": "2e104107-5e60-4200-a885-b808322cac3f", "comment": "Malware payload (RedLineStealer)", "value": "010def03da5ebb50a95f7e8635aa8aada0349c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696778621, "uuid": "32f56252-6cc3-413d-9a5f-77f7ec8bfd80", "comment": "Malware payload (RedLineStealer)", "value": "d6182876352481d5b0f355e6b8f7ce54d15ad854dd39e978fe37a25958328f181f9fbc67ccedeeb4ab323962cdfc1d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696778621, "uuid": "70b1bd3d-0529-48bb-971a-37638c132587", "value": "T13C45230277E99532DDBA67B00DF746C71A363E615C78172BA30A8A2E5CB359085313BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696778621, "uuid": "a6cac920-31e5-4be1-9759-263fd4a162e5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696778621, "uuid": "33e76471-7bb6-4ca0-a9b2-5102b71c2595", "value": "24576:Pye4SZapLtX5y6teuhFi8SyyyUbUAMx/7MxpxggPdy96zsK/pypN:ae4XLSuZFiTVfb1Mx/7MbHu6zsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696778621, "uuid": "0604418c-e753-4312-b041-9824a06f607e", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696778621, "uuid": "deca7f9a-ae49-4e04-a5ee-2296bcfb909f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696778621, "uuid": "bac4c43b-31dc-416d-bdcb-06a831095b4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424c24cd-65e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696773723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773723, "uuid": "df4f09f5-5edc-4cb3-8865-3aaf49c5b320", "comment": "Malware payload (Mirai)", "value": "363c80a1c22191802a9aae73519429cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773723, "uuid": "27c5bc6c-5e29-4a3b-939e-5b0ba8fe0088", "comment": "Malware payload (Mirai)", "value": "fb78510d0ff9692c88b39516699bdb992ca78d44a4d342e8f0c6ca107f23e9bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773723, "uuid": "a5ac90dc-77b5-485a-9baf-8299e7076ef0", "comment": "Malware payload (Mirai)", "value": "7cfaf22c314d6bf0332b1d4bda60f13f2d002ce3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696773723, "uuid": "e45c8845-22ae-4853-ad32-8fdbb8218313", "comment": "Malware payload (Mirai)", "value": "9a58542b6fc3adeaf8ec8876f423bcaf2bf804355c8f07d3cff5ae85f835b3693b743d09952f94fde0f541781d7b24e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773723, "uuid": "e959773c-445f-4bb1-bd3a-39b05f1129d6", "value": "T134732925B87A2E17C0E4927E12FB8615F2F6330E1470866D7D790F8EFF54684A90A277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773723, "uuid": "043eef95-4806-4997-ad84-d05d02ed388f", "value": "768:77s6xF6ukVDoK9UuSsPyS/iZSPz7e/+V1NK+6OajfnuaCWu1IMa8/77XqH/jFrpH:fs6IVDZfSsPrbXnqBVkR0ieLWWurC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696773723, "uuid": "7ed8cd7a-6624-4720-afc9-1e13ca369776", "value": 75112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696773723, "uuid": "5200cd55-5d8a-4062-9fb6-0ed273a4c9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696773723, "uuid": "c7a386f0-1e73-4017-95c8-3e1991eaa71f", "value": "363c80a1c22191802a9aae73519429cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d120e4e8-661f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696799733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799733, "uuid": "e323567b-77c4-48f9-b165-d9cb04d31d1e", "comment": "Malware payload", "value": "84f12cf325b3e0027b808b720c0d0235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799733, "uuid": "0bb9fc03-6cf5-4587-b9a4-86a629c9a275", "comment": "Malware payload", "value": "fba240696488aafb5ec318a14e1fc0359d5be51be372a6633d636e6a3434e8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799733, "uuid": "9f6d1b01-9127-43a6-b706-4ae909178852", "comment": "Malware payload", "value": "010b57ab675040ebf53d0b767ddc5020651b267b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696799733, "uuid": "6eaebe6a-ff4a-4356-b7b9-f756c96110ca", "comment": "Malware payload", "value": "c9b732ec4db175e0a61f9806712580055ba2c95280e9b1d1199a92ffd4e2a68a5359d5d87cb10e77cfc7d021d9563da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799733, "uuid": "3bf053c0-83a4-43a6-9e2b-4629fc66dcc6", "value": "T1E5547E03A3A16C11E52A9F328D2ED6A4772EFD91CED9779A32287F1F04711A1C672713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799733, "uuid": "0832d3c1-83c3-48fb-8ef8-9d83b34e4cb1", "value": "9d37df760655c3ef5d6cbf6ba5a52e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799733, "uuid": "8e8139fd-d6cd-48bd-bf43-edf4e5cb9bd3", "value": "3072:InhodI4g6FeMLzAm6Ip1OcatdlQfAJ1U79yLA2NTnQu8L841/aT:woDtFeMX6Ia3OBinH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696799733, "uuid": "f1988b9c-536e-4d0c-bad1-cd53d419a508", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696799733, "uuid": "a659b071-ec3f-44e8-a748-56f5f62156fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696799733, "uuid": "f0088002-76d4-4b5b-8437-481f0e43d856", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa27e9d1-656d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696723217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696723217, "uuid": "2843d7c9-220f-426a-ae00-1f70ea868ac1", "comment": "Malware payload (MysticStealer)", "value": "b925d3709231a29c1bf31564858f9037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696723217, "uuid": "0160d2f3-f9ff-4fb6-81a0-fa7255942a3b", "comment": "Malware payload (MysticStealer)", "value": "fcfe66802b5c589f61e511e51ef1fdc3d1d75d68738a9874e3417e69709a3899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696723217, "uuid": "07cbaf2a-b8d5-433d-9dc4-4cd52cdfdcac", "comment": "Malware payload (MysticStealer)", "value": "54cefd3f1571b1d4ad04e0924257dfa22377d996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696723217, "uuid": "89d5fd77-dd4b-4133-b28d-f3781f4bfbcf", "comment": "Malware payload (MysticStealer)", "value": "e6ca763d266365d3e564a01c918fff4a5019c0c0b34a464a66d21f3f20881c0bb8f99c340efa9d0b43eaa8aff1fb1456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696723217, "uuid": "12ff9cd2-15fe-4b55-80e7-cf18f6c4c4b5", "value": "T1E7652343BAD95533CAB45371DCF606430A3A7DB74D3187B72359788E0CA2AA0B57237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696723217, "uuid": "6ce77d85-b6c9-4481-8d2e-c67538d4e46d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696723217, "uuid": "b1b7e488-ba7b-457b-9d6c-f858ccfc0cb8", "value": "24576:TypLla+RH8u1t3jXa55GOVypVw/x6PxZdFATBYSwrfPaduDsWRVXPgI:mpLljR71ha55zypVwZ6dSFYSafPaduLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696723217, "uuid": "4451cdfe-3ee6-4224-93b5-a7c2336365fe", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696723217, "uuid": "fa81f3d7-8e7a-47a2-9226-f4d26a692134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696723217, "uuid": "7cebabbe-14f5-4146-8814-d6e428329f3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0370c08f-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696753861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753861, "uuid": "203682ee-f24f-4320-8394-7f5ab233f51a", "comment": "Malware payload (Mirai)", "value": "d1433b1c55cb4b873a8b5cfdc0718ee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753861, "uuid": "d1f77b8d-d864-407b-89a0-c8e655db589e", "comment": "Malware payload (Mirai)", "value": "fdd4c53f1b33f95108159fb3032407588bbff7378b976393570773ae3aad38c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753861, "uuid": "e08600e2-b01c-475b-9611-00af51eab3d8", "comment": "Malware payload (Mirai)", "value": "7338da2c64e0203841c9398e31f0cf1aee4c429d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696753861, "uuid": "5f66b238-d8d6-4bec-b17a-b46fe2a34a72", "comment": "Malware payload (Mirai)", "value": "2cb039793dc3d5a411b63313de4b437808a66e42a223e0e07940d0c62b4f44da99e58c3cac7244723d7163c3d2f9dde1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753861, "uuid": "fce0ffb7-d0be-45d6-adf7-156910050af6", "value": "T1D3F2E173D63B2E76D8707C7AE91D4682274547F8F8DEB0B602A2074467C5883C8BAE48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753861, "uuid": "abf2418c-39bd-49c5-bc2b-32d5e5ea34b1", "value": "768:zq4klk3/xrmlcDdGj7PBUbZT/JKDvUw4mw39q3UEL67:EluJrF6UbZTkTLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696753861, "uuid": "2a050c23-af48-4900-a5a1-eba69d2f46ce", "value": 34868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696753861, "uuid": "6dea76de-b9b7-42e8-a582-cbec462158d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696753861, "uuid": "c81044b8-495d-46a5-b518-fe17ce9555c2", "value": "d1433b1c55cb4b873a8b5cfdc0718ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e890d9b9-65b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696754246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754246, "uuid": "1465b725-6f19-406d-9fae-0c57fb09b656", "comment": "Malware payload", "value": "f401ab41bcc4357bb07b8488a41d824a", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754246, "uuid": "c1d2f2c3-d0ca-40ce-817b-50a577603989", "comment": "Malware payload", "value": "ff59597e829d63cba158f8d4de168ae86fb0b3ec6b288abf5c4359a253523301", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754246, "uuid": "49546376-fa4e-4510-8338-5fabb4785bf3", "comment": "Malware payload", "value": "3bf54fd8b8f89726d7ea37790db2d5d8afb134aa", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696754246, "uuid": "971cc94f-022c-4ed3-bda6-33870e61051d", "comment": "Malware payload", "value": "8d18da76ab20a4574ec2ff1200f0cfe63e03a4c748edaa9f53aad8e7aad5431f4bce961ed124194793f685dbdfac7893", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "cystnovor-fun", "colour": "#BA78AE", "exportable": true, "hide_tag": false }, { "name": "DropBox", "colour": "#BB1E7B", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754246, "uuid": "a4929470-8de7-44a5-b370-84bb333a1a0d", "value": "T15FB5D0F6294CA6B603E5AFBC151633042363363B9C5E34C351E5E9A7ED5C0F7A0A9E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754246, "uuid": "ed003751-79f9-4bd5-b440-1417c55a41b8", "value": "24576:7DoekuDJ7/7OhbkR8QmmNfPuQvxr7y/HNVDFZS1H3nnPkQODnnKXbsLx1WOgSMM9:osO5kpPnorS1H3nvyngsfrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696754246, "uuid": "cf606eea-8f3b-48ea-9cc1-78df35aca8b5", "value": 2424322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696754246, "uuid": "40c8de77-b60e-41e0-918a-5df172b0f518", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696754246, "uuid": "5e0356c6-e1ab-422b-bdcd-406430402b48", "value": "dvYojb.table", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }