{ "Event": { "published": true, "date": "2023-03-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-12", "timestamp": 1678665781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5534eb34-0290-4903-ae33-b30c98e9c040", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb33e7b5-c0a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678605007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605007, "uuid": "d019949f-fe94-447b-9c71-ea960b0f6691", "comment": "Malware payload (CryptBot)", "value": "872e7d06688cfe2fceee54cbbc7ecc4a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605007, "uuid": "3a53fc6b-de52-43ca-8595-1c35628277c4", "comment": "Malware payload (CryptBot)", "value": "0064b1e109f573ee5ee5d3e6881909320d2c8c5c0dfae1c0539ac45d1d4edd4b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605007, "uuid": "3f2baba7-cdf6-4196-a790-f8cb307c644c", "comment": "Malware payload (CryptBot)", "value": "958fa38889e80a917829c28195ffa7163b59bde5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605007, "uuid": "017396db-0107-4e16-90fa-d89e9347225e", "comment": "Malware payload (CryptBot)", "value": "ee67d5ce3ec7f35d91b3501a9f423693fff1b28146fe266dd4588a1cbf7ba933f723d38440fa8bb37dd8c51c35bc93a3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605007, "uuid": "32573009-2a80-4f68-974f-42e7077db1dc", "value": "T146050232F485E237D12112BA8938F521F7BC7EA14A35086B37D45C2EFB2E5829F64752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605007, "uuid": "4e2f9591-0c26-4e05-a07c-5c0d5617bd4c", "value": "12288:RcWNxg/hfSJ7DAWft9IN55Pq2bKIhiCHendgUGdZPM3n/t99qhdVz8VP06KAFVuQ:GWIhG73iN55Pq2b5hiC65ZPt4b4cAz1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678605007, "uuid": "5bfae502-9167-404e-b9bc-056676ee6973", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678605007, "uuid": "22d8ac7d-0fe8-4f7d-9456-b7994db08207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605007, "uuid": "41b2cdb2-e202-490b-b299-98b0c2330894", "value": "872e7d06688cfe2fceee54cbbc7ecc4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043b6a56-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642844, "uuid": "b1deb0a2-328e-47cf-b6ff-0ebe493a594a", "comment": "Malware payload (Mirai)", "value": "753066d298d14bef326bc57a1be7206a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642844, "uuid": "e9fb7450-f77d-4174-8a1b-110f63e37837", "comment": "Malware payload (Mirai)", "value": "00b8070a9d81bf764c26b355600690477a34fda7849fd1ddfccbc50545180ca6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642844, "uuid": "531ae23a-9a09-43c1-b61f-67dad520b480", "comment": "Malware payload (Mirai)", "value": "56a2039f92c46a1aecf28983f3e6da91a84a15ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642844, "uuid": "fcc631b9-6569-4660-81b8-935895683994", "comment": "Malware payload (Mirai)", "value": "89c7a130877a92c4ca52d7e72b6c1de05d4c8997f76cc034b01692d6e4e9338068c63149659d1559ec183282c48adf78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642844, "uuid": "ad96bd51-58b1-498a-8026-254a490e9022", "value": "T1643302B9C96133D8E6CC70B5D75963AD0F6017922C422ED6D590B8343DE636CA40B5B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642844, "uuid": "8a5eaab4-033f-4901-9f0b-bb0119268126", "value": "1536:mcOy7aTccrsfAcGHr43bKamHjZas4aisBvHYwj4:N/Nwrub0HjWavBHYi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642844, "uuid": "88cd8643-90ea-4629-ac22-6ff23421e942", "value": 54904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642844, "uuid": "42dcd273-f928-49a9-8a4c-9a423fa20f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642844, "uuid": "a7930723-9179-492a-9c26-acc5d4e05474", "value": "753066d298d14bef326bc57a1be7206a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10819719-c0e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678630839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678630839, "uuid": "716af280-3839-4464-8fa4-f16ca444be90", "comment": "Malware payload (RedLineStealer)", "value": "7319cb5b297f551049ae3d839b146b28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678630839, "uuid": "ac47fa4a-256b-42cd-8deb-f46e7c84ba81", "comment": "Malware payload (RedLineStealer)", "value": "014302d7d081b449b499c26f94fb69e046fd7c89b9a1d777d796dd9f73b4acac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678630839, "uuid": "cc648d7c-bac2-4cfb-9e36-322413dbc017", "comment": "Malware payload (RedLineStealer)", "value": "9902ccd729028838bcfbadfca727af6f25af45e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678630839, "uuid": "87df1bda-d2f4-409b-84d8-49ee063a5245", "comment": "Malware payload (RedLineStealer)", "value": "3ca0d8b4703f76e38aedcff6e28e5aa47505c9c8cdaea7a5dd875de86edecbaf0aea0b7d98eeba6c5416c40b08bd973f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678630839, "uuid": "e2b9fa78-62ed-4189-b17c-5738b1ff4fd8", "value": "T104A4E13296A17824F5628E329D3FC2A4261FF8A15F6957D732046A1F0A711ECC5F3B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678630839, "uuid": "7c042335-708e-4dd0-bc1a-bb1589a15c60", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678630839, "uuid": "ce44ee4a-d0d6-4ae0-b5e7-8698f8a6b1c6", "value": "12288:QpRYQp8r2yS44YOfXqfTsAQvNKooICHciGxa7pA:Qv58r8YOfXAsHQooIQciGOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678630839, "uuid": "76c5949a-56e0-4a95-9529-4e630b7a4087", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678630839, "uuid": "9910ab5d-a549-44d8-84ff-11915d8cd1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678630839, "uuid": "8afc46bc-4972-4e22-a8ea-072441decabf", "value": "7319cb5b297f551049ae3d839b146b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5a1e91-c077-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585577, "uuid": "9e0dac3c-18e2-4506-9355-6a4c2f821900", "comment": "Malware payload (Mirai)", "value": "3ad2b7189a4dde9771c9394193fec7f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585577, "uuid": "6bdbf9d8-7c30-431b-b0ee-cc12b2efca17", "comment": "Malware payload (Mirai)", "value": "01aa7d31298a2957d6c27f932548a16686258b285ec1383b503b59df53d494a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585577, "uuid": "c9a68b3a-fdc6-4528-813f-b3cb1474842f", "comment": "Malware payload (Mirai)", "value": "8c6f33bf8708b10b73c5a218f75ae8250ebd81bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585577, "uuid": "39f93ccd-c388-4cf8-a5a8-c191c99ce654", "comment": "Malware payload (Mirai)", "value": "84ca56ccb48811c39d0004d16d63ba58beb9d4656ac7b2c3b1e2576f869f0f200513efd792d59410df9c9a7072d48fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585577, "uuid": "dc778ceb-be80-4969-b001-9ebd1444fa89", "value": "T13963A64D3E319FACFBA8463457F39E20A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585577, "uuid": "7f5eb94d-328d-4b33-9f89-fa9c559cf61a", "value": "768:RzZWyvL5MsRXxPx2pqV2U1z9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2U/GecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585577, "uuid": "6f77790a-61c0-4854-93b4-c622df9a8336", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585577, "uuid": "548db519-fe91-4472-930f-31a65a14ca55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585577, "uuid": "a987ec07-7ff9-4a7b-8f93-6a1e5b74fb2b", "value": "3ad2b7189a4dde9771c9394193fec7f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8ca246-c0ce-11ed-88f6-42010a9c006e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1678623021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678623021, "uuid": "6ab227ed-1d3a-46b7-aa6e-cb359998c8f8", "comment": "Malware payload (OrcusRAT)", "value": "5d36ba6502005e42710ed4fceb11d604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678623021, "uuid": "316c4af0-2fce-49a2-ba54-fa1cb5508086", "comment": "Malware payload (OrcusRAT)", "value": "02a3d32c6a311ca0478e4767f3ea0eddf78cc44638200ca59c0a05bae42dca43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678623021, "uuid": "32da57f0-35c0-40e1-9aaf-d6987001e78e", "comment": "Malware payload (OrcusRAT)", "value": "fa445ba179a4dc8d0c485f0fa6b0bee9b86960fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678623021, "uuid": "c0804424-15e1-421f-b27f-fadf08ca6994", "comment": "Malware payload (OrcusRAT)", "value": "8880d2f694dc11f59a67cae25eeadf1d1feecaba94c19d220db82ff9b85515160f824da9a58f4902eef0674a4f403843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678623021, "uuid": "450f6af6-17da-4eaa-ba7b-2c7829679e2c", "value": "T12DC633FA5AC1CA5CC3BD0432365C3D01AA30A9E39A9357B6B7F43227A75C9140B0DE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678623021, "uuid": "dbe48eee-961f-4675-b448-94129838a991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678623021, "uuid": "d25033c0-1826-4502-b1d4-9a274f87e28c", "value": "196608:FvJA5AWU9xc7xLp8QacUG4raKu24YY7HVT4hV0AD6QgqKRgX:Fv459LWvmKr4YYH+EUWpgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678623021, "uuid": "f660ff26-da9a-4dcd-83c9-ae4253b04d05", "value": 11523584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678623021, "uuid": "9eb8c124-1491-4e65-b15d-2b9167c5a325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678623021, "uuid": "85a0592a-49a3-44b6-a47a-cbc69ad9bd75", "value": "5d36ba6502005e42710ed4fceb11d604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff11f89e-c0bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678614918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614918, "uuid": "c7324093-1278-4a6e-bd43-dac6f6476a72", "comment": "Malware payload (RedLineStealer)", "value": "28d7918ffbf0181dc8eb3c237b25fffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614918, "uuid": "e7253d43-deb3-42d6-a88b-032543c47376", "comment": "Malware payload (RedLineStealer)", "value": "0387e26d7a9ce629f39a713c878522263b09908877458735922745bd55ac1bf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614918, "uuid": "a06ecd81-2392-4ded-acc2-7c8f6ee971b4", "comment": "Malware payload (RedLineStealer)", "value": "dcbd0ae601352940a653a9d2b0c080e3aa86b4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614918, "uuid": "dc21abda-3959-475b-9355-8b4fdc19fbd5", "comment": "Malware payload (RedLineStealer)", "value": "b3d7dce437bea0ea8c08d642140aef1eb60892523ae2b444991e6eaca3106d01c39dc137aa14b8c9a6c5593c26bbc092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614918, "uuid": "75ea6fff-d10a-4832-b1f9-fcf87a1c7fc5", "value": "T110545D0DE9257415C37D80FDA58CD3F9DCFE49B793AF6AA247E82475DE011E862A8023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614918, "uuid": "97e65f39-6f23-4112-ba66-988c3ec29076", "value": "1f7948b75e8007bde9f40a49c22ca16a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614918, "uuid": "aaa17fda-fbd1-4911-8870-73d73d6bee0f", "value": "6144:l1miLQT5EnGk/S9urcY9i8Xt4xMGgSjATcRFrDp:l1zcTGGk/4dYUIS6cXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678614918, "uuid": "bb41355d-f5c3-455d-829a-5c8b80f7c07d", "value": 298944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678614918, "uuid": "73d9a715-a3c2-4f6c-96f5-3f7fdac3d024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614918, "uuid": "9619bd36-13b8-4241-8be6-00d79c0d247b", "value": "28d7918ffbf0181dc8eb3c237b25fffd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8ca2e8-c0d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678625353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625353, "uuid": "d62b1d4a-7370-4970-81e0-21d0f0287543", "comment": "Malware payload (RedLineStealer)", "value": "cc6d75eb91d5c55384fb572046f9b033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625353, "uuid": "7cc93463-fba7-4d70-be66-af54936dc78f", "comment": "Malware payload (RedLineStealer)", "value": "03b776712224abba6f0c65372624ab01dd4d38c88cc33c1de0b03f9b0f4e7d5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625353, "uuid": "6497dd81-1618-4be7-8245-4974af42fa9a", "comment": "Malware payload (RedLineStealer)", "value": "e185f82404a5f7b80f77f4093481ad4c42e60e16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625353, "uuid": "10f16e39-9aa9-46a2-98aa-5b1d23080aa3", "comment": "Malware payload (RedLineStealer)", "value": "1e69303adba9f8f65c3789b78723faa788b382e6042152e066779b60f21f810b26e531c02637b9debeaba3aac11b7fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625353, "uuid": "56ba2435-6a57-4f8b-8a8e-5e5af911bddf", "value": "T126A4F11273F0A821F577C7325F3FC2A4666EF6614E68636D33485A6F0BB10E1E562722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625353, "uuid": "fa2fa43e-9f0d-41e2-8e45-2d700244184f", "value": "3d4c16eb468ed7fad4115f689c8d6af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625353, "uuid": "08360e96-ecba-45ee-b700-23d7daa6a955", "value": "6144:qpqCfjcHwMbLU3dw4QHVa8GcVCZMh9jbMxCC7Nx9ipAEzmq4JerYh0K:qkAkBbQ3EHkpZ+9jbMMC7diiEZ4ArGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625353, "uuid": "d4b2640f-2afe-45ca-8dcb-432c0421f975", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625353, "uuid": "5eb1df3e-e58a-487f-a475-21804a1a7532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625353, "uuid": "a5dedff3-9dcb-4328-8fbf-4d82593856f8", "value": "cc6d75eb91d5c55384fb572046f9b033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c4954-c10c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678649471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649471, "uuid": "d9619dd0-d92b-42bb-8f9b-39b1fcaa391c", "comment": "Malware payload (Formbook)", "value": "aa7f05d22a343c2e46de59a7926650eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649471, "uuid": "d8ed60f4-ce0a-4bfd-bd44-200d94c5b22b", "comment": "Malware payload (Formbook)", "value": "0576e8e55fb4cc7c41becaf8bb58783b38fe13939fb2ab02f28b948747ac6ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649471, "uuid": "218ad659-3c3d-4a28-94f1-ab3b6feb69b7", "comment": "Malware payload (Formbook)", "value": "fe4f3be939d3bdc35be6bd221c66c805c9d5aefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649471, "uuid": "1077b695-2431-420a-a1d1-b60f010bdf4c", "comment": "Malware payload (Formbook)", "value": "30f45f449ba82446ad6b52d1585a7f9af65c039d25a1a1964dddc99c2e19ddd4d9b94219806564f5dc8a8c70788097f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649471, "uuid": "ed6c076f-8114-4906-b709-1f3bbe6d8f09", "value": "T1C445383439FA502AB173EF6A8BE479AADA6FB7733B0764591090038A4723D41DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649471, "uuid": "f1032bc8-af81-4bb5-abcf-7d4dbe9b5f3c", "value": "12288:XaBbBkPelYFLRpzg/QtCC8Bg+fWwITDrB5DksSkKcDW87HmD07vhRUNlgM7DCxFF:udNfWB1z8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678649471, "uuid": "9dac900e-1a8c-4c48-8448-7008df4ee82a", "value": 1252760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678649471, "uuid": "6d37c20e-eb84-4f78-bba7-d13796e6bb42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649471, "uuid": "79c60770-78d2-43ad-b577-a956a4f72042", "value": "MoE405pkYg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f888f0c-c0e3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678631696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678631696, "uuid": "295b6d18-8844-457b-8963-a28f0f7836c4", "comment": "Malware payload", "value": "37b949174fe2988697fd9c5b21c9df7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678631696, "uuid": "9bb47b0b-49b5-4aa2-8621-7cc1da8327f1", "comment": "Malware payload", "value": "05886d06ae1ab5439b64790aa96155f8e6853089588ce0e379978e5b88bfa04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678631696, "uuid": "cc0a0b32-8f79-4c12-8852-4679cff165b3", "comment": "Malware payload", "value": "83a39677501175d2d2c719bb36d79e67b557f4fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678631696, "uuid": "de51c67e-4a2d-47e0-9606-9934584e6012", "comment": "Malware payload", "value": "480cc6b3ee35eb093dbaf5a83bd3e2e42fe2453ae07b48a5242cb724dfa3f44acc115c83b4d056062abc96f3c4e1285a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678631696, "uuid": "df37fa07-e9bd-4b64-b146-adec81e1a1d5", "value": "T1F2F36B13338C4135F95DD2F850899A3588AC757513EF20DF6B8C259E9E12BF066B8B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678631696, "uuid": "a6678e1e-377a-42f1-a4c9-e96730b1d30f", "value": "f5bb3bf3856cb08782d3dbaa36a5825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678631696, "uuid": "15b8f9ed-f290-4155-810b-db0e431a6794", "value": "1536:ssZGZgQcMOiUVOHFMZ2a3cLSh2Eb9FyFBjHVskfqC1I5R5PxU06Fy8RBqT3WrBvg:ssZG5UslCtMjxDCf2dFyyB23qJognrJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678631696, "uuid": "9fbcfdc3-3d0e-4b51-ba94-6a77a0733fae", "value": 157552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678631696, "uuid": "e1771e25-274b-4478-841e-f621c2745fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678631696, "uuid": "fcaba886-01f8-4b80-bfd3-e3a8f5dffea2", "value": "Kiddions Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afca33bc-c0c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1678619939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678619939, "uuid": "c6f8f49f-2df7-4346-ab51-05899278657a", "comment": "Malware payload (Chaos)", "value": "e8d60f0ce1aa1ff49f609b36772cd4fa", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678619939, "uuid": "201b320f-a1ac-496c-94a0-dcc9083f3873", "comment": "Malware payload (Chaos)", "value": "07fec2205cbbf2900ede2f6a1d9a5c428ef314c1dda559c632833a9c1d121542", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678619939, "uuid": "87fae212-b35c-4135-9041-a9d9f279435e", "comment": "Malware payload (Chaos)", "value": "87f5046e42d592eda4e0a2f04eae011cdf54a84a", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678619939, "uuid": "925fb9e4-2c66-4b29-98a8-b2af95c29b00", "comment": "Malware payload (Chaos)", "value": "7a17749b48bde3880ee3b44c9475464d0dc4f92ea759b2ec9889ed6c0296a0109a88e7a962c7b2189708741c7de86d5c", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678619939, "uuid": "42152a65-98a6-4b8b-aae6-2e735c712b29", "value": "T140D32A10AAFC0135C9EB26371A2B1DA6CB78998C5F1461E74778A7679C34CC0D8B2F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678619939, "uuid": "9dc7a430-a8b9-49b8-92c3-641a2f62a3fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678619939, "uuid": "8aa23ba8-1dcc-4cb8-926e-3e4c45e5ec1f", "value": "3072:hgMLiar9d8Wgu+tAcrbFAJc+RsUi1aVDkOvhJjvJ:FFr9dErtMsQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678619939, "uuid": "0c0bdbb2-0392-4d35-80dd-cb4d2b85a65e", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678619939, "uuid": "8ebf1699-44a0-46f6-9d06-a9bd33fd0a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678619939, "uuid": "27f93664-1404-4483-a8c2-d4f868500ee9", "value": "2023-03-11_e8d60f0ce1aa1ff49f609b36772cd4fa_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01712299-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1678647994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647994, "uuid": "f95435bc-f504-4db0-8dcb-b10f986e2ec2", "comment": "Malware payload (CoinMiner)", "value": "45c13451c346c682c4c1924cec775975", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647994, "uuid": "296e783a-e9a9-4074-b3cc-9d59aaa5ff4c", "comment": "Malware payload (CoinMiner)", "value": "09b57609920e578fec88961beaecc9dd8626c418c097d98308d94f6df3b28b90", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647994, "uuid": "30510297-223f-4a8a-a873-5f667364b163", "comment": "Malware payload (CoinMiner)", "value": "c05b22a1b2e63599c2475cd75e85cda3b6dc18b4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647994, "uuid": "22a23a12-b939-4ff4-bf90-863b777f123f", "comment": "Malware payload (CoinMiner)", "value": "edb44da21c40fb18ca3d8825d4487b6941fd58d9d727deb719a3eec8f37fbc54febc41161658f0b87faf6a0c524813c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647994, "uuid": "9d79b887-09ec-4a6d-b687-935e4489b19f", "value": "T1DC7533D7DA045D34D8CE1A72228EA515897B8794A163B7CC358B40CE2A0BF3D75FA933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647994, "uuid": "ea1c1f81-de98-4517-9003-9305758b5400", "value": "53882e10f0ed79e8a12b7085fd4dd221", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647994, "uuid": "278b7df9-666d-4ccb-a601-c4abf5366c3a", "value": "49152:S+Ib4FXl14RGTLqTj5sMaup+7XpcGEYWZBUMfwZJ:SB4eRGTLqJFYWZBfwZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647994, "uuid": "d6d3918d-79d1-491b-a48d-8b4eb13eb02f", "value": 1626800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647994, "uuid": "5907125f-b4a6-400a-8f39-c6fcf2319464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647994, "uuid": "749d67f7-e968-4ca1-a14c-06d8c924f163", "value": "45c13451c346c682c4c1924cec775975.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1550465-c0ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1678636665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678636665, "uuid": "cfec143a-3258-4e39-a081-ef57dff1fd77", "comment": "Malware payload (Gafgyt)", "value": "82f4f3c91870e135419f9c302eaaf074", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678636665, "uuid": "25a2099e-abfe-412d-a1a8-32df98c17720", "comment": "Malware payload (Gafgyt)", "value": "0bdafdd65d9a1a0ed59745a8ef6f6fc0a0f6262c495547c3e45e203921dcc2f2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678636665, "uuid": "7e132602-d2cf-43a4-81da-7a550e70a1ac", "comment": "Malware payload (Gafgyt)", "value": "00ffc387ccff313662717a0822b93af0c8a7a2e8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678636665, "uuid": "4093f9b9-70da-47a3-9055-8c479d76ae5c", "comment": "Malware payload (Gafgyt)", "value": "9b8ab52f6c52feab3601389329a25ca0c01e2a0d639078615254063f0bf59dc10b59443590008d78f09d12247687adf8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678636665, "uuid": "755b5f8c-0eca-4356-96be-bf85d891b4ac", "value": "T1D72443326D26D217C0A7EFB8AFE9BE92D659F2D70F41910372E0106D0EF5959681FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678636665, "uuid": "58d40d64-f883-4e7a-b2e4-7ca14fde4000", "value": "3072:gcSeH8LgHa1qSquhH7Ij1Myh4v9PmwmVuENm2DYX:oLg6hlOjzkdmwmVuENm2DYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678636665, "uuid": "6f87c381-0d7c-47a9-bfe7-f7db468fba27", "value": 217204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678636665, "uuid": "fded6c5e-fe46-484b-934c-d819c65c1062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678636665, "uuid": "e64a2a77-2693-44a5-a848-fccd0666bf4b", "value": "82f4f3c91870e135419f9c302eaaf074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea41f70-c0c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678616824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678616824, "uuid": "988b9861-2cde-4225-b1f2-d0cf0ccedb80", "comment": "Malware payload", "value": "f5a4d2b71c363c1fb485b8cc4aa7e073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678616824, "uuid": "7ab2d37a-fb1f-47fb-8fee-9eb68537aa06", "comment": "Malware payload", "value": "0ecbe3f207533875f77a7f9bb2eb310ff8749ade0feb35238aaf5091b53a8a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678616824, "uuid": "bb12e45e-8b10-490d-9e32-1bf50d84b0da", "comment": "Malware payload", "value": "a49a1ca90c8dfe8e419c188025745f4d04125841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678616824, "uuid": "f6813e66-1c97-453a-acb1-abb4b9b3fb46", "comment": "Malware payload", "value": "1f8475c300664ae6d16083ee20eac0588981704b8284b58ba7d587bd31124fc2e2e25534a45e5f867794b47611c9234e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678616824, "uuid": "fae71295-bf90-45e2-8f32-a06828cb1434", "value": "T17BF5331BCDD82CAEE76D0E713856B5A9B1CA4B13C98C457BDFCACADF0801A980574ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678616824, "uuid": "3bbaec1b-ca91-4203-a4fc-23fff37a8d07", "value": "c8bae08c035a9c3e7f06d8ee51ab3fab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678616824, "uuid": "08d73540-3f26-4451-99b6-b641d305bb91", "value": "98304:5eTa92GiWqonSQ/flsxqJahmH/q3x9XMd6h7CAPjkmAw:KaW+SwlsxZwYMILd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678616824, "uuid": "621bd976-5ecb-4213-acb5-5895342ba5d8", "value": 3322880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678616824, "uuid": "e33f9847-7480-4790-a5ff-54f644d30b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678616824, "uuid": "9dd2ea33-e49a-4034-a671-21e9ffd3886a", "value": "SecuriteInfo.com.Variant.Razy.668800.9466.9421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d12a5-c0aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678607497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607497, "uuid": "5c3172e1-33fb-4f43-b185-61a7da22bf1f", "comment": "Malware payload (RedLineStealer)", "value": "a650e6d520425faf6df5fc2c56fe1f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607497, "uuid": "c8dd9263-dc1c-44c1-83cb-4eb0f441ecba", "comment": "Malware payload (RedLineStealer)", "value": "0efb1a320a04181d0053d1a504c0ce71612d30319e815a2cdf891b1f6001c126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607497, "uuid": "21893539-1d4e-4f72-9486-34be5a0c654d", "comment": "Malware payload (RedLineStealer)", "value": "2c88892193887b5df2964081f9f2ecc6d92bfc9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607497, "uuid": "ab7fbfa9-2d9e-4290-8a58-70984c68f4d6", "comment": "Malware payload (RedLineStealer)", "value": "1f0bbdd5dc99dab19677ac3ebcd9cde05e7e3e0917fa7495df7e1e38ebb4940eadf1ec597b887d3fe26dbc61d29e3a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607497, "uuid": "19ed39b8-faad-4edc-9140-c0884b3cc7f5", "value": "T1B3C4F112B3E0A871F673C7315F3FD2A42A1FB9708F69676D22085B1B0BB11E1E566712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607497, "uuid": "485870fb-3fc5-4d05-8c05-3638007d40e4", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607497, "uuid": "b6b022b3-8283-49f9-8be4-cbdff9b7e314", "value": "12288:Bd5+vYnP4MFbt9ZJM8HHJE/aey6Pl+sZKXIm:BvPLl68JERySl+3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678607497, "uuid": "258c9f4f-424c-44c3-b2f4-19c53724cd03", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678607497, "uuid": "67903e5b-77b1-4c60-8e67-495f6e109e4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607497, "uuid": "9d8ceaaf-65ad-414c-b5ac-6937b1020fdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3d3c56-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588067, "uuid": "cb0de6a0-75b3-4b65-a168-d1a77563eed7", "comment": "Malware payload", "value": "d6c771f2afd8ce35e8727f95f3a3c6c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588067, "uuid": "fe0d414c-2fea-4e66-9998-f02f5d22d99d", "comment": "Malware payload", "value": "0f220ebbab71a8568eb0dfff22ea8c77cc05653580dc02ba86ca430c25f285ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588067, "uuid": "bff4594e-b65c-4336-8b4a-576080d4ae47", "comment": "Malware payload", "value": "8517f732d90a1eba51903b9440a3bb75740154e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588067, "uuid": "244d8e1b-2461-4998-a126-783e4182382e", "comment": "Malware payload", "value": "28a0f514b687537c2170cead77da20f1a1f7e9bfa66cd8ec0a6c319e7d7a8e305f2620fc06e463f185e5d6681179defe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588067, "uuid": "6d4afc4f-3ea8-46cf-99f2-a80fbf103655", "value": "T1B9B43B01E7619138F4BB21F91A7E65A9A43D7AB01714C8CBE3C42FED9635AD0AD3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588067, "uuid": "e39162cf-a8fa-42b3-8752-0fc34b683d21", "value": "d3d4006920c2c1d9a10409b75aa96228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588067, "uuid": "dc59ab8d-a01d-4254-9480-2dd33053992e", "value": "6144:VCCHWA+UG7KVisYTnad3ZdfZOOJ4bp5pu43vU:VNW5hNTad3NOm4bHc8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588067, "uuid": "9e88a735-cac8-461d-8671-b3ea211140c4", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588067, "uuid": "22b1966e-fcf3-43f5-98dc-b5b5874dd8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588067, "uuid": "33749a32-78b7-4c65-b7bb-79f30f6b1bf9", "value": "SecuriteInfo.com.Variant.Fragtor.123674.10830.31950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc6a0a5-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678642886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642886, "uuid": "0e7de0b6-90a2-48da-9796-55562f910843", "comment": "Malware payload (LaplasClipper)", "value": "9c6e68c904cc609b5630489a18d27a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642886, "uuid": "aed8fbd4-dca4-4b85-85b4-926ba67394c1", "comment": "Malware payload (LaplasClipper)", "value": "0ff5f230019a5eaa513beb416452f59f382ce643a504375ea27d1c05ffbe7b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642886, "uuid": "a08b3a2d-2f68-412f-94d4-dc6083243ec3", "comment": "Malware payload (LaplasClipper)", "value": "da86abf7d89c24ed2cbd31d7bcb36ee3c3889e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642886, "uuid": "bf6efed3-e7a1-4cfb-8323-4c268cfa4a06", "comment": "Malware payload (LaplasClipper)", "value": "05ccdea9f1f57af48de9a30c7e846929d4e426814e5c9090ae1a4c9339ffba6b133fe0fa98dfa55f2b1db61a7e7aa25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642886, "uuid": "b1926a37-2259-4a33-b9e6-f159357df505", "value": "T17344C11253F0F825E663D771AA2EC2E4773EB4A18E79B75622048A3F4CB12E1D962351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642886, "uuid": "8a2aa6a3-cfb4-4ff3-876d-d9a30d317393", "value": "c3bde088952212340d0ea7abda553943", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642886, "uuid": "4ceaac21-4fe9-4810-85d6-329fe1cb015e", "value": "6144:tFgJaAEF6tYynz3cgcfFwzU/ZXk+3+jHwzAK:f0a7kjzcWzAz+jHVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642886, "uuid": "f220b598-aace-40fa-8d72-99d40bd00901", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642886, "uuid": "13bdefde-e47f-47e4-ad73-f9722728db1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642886, "uuid": "ee32c434-5303-4309-a7d3-ae0eac06681c", "value": "9c6e68c904cc609b5630489a18d27a5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1419f619-c09e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678602069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602069, "uuid": "a4a618fe-ecef-4042-af46-322a512b9a1b", "comment": "Malware payload (GCleaner)", "value": "720aca5cb79353b72636e3a5147fdf77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602069, "uuid": "ac2ba0a4-6680-489c-90d3-23b0102adb55", "comment": "Malware payload (GCleaner)", "value": "103531a2155425de015b66daabd43c81b6fb95b913c46634889de5b15475ed5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602069, "uuid": "b607c8fb-f519-4da0-958b-20b97edf393c", "comment": "Malware payload (GCleaner)", "value": "cc5c6e8a25b087a91812180fd4b8911df84d0d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602069, "uuid": "e0dfa0fe-67d9-4ddf-8f1c-0f0cb5d7d575", "comment": "Malware payload (GCleaner)", "value": "4207a2d31507a7b1c26cc1e27ddd808e95428899c014925c25554fc47b905bdf265f261f4015e49c258db688712b1619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602069, "uuid": "3ffbfa79-bd65-4d86-b84c-b1fe35bfc4c1", "value": "T14BE533C8D3E90978F1A076703D1D8DEC1F3EBDA90C2A4A31767C164E1A175A5B0ED39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602069, "uuid": "0073e4fd-f581-436d-8c62-b25680cfd4bb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602069, "uuid": "7276af84-d757-4cbc-a55b-435daff11daf", "value": "49152:AGraK+Jf5pf1MiuhjfNwYg3bgzEHkAuvZ8zhiCzdgk8mz7Kv/EQwqaAVtR5j3TpX:dr9afr7YjCXUEoBQiCL7Kv/EGaAVtRZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678602069, "uuid": "7ec5da0f-47f7-4c53-826b-5cd3ee84e454", "value": 3117785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678602069, "uuid": "0af36d3e-ee41-4ba9-bc55-2a5fd36c94be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602069, "uuid": "bea3d3d6-7689-4cf2-9c07-144b39d593dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c88a4c3-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588071, "uuid": "c81e17aa-4b05-4c68-a1d3-b3210db3b479", "comment": "Malware payload", "value": "803f772489ff905eccdc4684def6adde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588071, "uuid": "d894abdc-42db-4c2f-a9a0-a9f805454122", "comment": "Malware payload", "value": "10d21d4bf93e78a059a32b0210bd7891e349aabe88d0184d162c104b1e8bee2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588071, "uuid": "89afc0f0-9349-4c34-b810-f232a52d7fc9", "comment": "Malware payload", "value": "fbb3e24f9d517714c312fc88d7e60ab05860dff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588071, "uuid": "3a021682-8429-4e6d-b73c-7b6f2aaca3fc", "comment": "Malware payload", "value": "c8fec0bafd3c6d6af9135a2c1dc2edb548ef42c924d16be7c3726bb0606693cc81a0acee9c9304af475dad86af318f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588071, "uuid": "096300e8-514e-4b5b-bc54-82786e28d7bb", "value": "T1DC427E55FB84E9F7C94C3AB520CF8AB4CA908C879FF6A441191440BE6B007F94C3467D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588071, "uuid": "25d1ee7b-3bb3-4b63-8668-f7eacac96a62", "value": "5ee4c645a2c1d1498e2e02d94b61b09d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588071, "uuid": "f6210b4c-7613-4d7e-902a-7719958cde0f", "value": "96:Z1aVn8RjvX4INJEP0W3AucJciYA7u1MrOSUd5CpjfI4+txNxxD8+D4SQumh3v52h:eVnsjvXLaFAyA7saORdMB+xFPDT0adc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588071, "uuid": "ddb1f065-ed84-4db8-9965-a74b24bffe5b", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588071, "uuid": "e6e4352b-ae23-446a-8e96-c0eb3e737f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588071, "uuid": "4c82a397-4f60-4105-a947-8981157eec80", "value": "SecuriteInfo.com.Trojan.Agent.FQDA.12997.15130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cc9e58-c097-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1678599198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599198, "uuid": "2f498583-6f55-4534-a738-d15bed51901d", "comment": "Malware payload (LockBit)", "value": "523190c8adb9f67f54bd299c9175d4e8", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599198, "uuid": "2798f52b-e419-4900-889f-e774cf1fd194", "comment": "Malware payload (LockBit)", "value": "111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599198, "uuid": "e560f733-bd20-482d-b565-3b5b27a76002", "comment": "Malware payload (LockBit)", "value": "1a736dfd8806f898e529b0f713b4e7bc44f75742", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599198, "uuid": "836045e3-0318-4dad-b3b1-d96a710de6ff", "comment": "Malware payload (LockBit)", "value": "b33a4fa896e46d6cb6f22b982547d9598ae3bae862af865211f54ffc940cc80d99817fe9a27b6e8037ab6412654d9b55", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599198, "uuid": "534907e9-7a89-4641-a4df-1d0ffe5c3025", "value": "T1BDC402123181E873D20583344D56DAF83AFAB7315E616BA7376C264F0F74AA19237F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599198, "uuid": "21e9988b-9b32-49fd-b57d-83790d2c13c5", "value": "915857a0c1b1198d919ed99e3d150aa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599198, "uuid": "bfe0fd8f-9723-4c60-8f52-1e1923c45133", "value": "12288:9SUCXw8ZeNj+qIpyt9xPRQ+KQmIStn3iHfVt+K:9SUDNOyxPq+PSt3i0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678599198, "uuid": "d9558621-88ad-4cc8-8e6d-e9e532cf6f0f", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678599198, "uuid": "d374539d-06f6-4d30-b14b-d5e2c1f1d7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599198, "uuid": "5b501c42-163f-491e-995b-8508bdc0f634", "value": "111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5b7354-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588074, "uuid": "dad84d67-297c-49d1-9545-4ad9b38827eb", "comment": "Malware payload", "value": "238a1361b7c1fdef3abf28c64af15560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588074, "uuid": "d172c2d9-ee6a-4135-89ea-8f860f6ac8d9", "comment": "Malware payload", "value": "1112f2471a7bfe5ea0e497c2886836d934b6f65f15601dc1dcde23ebffef3159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588074, "uuid": "63c8b973-cb38-46cd-97d4-0868c027b227", "comment": "Malware payload", "value": "e587ff887d11a48755d5772c5a6ad7448e5d9c39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588074, "uuid": "2180e8d0-d141-4190-9adb-c346c0452ea4", "comment": "Malware payload", "value": "162ce0c31ab223abda5c67ff70165f767b93fcfcb9e6d436cefd222ec192549042852bb582659f0f1c17e17f667dfb66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588074, "uuid": "8bd2b94a-ac7e-4fd1-b8e1-36d853ad3edc", "value": "T1A0F4F1654B2FEF23E88F6A3D189F024CA555EF7E256DC60A4984C4882F5B4F1BD01D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588074, "uuid": "4724a0aa-ddc6-4163-aa70-e90d411f41f6", "value": "12288:ZmSwcZSAZDaXJboF3UL3Q86wpE45N+FgLSO6:4SwYScGXJbaQ3lBvf+mLR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588074, "uuid": "da708dfc-0640-49c0-910c-a6547abd44dd", "value": 739928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588074, "uuid": "287d2855-0789-4a4e-b005-33fbdea3dbf7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588074, "uuid": "55a817d0-daeb-4a46-8d51-4a6e7723d1fc", "value": "SecuriteInfo.com.Trojan.SuspectCRC.14126.20360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fa9dce-c108-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678647605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647605, "uuid": "9d200a29-a875-4dcc-b993-b282a8919532", "comment": "Malware payload (AgentTesla)", "value": "d0bcb155d0c3facda30a15e436be747d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647605, "uuid": "6e707b3c-08a3-43a7-a3e8-d4fed7b387ab", "comment": "Malware payload (AgentTesla)", "value": "11eeb77d418ef5d9b701e2417ae0dc8cc73b74e65325e2ee6f371c7c17737ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647605, "uuid": "dd16e628-f581-4100-8d4a-e330bee86750", "comment": "Malware payload (AgentTesla)", "value": "8fffec2d9cd06d92cccaee64444c1068c43ee168", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647605, "uuid": "68414257-bbfd-4068-a715-1a5a677f37b9", "comment": "Malware payload (AgentTesla)", "value": "493f31c7985023342610d014b657ae716c9fea9c9a49ad51bb8bc5940240a01ee130b84ad3cc704eb17274572b5d3958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647605, "uuid": "76c2219b-3c47-45b4-800e-ae227466eb11", "value": "T1F745383439EA501AB173EFAA8BE475EADA6FB7733B07645D109003864723A81DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647605, "uuid": "55b6b891-cbc8-4a65-9178-8c50c2b5ccfb", "value": "12288:nCnqrH3ZQExvSJBnl88nYag6yph5a4gASLSENdy8SLVpSzc/WBoo/Wbpn2+F9rAd:CJgW88XS7lScACezaG5UWU9xOZ9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647605, "uuid": "19aa1c9d-3cac-4f09-8bda-98e9c0dab0a8", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647605, "uuid": "0993d3f3-b486-4ac9-ac96-3ff8600c0020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647605, "uuid": "4981bbb5-d761-41ba-a53f-e48114b6d559", "value": "Swift_92be67ab-e027-4955-b6fc-64b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1f5cd3-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678648600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648600, "uuid": "ef2f8f90-5066-427c-9a96-bdc96ed9df20", "comment": "Malware payload (RedLineStealer)", "value": "dfb0833ee43a895b4475b4df229253bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648600, "uuid": "b49f9c2f-95bc-473b-9833-9fddaa755453", "comment": "Malware payload (RedLineStealer)", "value": "1430ef775b65caef8cc9c772dbb7ea8b841306e0c7b12fc94869b1380d01c3f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648600, "uuid": "404d7473-2354-4c02-a51e-f769cab91260", "comment": "Malware payload (RedLineStealer)", "value": "f2e86844bb902b8d22588162d6c95184bc7ec7ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648600, "uuid": "78417b88-d3ba-4623-b382-f2b60a50dcb5", "comment": "Malware payload (RedLineStealer)", "value": "19aa9dbb4602671588f8def8015cb26a173f10a4ff4d9f6637df63cac70dc054813c63617c9b25623424a97f55c9eb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648600, "uuid": "b391845e-b6ff-4836-8432-047b0bf3cb81", "value": "T1B754C072ABA07810F5624A324E3BC6A4661FBC518F75979B2304AA1F1C711EEC5F271F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648600, "uuid": "f22efe86-1821-445c-b627-02566e18e3d8", "value": "8f077cc2038fae85c4e9d8c60b51a269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648600, "uuid": "bbb953c8-013a-47a0-869e-5af6b3227349", "value": "6144:jZ1xn63ucEXR8iXrsEZAgt23F/lwHh5EkTvb4:Hxn6Vz/m21OHhxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648600, "uuid": "2940003c-df4a-4b48-8a57-e0d73a819531", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648600, "uuid": "dc41ad69-81cf-4131-b56f-cf65a41c206e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648600, "uuid": "26f62556-2635-44e9-9b1f-be193a8897e9", "value": "dfb0833ee43a895b4475b4df229253bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad503126-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648282, "uuid": "36bfb673-1c1f-4349-95ac-751b8da0b923", "comment": "Malware payload", "value": "14e3671def9be405b0d8aca3c4d477b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648282, "uuid": "bed98efe-217a-46c9-8e39-4bc2adbd0bf3", "comment": "Malware payload", "value": "147b554b67aaa224e7a1e50f259f26ff11be96d9ee6da5573ddacfdb32045c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648282, "uuid": "9b62207e-b87c-4676-9c36-803c8ac111ec", "comment": "Malware payload", "value": "1d76592cddba8362a8ea57a11c224389f86ba533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648282, "uuid": "1c8c054e-2dff-47d3-8a9b-43d73dc29321", "comment": "Malware payload", "value": "11f0997b3e5de79520cdcd89c0099c603ee4107ac9a50c825634f4f214f577a52dfc0b09f289099b8e72d48aa1973e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648282, "uuid": "0d31c92d-05e6-4fcc-9f13-2ca80181204e", "value": "T1A3C533CCB94F11F0EEC25434D297E98CFBF494F02594C10CAD876C866C7AB5E983AA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648282, "uuid": "318d1acb-ac6a-4870-8a88-bbd4dbfe3d38", "value": "90dd89b6b8fe2e3297928913f3acc5f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648282, "uuid": "612d6f65-a333-4db5-851e-e9b8e22c798b", "value": "49152:986J+PD9KRXVdqksgla7K2X9Sy29XEk3cyAEntzSDqENlJCsux:ZMb9oCqz6ot9Rc3SqRNlrux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648282, "uuid": "326d4766-d015-4560-b279-fccba90a88cc", "value": 2690626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648282, "uuid": "cee08a92-dfef-4436-b5b5-0a2d49933d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648282, "uuid": "d421dbba-014d-4a7d-9a8e-6c8ffae8b68d", "value": "14e3671def9be405b0d8aca3c4d477b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5955f608-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678642128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642128, "uuid": "5a9c45c5-551c-4690-a508-d499939ac2ab", "comment": "Malware payload", "value": "a63f9a7ad92bb5643a350e419eaa24e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642128, "uuid": "c43e8323-5354-4d32-b549-1d86b76c9875", "comment": "Malware payload", "value": "14c97b57b65c1b6b6c35a29760a061e101d72ad11025a0d7a171221227ce7d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642128, "uuid": "7cd23e95-5fa4-4b82-a4a2-5c34697f3fa8", "comment": "Malware payload", "value": "43484e507ad12d74edd087648438d8837e2f6f26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642128, "uuid": "71d975ec-8bbd-48d7-9518-7bf4f31932ac", "comment": "Malware payload", "value": "cd88dcbb22a9253868a9e2a915368f3d8b295ab825384ce1443759c596b33c8faff7ade3be92be4b55d5d0dac25e9982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642128, "uuid": "1062d729-242e-428e-9c58-d7cce90f0860", "value": "T1C8D58C32EB049132F5D211F1991D1B6F894CA53403B940D7E2D63AD969E0FE36B32BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642128, "uuid": "9bac5103-249d-4ca1-aea1-8cd3a78656af", "value": "476e0d8710d77d835e610a586e499b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642128, "uuid": "057829ee-ae60-4516-afde-896c63304979", "value": "49152:/JUdlQCNAkGnq6no984vLDpQ7b+bkc3J2BDCM/Tve8itMz3jS:BUjQCEmHe7b+bkc3JwWMa8YMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642128, "uuid": "08c6a744-fc4a-4ad3-afb7-b03044637c89", "value": 2791936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642128, "uuid": "6fdaf25d-e8e2-43f2-a5e7-ed8c3c86977b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642128, "uuid": "7af1b01d-d051-4ae6-99cb-a63e48ccf9a0", "value": "a63f9a7ad92bb5643a350e419eaa24e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37d446d-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678642789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642789, "uuid": "bd209740-ef50-439d-a298-0cfabece7cc3", "comment": "Malware payload (Formbook)", "value": "961c9c4f65267e43e44e13b6bf265f6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642789, "uuid": "e95f7619-20bb-4756-bf10-e6de538917c5", "comment": "Malware payload (Formbook)", "value": "156432010c9c69932d05b3420b22ae89d29e4d858e0626031ed4856f1b3a00cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642789, "uuid": "919bc38c-ad47-41da-9ad0-bfd75e0c9d4b", "comment": "Malware payload (Formbook)", "value": "33776c4a9f5989f733f6047cd3fbecb488d1688b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642789, "uuid": "1d3b0e29-5fc4-4571-b7d7-4e85d89cf34f", "comment": "Malware payload (Formbook)", "value": "01d9683c46c766e0edfb088aa8e90d87bb6e5b70208c5a826805751ae059456aa5fbd4f4468e30a5b244f2f8eb33ac5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642789, "uuid": "e743251f-f04f-471c-974e-4a58c8e20507", "value": "T1E56412093244C273D8AB2F300A2A5671CF6AEF521AA9460F17657F4DBE37542AF4EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642789, "uuid": "827f801b-de55-4d36-b416-324104023ddb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642789, "uuid": "52bdd736-7ea9-44b2-88e4-515a1df80e6e", "value": "6144:+Ya6e3D2t9hg068nDs+wW2bRmLhW4dlNNwl4jmfX5GJBL12Q0u:+YY3D2L68nDdwW2VUJdlNNQkmv5GZ2Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642789, "uuid": "f7064f68-a692-435c-90d0-ad94c0df120a", "value": 336103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642789, "uuid": "57415cb0-65ef-430f-82dd-fc743b6ed71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642789, "uuid": "8dcad501-7b16-464a-8454-4b63645a2295", "value": "961c9c4f65267e43e44e13b6bf265f6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fdd57c-c0e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678633216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633216, "uuid": "cc7fe998-d5f0-4330-9e83-2514306236a5", "comment": "Malware payload (RedLineStealer)", "value": "42e53d837c6ec79f61fae2cd024ab3b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633216, "uuid": "603f2299-981e-4f8f-8332-d58ab58e68c0", "comment": "Malware payload (RedLineStealer)", "value": "166a89f2f7e0fdd7d7f1ae3f4ae51677e1febb9573d33d9c8f67f24b2fa53818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633216, "uuid": "5f1ba8ac-fe94-4c64-b255-75cf474762f1", "comment": "Malware payload (RedLineStealer)", "value": "b894960f52fc66eaad9d2d2c80ea01d04ad97d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633216, "uuid": "e097729c-e1ac-4a88-aa1d-ebdaaf57fe50", "comment": "Malware payload (RedLineStealer)", "value": "f9e72a43d96a309b4b72392a5b6f2bd490c9aa41b3eed0fca314c1ccb0c5fc9d75bd6ce37b382bbc539a15c8d862b3c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633216, "uuid": "e60c0cfb-c400-4e97-9e9b-8013ff38b9dd", "value": "T16BF40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633216, "uuid": "dfabb5ed-73c8-4420-959c-4b4e49813346", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633216, "uuid": "58b0302b-134d-48b5-adb2-05fdc86fd755", "value": "12288:YtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:YtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633216, "uuid": "6b23b3a1-0cfc-4811-aa7b-574d4d3387d3", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633216, "uuid": "938b6faa-ca5d-4048-89ed-7529a354f487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633216, "uuid": "3b26e37d-1b37-4fa0-82bf-37dda714be17", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c84685-c0c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678617319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678617319, "uuid": "ecaf117f-46a9-46db-8df9-39c854ce033b", "comment": "Malware payload (DCRat)", "value": "34c2ce6ab4499f8decd585ecc06ec4bb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678617319, "uuid": "fdc60cc0-a752-4a4b-869a-a8480ebc3657", "comment": "Malware payload (DCRat)", "value": "17303a8f6309aecccfce184b38daf556e50db1f166f6eded94795a319085e642", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678617319, "uuid": "56758de0-3dd6-4f8f-bd83-e9710eaf817c", "comment": "Malware payload (DCRat)", "value": "094da2f74f2efb7cdd4927ea06655477227ebe94", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678617319, "uuid": "6d6ee62a-745e-491c-b0e0-d2e17f691bd8", "comment": "Malware payload (DCRat)", "value": "5b0e9b8d59f513bf4f89a39e41263878eea424a9addd92c1be4c47c3c6259c7038323f6445ce6288a2315e62bf372c83", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678617319, "uuid": "1d517e39-1f1a-433a-871a-6be30bc7b823", "value": "T138556B027E44CE12F0196633C2EF594887B0A95166E6E32B7DBA337E15123A77D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678617319, "uuid": "1de11b63-1e5b-4eaa-9acf-aa084119df93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678617319, "uuid": "e6ebbe0c-b31f-4ef1-abf2-46137872cd8d", "value": "24576:X62jhlaS8Wi5JGy4ieXjITaSqRJ9FKRqMW3FsO1:XhzaUW4BKal8Ivx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678617319, "uuid": "1135dae0-5526-4fee-8548-24228522b897", "value": 1342464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678617319, "uuid": "4f760bbe-39d2-40b7-b698-dcff42176624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678617319, "uuid": "50e36f58-4f3c-4207-9f53-01128dd6e084", "value": "34c2ce6ab4499f8decd585ecc06ec4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9b2d45-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648658, "uuid": "5161038a-87ae-41f4-9b1f-de01eccb9c34", "comment": "Malware payload", "value": "da726d3610f5ba8c4ea24f251875fc2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648658, "uuid": "9015bd85-7ec0-40f1-88cb-fca8054e4b09", "comment": "Malware payload", "value": "17e4aef2887fce2fec9ed8064850900bbe09a3e0a535a820fd6e699cd09af403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648658, "uuid": "b7344bac-a140-4e59-9a55-6a49b055421a", "comment": "Malware payload", "value": "3cebabd8ac8712f990ab033b551837c96db588cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648658, "uuid": "73094b17-840d-45be-aa87-826dbc0102ca", "comment": "Malware payload", "value": "171e3f94bd673df74d9333eb395f5b13923bd2082773c701c7f0e2a9fa4c741614c354842325f6e13a42743877796859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648658, "uuid": "09867caa-e4a7-46e1-a8cf-82e8bf9a1843", "value": "T19A36021AB9648C64D493D4331015D763A206D69EBA18CFCF23B01D06FAF55EB8B12BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648658, "uuid": "0a90b07d-3544-4d6c-bb14-7c1575258a52", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648658, "uuid": "276ba875-c556-4ace-9a8b-4f053cd81163", "value": "98304:1q29KaNjf5rBIZU86Ch3/NCFBdkPo3TsWVBGAa31RAXHp+TmX3Gt2U6cm:h9DNr558bhV8dkwDsiBGAa3cXJ+yX3Gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648658, "uuid": "300acf01-7613-479d-961a-5d37601eac9f", "value": 5116024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648658, "uuid": "c59fe576-285d-4190-a977-b19a9e595190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648658, "uuid": "84d64cc1-7961-4a61-9a01-2454af054b66", "value": "da726d3610f5ba8c4ea24f251875fc2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04419a2-c0e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678632503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632503, "uuid": "01910e2f-8cf6-4e76-bbae-3209da833e5f", "comment": "Malware payload (Amadey)", "value": "f6c85dbffcda562390e6821303f9a185", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632503, "uuid": "427ee06d-684a-4dea-98c4-5bbe29701db1", "comment": "Malware payload (Amadey)", "value": "18639951491277c647bde41ff7518a6ee204836b5f4bd77813d9fe6d63893315", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632503, "uuid": "927ada03-a8ba-4811-921b-4ec66b9135af", "comment": "Malware payload (Amadey)", "value": "fa8b9e6ce9f6ba382aae82a99fbf1b611e7f5d98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632503, "uuid": "d971bc09-31b9-44b7-a01c-88f38eb893f9", "comment": "Malware payload (Amadey)", "value": "e155b40967ab25f1499203b25c836150d432fc6d3d18dd9820e4ca2946f920d8357f193d3b9e35c56c3443d7aa0d8bfc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632503, "uuid": "c56b9c3c-c55b-41e7-81ed-1eae4dbe43f7", "value": "T1DDA4E13296A17824F5628E329D3FC2A4261FF8A15F6957D732046A1F0A711ECC5F3B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632503, "uuid": "a6350903-55fc-4afd-8b4a-cb03a2ae3afa", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632503, "uuid": "e87068e0-a703-42f7-81de-6cba7ca542b2", "value": "12288:wpRYQp8r2yS44YOfXqfTsAQvNKooICHciGxa7pA:wv58r8YOfXAsHQooIQciGOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632503, "uuid": "029abb96-a20e-4364-949e-9ce5342cbfa9", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632503, "uuid": "bc02be65-cb83-4409-a45d-78a1a11e826a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632503, "uuid": "6233e865-a109-4f31-872f-7756c0044782", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272ba112-c0f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678638608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638608, "uuid": "4944c66e-2fc7-4eaf-88b2-895eb3ae6836", "comment": "Malware payload (njrat)", "value": "094af2cf14be5e00d331c213b62af22e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638608, "uuid": "a3978f69-bc63-423e-864b-faa55aa3f663", "comment": "Malware payload (njrat)", "value": "188123f3bf7cb4200eedfeeda1d4835d8331b22aa013f0eef83d205ef08153e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638608, "uuid": "0e761fdb-e985-4d3a-ba62-250ba872a99b", "comment": "Malware payload (njrat)", "value": "d45a716adb8e74c935531bae90a53cdc358a98b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638608, "uuid": "da78099d-5c4c-470a-9779-7f95207be08f", "comment": "Malware payload (njrat)", "value": "29ed8c2bc35b7acb7c0b7332a9ea7aa2c516ced0f33bb88343f2e6ab306bae8d18ed713a431f3b310f5e5b9d714a9d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638608, "uuid": "76c986b6-3df3-4963-8977-8cf931468765", "value": "T1D9F3299AB78A4B05E5BC0D7190FB593403F1AAC3A532E2853FC4759D8E122D75D0EBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638608, "uuid": "bafd014f-e5ed-4097-9ec3-98a5e49ff4d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638608, "uuid": "7af34566-74ba-490c-ab79-62c0267da5db", "value": "3072:yEkwM/7nv+/ZUGCqKiTzDnL8l1teENz/BV0bzD3aNpvDZ+lf:yEkRqKiT3LYjR/BmbibZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678638608, "uuid": "4b603484-48d6-4406-be68-182a931a7827", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678638608, "uuid": "ae944f79-890f-477d-af12-ef6a424b8afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638608, "uuid": "02aeb29f-d2b2-430b-8b7f-3067952640e1", "value": "094af2cf14be5e00d331c213b62af22e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1978f18b-c0e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1678634290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634290, "uuid": "148eebd0-7734-4040-8464-5b07d6c38dff", "comment": "Malware payload (Stop)", "value": "a6687144b52fdbda555d37114f29daa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634290, "uuid": "28c38136-77a0-4e3a-b5e0-09185e29ed9d", "comment": "Malware payload (Stop)", "value": "199cc9569607edeef118140ec03515ccbbd8dbc31a0f3e597fab09f6efccc2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634290, "uuid": "cf4c9a85-c889-46d5-9d5d-4d05d27cd291", "comment": "Malware payload (Stop)", "value": "b20f118974c0e194971c4430ec6aded92e74f180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634290, "uuid": "4fad22f9-d649-4013-8f96-854d76e5ca65", "comment": "Malware payload (Stop)", "value": "b7fc9eb44067280119cd4c40aff14ba7a0bf903d5526a87262895c2d4c203389e4d0346ac2d17e137ff07e9de3438d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634290, "uuid": "67faabf0-ee50-44f6-afe5-db655fc1872d", "value": "T1F5E4124273A07952F5A7CA756F2F83E8662FB8714E58A76E32045B2F0FB01E2D463711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634290, "uuid": "1a66364e-0cd9-48c7-9faa-c2549d8c2e2f", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634290, "uuid": "68755c82-4e67-42f7-8897-4dbe86fdbff8", "value": "12288:JcuaXyK7IEu14C6t3e50Eu2lVUpEnTLZUSUjbszZshnnbgKOi3Z9eDaVBMeM:n5x9DK2lVQEnHZb+aBi3rVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678634290, "uuid": "86d74b3e-a56b-4c4d-9e1a-669a4d853108", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678634290, "uuid": "479cfab3-c75f-47a3-8214-fb5e03d7ee61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634290, "uuid": "980020ed-7716-460c-884b-80de47c73a84", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7f2a9b-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1678621331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621331, "uuid": "24484037-44eb-4912-b8eb-2b14e3bd4122", "comment": "Malware payload (LockBit)", "value": "fec0ba68b3118f490dbee9dc5cc382d4", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621331, "uuid": "974fc956-b62c-489c-a156-3b4d3dca8ef2", "comment": "Malware payload (LockBit)", "value": "19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621331, "uuid": "181e60d8-f216-4774-b899-2a918e8b4152", "comment": "Malware payload (LockBit)", "value": "c5a76c237314d970fb5acfc118c1f1109d012704", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621331, "uuid": "dcaad00e-d748-4d07-889c-19ddb3560932", "comment": "Malware payload (LockBit)", "value": "1ecf9d52f4336ad1c99654285330b775975a60a4ee29232aa163276c4c2e42ead478bcf883050ba3ad3b73b043b8bcd5", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621331, "uuid": "ba81c69f-d6c6-41bd-881d-94dde30b4f69", "value": "T150253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621331, "uuid": "46b83296-b605-4357-9165-c7d32bab9252", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621331, "uuid": "14887870-1248-4d50-9a21-d0b9976449b8", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621331, "uuid": "e6a16049-f61a-47ce-a45f-17309763cb65", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621331, "uuid": "45fff697-5d9c-4d45-ac89-d379288d61bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621331, "uuid": "e899ac39-0706-41db-b294-186e6fd4c683", "value": "2023-03-11_fec0ba68b3118f490dbee9dc5cc382d4_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60904bc1-c0a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678605204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605204, "uuid": "58625944-e835-4729-9a6b-b9b6dce1b5c9", "comment": "Malware payload (LaplasClipper)", "value": "7c85eb3eb5a5d141d5ef1f7864ab2859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605204, "uuid": "11f77db6-b71f-48f7-8ee8-f31dd775f827", "comment": "Malware payload (LaplasClipper)", "value": "1cc7072f07ca3eda300e2ce851338f96ecca934d3c5325fbb72935ddbdbec1c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605204, "uuid": "a1a0f5f1-de90-49cf-8201-485a20cfc994", "comment": "Malware payload (LaplasClipper)", "value": "edc3b3ca51f746d2d553cda2617c431b77fc21af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605204, "uuid": "04f4ca2a-d7a6-41a3-bad4-0e56555f1ae8", "comment": "Malware payload (LaplasClipper)", "value": "775f2b5b6f7bb59e5389e2d16c7bcae739877b071f7f6e5a50bb09400cca3a4d13377d8dcfa18ceaa5254ee50d908b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605204, "uuid": "ebfcc95b-0253-4c2b-8429-4002c510db85", "value": "T17044C01273F16871F5B3CB319F2FC2F83A7EB8614E69675E22149A2F0AB11D2D562311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605204, "uuid": "596c59bf-ed24-4c40-bc79-1dd08709bbf8", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605204, "uuid": "ff67e96e-c154-4ef8-afdd-1be498c3fae3", "value": "3072:BNlq/uD4ZxAeqqqIFQ3YerRiAVBGsGRZTpBMUF5IrQluJ6Ov6Hw1BmlfgQtRY4fh:pqWDoxrQogvVB5GRZLMrl9yUmltty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678605204, "uuid": "5ca008f4-fb43-4789-aa51-22e497f839e9", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678605204, "uuid": "c72de168-66e3-4cfe-b70f-4707208c1659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605204, "uuid": "8fdf6a43-299f-4ea5-aa34-a2facd1437fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1114827d-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642866, "uuid": "4e106b7d-a46a-42a4-970d-dd8d3c7c0f28", "comment": "Malware payload (Mirai)", "value": "ebe439d25a078956847760f11826b5a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642866, "uuid": "6ebe3501-db84-4745-9b41-ea7d1f2c4b94", "comment": "Malware payload (Mirai)", "value": "1deafe494598e6f13b64cc896c9f088ff5500822bd993e781421c06628be08ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642866, "uuid": "93b7bde8-183e-4b10-b086-c8617f316b13", "comment": "Malware payload (Mirai)", "value": "20296053476dae79017f8b1680f491697a63f352", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642866, "uuid": "e81668d6-9923-447e-9271-5326c3184d22", "comment": "Malware payload (Mirai)", "value": "8bc2767a5ce9e7ea7d705eb1ddf0f7198208fd72e818d8d62e4e884acef6fca1451761d9c6efd86bda17896060176aa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642866, "uuid": "b59cea3a-4738-4e67-8ae0-d509213c204b", "value": "T1043302AF4BD38DAEFBF2D9F657A25BB4FE0134C35B8B485B5B7C60451812130B826192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642866, "uuid": "dfaf8564-513e-4cf3-8408-34c5923f1ae1", "value": "1536:WyadVtB4JyL6McpmHmIM+uh5JgdVeEtAyx3y:W5dB4bg+h5qe63y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642866, "uuid": "a3808c9a-b3c3-4bb1-a791-762eeef38b77", "value": 54344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642866, "uuid": "58a857b2-9597-40fe-b7b9-52241814ba05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642866, "uuid": "f0024907-bfe1-4fe2-91c8-afaf4ec71043", "value": "ebe439d25a078956847760f11826b5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8afad8-c077-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585571, "uuid": "1e3efa8f-ee04-4e73-a4a9-bd2ee2aca495", "comment": "Malware payload (Mirai)", "value": "77a9629a5d26ede70eb70b5198495a28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585571, "uuid": "3fb2a856-3503-4b93-89c9-d92ace14bdfd", "comment": "Malware payload (Mirai)", "value": "1e2c5b3c8e75282beb9c66c66e89373f8979a873c9a10da928c325862436b853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585571, "uuid": "ce96fcb4-931e-4ad9-b8ab-2d9dedd39141", "comment": "Malware payload (Mirai)", "value": "0bbef91b0ebc3f5b5a296be5971f647c193e7c50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585571, "uuid": "8c74a6fe-3c13-4828-b5be-71216c32fefa", "comment": "Malware payload (Mirai)", "value": "e72b56f2f35a9a1682485863cdff1be619568b14128f76a09d16432e18ea1d19e07dc39e1910b95a9d3d43eb5d8dbe8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585571, "uuid": "526eb898-a64f-43fc-8b63-271cc5e54b1e", "value": "T14B633A0177584E43D1A61EF9393F17E193EEEE8021F4F6846A1ED64A5232E33494AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585571, "uuid": "fd5f6c1f-78a2-4122-968b-ad69b20e5b62", "value": "1536:2NJu2qcDgbLOx+j4FCbhJLCI/Set8SjBZD:2OPcN+jfflSetTjnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585571, "uuid": "57b5e28c-6697-4398-aa72-1de4562b93e4", "value": 67568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585571, "uuid": "93aaa06d-9cc6-4354-81ef-cd08f3d87484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585571, "uuid": "3e9b37b2-06a2-4896-95db-4aedee581947", "value": "77a9629a5d26ede70eb70b5198495a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e94745-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678628330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628330, "uuid": "850370da-ac36-45db-bf74-211fab10a4af", "comment": "Malware payload (Mirai)", "value": "1a362a398cefd4f742bc5ff0f8f0ea2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628330, "uuid": "b1c67f93-d31c-4c39-a266-dfd6c3d2687c", "comment": "Malware payload (Mirai)", "value": "1f480f55d0559674865a0d836b192df2026a1a0e81051dd6a620ce5b24e96772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628330, "uuid": "41638a68-c6e8-47cc-8db9-8a8257fdcb23", "comment": "Malware payload (Mirai)", "value": "40d8004dc03e1ecee7286405880db31723b75b13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628330, "uuid": "5a30f68e-1ce7-4e85-8535-f22669ddfcb5", "comment": "Malware payload (Mirai)", "value": "949f4b6d2bafc5211c87e5f9f020ca2aa820c8d3d88b238995b16da8648ca1db0db6ba53df8f902a2bf3ab88117b780e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628330, "uuid": "72ea2dcd-e296-4f5b-a3a7-1a5593486cff", "value": "T1F6B2C0CD61543084C98DBC7C278D4A674F6CA1D0BAED9B16E360CD9873BDA8B3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628330, "uuid": "4e5782f5-28b7-41a4-96f8-4235fd017271", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpgZqEWvi:/QlS07FUXqIYSXQKqu4qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628330, "uuid": "c24b4690-0adf-4e23-9346-c8e1f12f48fe", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628330, "uuid": "3c383ecf-d1d0-4421-af9e-1d2999097091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628330, "uuid": "8a261668-66a9-4bc2-acdc-b9d9998237b0", "value": "1a362a398cefd4f742bc5ff0f8f0ea2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6cee55-c0a3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1678604255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604255, "uuid": "53731dfc-3615-4fd3-916d-77957eff04bb", "comment": "Malware payload (Tofsee)", "value": "8d6e1abd179a428fd19240e8eb83fa05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604255, "uuid": "82498855-4783-451f-9503-85494ffeb1c6", "comment": "Malware payload (Tofsee)", "value": "1f6a2ebd5e58a939503b1b51a6e22090e80bc39099f715852cb3719b32e4a7d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604255, "uuid": "b23c69a5-47d3-4a42-8aa8-81c252a56f24", "comment": "Malware payload (Tofsee)", "value": "3b61a9fd7bad28e2bc02190c388d941d8d9f88f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604255, "uuid": "b9a490f7-b94e-494d-93bd-b257eba0bb95", "comment": "Malware payload (Tofsee)", "value": "1b590c908f45e9ce6f2ea9a5c6e4c7c42550be0ba00b85a30625a14a5565bf6f5f31271bed6f041a1a194c6b04ca7618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604255, "uuid": "634341f9-e08f-4801-bdde-c7b78b1ccb32", "value": "T154149E1273E17821F5B3CB715F3FC2E42A6EB8614E69676E23045B2F0EB11E1E562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604255, "uuid": "c64f605a-01fb-48ca-800f-1e13ab0437b6", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604255, "uuid": "3c9a0a1a-eb17-4caa-85f5-e84505b17ac6", "value": "3072:vQIqjva2yglqq4iIB03BZontUtmPBpO+fkfSFX6y+TIYI:vqLa2yriN3BZontvk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678604255, "uuid": "5418d9e1-f7ef-4569-a152-6f9e19b3bf1d", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678604255, "uuid": "539b7a04-3b8b-44c8-9e3b-6019bd26d539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604255, "uuid": "2ad7dc22-8ea9-4c02-aa6c-8a857c19e869", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27551b69-c108-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678647628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647628, "uuid": "6e8c9b4a-403e-4835-8366-0b3b66ed95ab", "comment": "Malware payload (RecordBreaker)", "value": "02a0844e14c943fda141728ceccc1c8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647628, "uuid": "4d151a0d-37b2-4558-b2be-925558c82d9b", "comment": "Malware payload (RecordBreaker)", "value": "2035adb734e272d7bba98ab34faa9a5ee0457ea24b940688d1cfd8ba622988f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647628, "uuid": "7f47e990-68a1-46d7-a89b-bdb73b160b68", "comment": "Malware payload (RecordBreaker)", "value": "681ff95d20d4b20c51d50b0da2890fd6b3a30a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647628, "uuid": "804ca5e1-a219-47d9-9d99-d60c4c300780", "comment": "Malware payload (RecordBreaker)", "value": "4d2e92c835b175625372701eea841dfd80f51c48074c45c31ab8dfce6f44604fbfb1de682b68d68c717d6d783741a249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647628, "uuid": "8fe8d260-0686-4b0f-b189-2a5f2a93f3b5", "value": "T13EB6337362680045E5F5DD3D953BBDE632F373264BC2A8B4659DECC21A239A5E603B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647628, "uuid": "5cb32d42-d6aa-4b89-aad8-e27cb989c74f", "value": "a9168cc43274820afc74b8e42a968652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647628, "uuid": "2418f854-2a75-4bba-bbc9-537df01b4354", "value": "196608:nNjXgrvo5xsSYBmIOhdxfCxs5sFRXTQojht33KL7GYf0hgIcqmi/SWxM21r8:teoYLOxfC65YRjzht36+VgM6Wxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647628, "uuid": "4b75f180-65d1-4501-937e-e49c2abc354d", "value": 11001152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647628, "uuid": "325ec936-bd66-4677-b5f8-582f46c154c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647628, "uuid": "ea6c5d52-8206-4c0b-84c2-38ef6e7596db", "value": "02a0844e14c943fda141728ceccc1c8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc58b56-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678642649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642649, "uuid": "7223da5e-9939-4a59-9593-3aa3ee5311d9", "comment": "Malware payload (Smoke Loader)", "value": "a118a1e07e15162e77cce97c0f921e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642649, "uuid": "3eab061a-e64a-4e02-a51e-630ad7e74622", "comment": "Malware payload (Smoke Loader)", "value": "211863e8f6bf12a126bd67c072cf375ebf5d9bd48b1d38af9712139a82a2ae99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642649, "uuid": "6e3c1069-1e46-4df3-bbf6-4c3e6fcaddf9", "comment": "Malware payload (Smoke Loader)", "value": "9c622225f69b6de41c8fb1868b630d7f60ae2550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642649, "uuid": "ed6a143a-a450-45e4-9d79-17930db9b8d8", "comment": "Malware payload (Smoke Loader)", "value": "359b7a6b8036b79c602b02253b5c603485dc86189e192b7390d518e3ee87f3f5a6d797f93a2faa90537aa28b35b5a765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642649, "uuid": "47961f5c-08dd-44ad-988c-6b32f350f73b", "value": "T108148D12B3E17861F6B3C7719F3FC2F42B2EB5614E68675E23045B1B0AB21E1E562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642649, "uuid": "140412bf-e5c5-4af1-96c8-7d3df962404d", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642649, "uuid": "8041e84d-2284-4a29-8edc-54925dabae78", "value": "3072:M07qR+K5fEIqqZa2nzqR/qCF0Et+vg5o8xmxauAX6Z+TIFYI:/qwK5fZTW1tKE/xmxauA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642649, "uuid": "34461e83-328e-4b80-bcbd-973f05714839", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642649, "uuid": "a9ceff6d-886d-4603-a740-c20c20e266e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642649, "uuid": "010b2099-48fc-4cf7-bcb7-2f8210130162", "value": "a118a1e07e15162e77cce97c0f921e6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1fdc9a-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678648844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648844, "uuid": "a476188f-18ca-4db0-b769-0552e7a9497a", "comment": "Malware payload (Fabookie)", "value": "7ecba2d73270388f9ac69ab36aad8351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648844, "uuid": "df030a63-6dd2-4fd5-b5b5-b7b2dc33f2ab", "comment": "Malware payload (Fabookie)", "value": "217ff786e98d8763294e360042af0717011ab7d017d2150f47250dc1fb0b7790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648844, "uuid": "2e61af40-2be7-42b3-be10-624ed8ebb781", "comment": "Malware payload (Fabookie)", "value": "ffac91e740e629608afccfa61b8b9aa25525b050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648844, "uuid": "88cceb10-de8b-43f4-bd65-c7aefd49ced9", "comment": "Malware payload (Fabookie)", "value": "47f51571f107c15b0f79217cd130663014d7c62a8fbfc457f0f23cc72a16bbc1206f7e6918a726d35063b98069e87579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648844, "uuid": "821589fa-f3c5-4f84-a4ff-623e219c371c", "value": "T17505AE219122C95BC310343CD885A5F5EA9CBC60C759CBE3BA55BC1E7E36AA94D3C0F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648844, "uuid": "25cb9305-fb36-4d68-a235-6a9608615972", "value": "a0ad82b564665412272991ba09f43857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648844, "uuid": "b7aa2640-da42-4dc5-b981-86577a2c5973", "value": "12288:qrtKU5Nk7yK6+X/P6+X/6YCoPsk7vFIlv:SpEyFg/yg/6YCUsk7vFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648844, "uuid": "7bdfa1bb-6fc8-4b2d-86d4-adff7dd2c509", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648844, "uuid": "b2ac3113-7838-4695-b7ed-0d15e1cef1aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648844, "uuid": "8edbdf32-cfb3-411e-9b2b-c44b03226754", "value": "7ecba2d73270388f9ac69ab36aad8351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413c5aa3-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678628344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "0b1930e7-a332-48ad-a2a9-635fb32c3686", "comment": "Malware payload (Mirai)", "value": "5dabcc014cf3e16c1797306357e10494", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "f94aed7a-4613-488f-8d85-6e66546dca4e", "comment": "Malware payload (Mirai)", "value": "223fdb1e5c6f5c7c1ecde7eaafea51ca8865795bc0f981f49bd71d3976d90caf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "f08e5cad-67b4-495f-8fff-b5cba411d254", "comment": "Malware payload (Mirai)", "value": "6be334a0228e0a3f42f8e64a185c753959a3af69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "a85a2656-831f-4a1e-9ac1-1c6f66ecf3ee", "comment": "Malware payload (Mirai)", "value": "d99aa5a8fee86d52b2472bc9827240b65105e35ccbfb40917bc55b73f8520313775339a358378b0412ae21a9d3cddb64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "91fcb65d-6b4e-4870-b71d-ee008df7d586", "value": "T137C2D1E07726FA31C420AC3DE5264D8A3A51067C81FF353664258D399FC169A66E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "b7342de7-9ee0-4592-a7de-f8cb4d89de06", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrsXk9q3UELue:NKy4qfqoeJdXWgINLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628344, "uuid": "2984119b-88c9-4ed0-9163-8c8e28a5c17a", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628344, "uuid": "e4e939ee-6784-4b5f-abd8-1404f9644cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "2f4ff507-bcdf-4a82-bb98-784f2932c18e", "value": "5dabcc014cf3e16c1797306357e10494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00777e82-c0e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678632960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632960, "uuid": "50a0d540-b1a0-4943-8cd3-ba85ef714903", "comment": "Malware payload (RedLineStealer)", "value": "2c406a5a35113e6c83aac6889657a56c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632960, "uuid": "807213cd-dbb4-4568-950f-39fb23daf4fc", "comment": "Malware payload (RedLineStealer)", "value": "244281a32a9da1dea28355b0cfcc20e35613001a6b6e5a48dde9ac59521ab78d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632960, "uuid": "28e87f06-b0c8-481e-8d29-5d296f082289", "comment": "Malware payload (RedLineStealer)", "value": "5202c13a23d6d6ad5fb0dd543010743e9c1562a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632960, "uuid": "e867a467-b54b-4299-be5a-23b32d66cdf0", "comment": "Malware payload (RedLineStealer)", "value": "76157c508280d57c21ae45df5c00deaf630cde970c38a4206a0e885c1627f6a377f030ecac089e383a43efef50622836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632960, "uuid": "1d2fcb1a-cb06-4ee3-84cc-cf631d16d5b7", "value": "T12AF40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632960, "uuid": "5f82acb9-dced-4238-b0d7-af7feb8cddf2", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632960, "uuid": "93e27d7d-cf1e-4e44-81be-2a1285f18010", "value": "12288:GtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:GtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632960, "uuid": "a48fa047-e8e4-4d9f-a0b6-a5921109bbd1", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632960, "uuid": "ce3cfd4d-8427-4174-9e28-d2fdd91dd3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632960, "uuid": "94d514b4-2bdd-478e-a1c9-1ce4f3b927bd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33710c9d-c111-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678651514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651514, "uuid": "363baf02-ca5a-4388-a672-335c8c6ca895", "comment": "Malware payload (Rhadamanthys)", "value": "0c4e0091a31c71cf4fcfd6b6745f3440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651514, "uuid": "66a52db5-651f-45e1-80cf-38841a05a546", "comment": "Malware payload (Rhadamanthys)", "value": "2473d2451cb6e066df31a2457c700cd9e0b1585db96716c981b3f34deffdfd26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651514, "uuid": "e92db184-7d74-4bea-ba55-2e77a84f0293", "comment": "Malware payload (Rhadamanthys)", "value": "325159ebb29f070a9738142a3baf5f8ed29372d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651514, "uuid": "3db87f66-19f9-4b31-b5e9-0c5802811898", "comment": "Malware payload (Rhadamanthys)", "value": "e73452bc95205eb05478342000dd64b30863b07fc39b83f5c816668fa59cb49b3fb4bc0f62f08eac1cde7ff1ded277d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651514, "uuid": "fc690305-5e8e-4a17-8e7c-97a3fa1406f8", "value": "T17B44AF3253B07861F1624A319E3BC6F4762EBC619E6467CB22186B1F18B11EDC5F271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651514, "uuid": "17d3caaa-4b01-43d4-ab9a-4c5ea4f2385d", "value": "8f077cc2038fae85c4e9d8c60b51a269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651514, "uuid": "65bd0597-48d4-47a5-82d2-104bed59b6de", "value": "6144:Ji1sjjewfyqoGHbz61OW63fTqYh/156aZfM06ELyq:asjjU+zEOfuYh9sU6EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678651514, "uuid": "14c6fbcd-ea3b-48af-8145-6368ce0cf0de", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678651514, "uuid": "51859964-98eb-4b19-9b00-68397987791a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651514, "uuid": "21ccfe29-3777-428b-9142-25381d80e075", "value": "0c4e0091a31c71cf4fcfd6b6745f3440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b729bc-c0af-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678609586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678609586, "uuid": "615e82de-e299-4cd2-98b4-c839057a9abe", "comment": "Malware payload (Amadey)", "value": "400ccabb38687fe1b4bcffd8f3fdf43f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678609586, "uuid": "f3828f81-a4a6-4dfb-8f40-329e561937ad", "comment": "Malware payload (Amadey)", "value": "24780309119624377675f42c9895add53a0119cb3a1cb860f0ef602e8b8497ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678609586, "uuid": "eb7975eb-0f36-4dce-805c-45ddac9acfbd", "comment": "Malware payload (Amadey)", "value": "7b12ea0464d92285807c4e5b0c3261fc3f3382a6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678609586, "uuid": "ddacb1b9-4681-430e-8cc7-62a0fc0d21b3", "comment": "Malware payload (Amadey)", "value": "05f7b30f7d5a32ada0e6813049c93a48670f8658219ad06e735d51191650585de54c644569a6a447e76819a5cb1ba85b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678609586, "uuid": "783d93e0-f161-42bf-b24e-0711009111c7", "value": "T1D2A4F10373F2AC61F6A7CB715F3FC2E46A1FB4604E69637E2208571B1AB11D2E662711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678609586, "uuid": "f917faa2-1163-4ac9-8846-ee03eba62355", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678609586, "uuid": "af80cafc-a395-4765-825b-ababa0675a8b", "value": "12288:cxFGgNXEsffo5TwN8srb5ZisaL86eb36y2R:c+s0sIdwKSXi/L8rKy2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678609586, "uuid": "43a54525-d045-4fd3-9f6e-c61489fbe1e5", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678609586, "uuid": "b3534110-2eb8-4ca7-9a8d-362177bde859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678609586, "uuid": "b798a7a3-15f0-4817-9739-f5cbc242aac2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418683eb-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1678628344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "e601b93d-51f5-459d-a783-66e0a6726805", "comment": "Malware payload (GuLoader)", "value": "595dfd7b53ca113b1caaad0565ce7568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "869e324c-bd71-4ab1-96a6-acda8decb5c9", "comment": "Malware payload (GuLoader)", "value": "253f5d458d58c68d652d8034d533b958226b72ba3f9e120acb2b7a8808aa052e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "cfddaccd-86e0-426f-8698-e47effa624bf", "comment": "Malware payload (GuLoader)", "value": "19fdc8a3e63d6ab09cbc0233d243d61eedf8c341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628344, "uuid": "b338c121-b496-4286-beb4-b3523abb9b12", "comment": "Malware payload (GuLoader)", "value": "426fc20cddbbe4a8c2461ce1388b8dbe0aad741a0e922274f195bf1fcf5631fd3d0bdacc2818f793da0e57511f1ef186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "a9250f46-41e0-4642-b7ea-9ea97e05d6ab", "value": "T117552321F2139867D0454BB009279E6A7B3A3D52F0E5D7373398B3473E37289AF5A189", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "91c7c0e2-4cce-4489-b749-f54a8d49c3a6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "ea068395-35ec-420d-9e0e-06d7e4d5ce06", "value": "24576:ms7aBdTshE58ef4lfAGI6o8JBTmqibFj0y9whWW3dWTHX5Gx:Z7aTtfGor6ZJBTmTZ/C73dWTJGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628344, "uuid": "d188985d-b548-49fb-bc4b-bb6b14b92068", "value": 1384568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628344, "uuid": "bd6c269e-9fa4-4589-8490-c14508ecdf58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628344, "uuid": "d5e6af4d-5aac-4d56-bf16-78e41ffae244", "value": "rSC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a113649b-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678648261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648261, "uuid": "fa2001a3-e5ca-41dc-b55e-cec3c9b9ec60", "comment": "Malware payload (Fabookie)", "value": "b9e6e8948db9bc7f6d70cfb6f75cbeef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648261, "uuid": "365947e9-d2a3-4e9a-b8cc-314b7e76a654", "comment": "Malware payload (Fabookie)", "value": "265fb8ad935504f6f91d2c7e177a70d766dd037f9137f1d0657eeb155c829886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648261, "uuid": "47a4da09-8268-4bc4-8d90-b9c0af87efc4", "comment": "Malware payload (Fabookie)", "value": "b09e74bddc257956a68fdf1bfb3ba90b8cafcd94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648261, "uuid": "cdba4e36-ed33-41d3-b8df-9181ba33ee07", "comment": "Malware payload (Fabookie)", "value": "b8c101e0ba64f65c27a83518196e1da2e91fd9bf26663376995f346197af924ce0bd5d857a6aec4ed25ceecc940e569b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648261, "uuid": "7116a436-f63c-4170-8281-cbfdd868ef34", "value": "T18DB45AC1B514C38CD81984319CD2EAF54A71BEF2DE2909DB35E1BF2F7CB5122252269B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648261, "uuid": "723282f2-ec39-42b6-b2e8-45de27f7ab92", "value": "cb238ad11edc9989f023bcce9f933e46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648261, "uuid": "d8a14a6f-061b-464f-9530-2e45ca76ecc4", "value": "12288:bFTx5KRZ78ztSo+szd5IugOOZLM3EMekf:KoztSo+sJVOZQt/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648261, "uuid": "b380596f-d000-40ec-a4ec-ca62a7915772", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648261, "uuid": "305191e5-c9b9-4d74-a870-f8e9fa00c5a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648261, "uuid": "e30aedce-8407-48cd-aa6d-ad1b97c72c85", "value": "b9e6e8948db9bc7f6d70cfb6f75cbeef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa76880-c08e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678595262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595262, "uuid": "e3e8ad14-3553-4752-a7b8-6d8c88e0ce10", "comment": "Malware payload", "value": "7047b113ec0f9285842ff683f9126311", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595262, "uuid": "0bbf19c0-0149-40fa-a422-0df1f35f2705", "comment": "Malware payload", "value": "26fc8b5dedb6393e8d7863eb6168c4af32c9287d31e3edbf4ef1c9a30b3cb12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595262, "uuid": "c4bbe0c7-7934-4866-b20d-ad788776ae68", "comment": "Malware payload", "value": "6742d33b2b27db446df06ba564cc6995dcfa750e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595262, "uuid": "9e9474eb-5d16-4d8f-b029-e7de0c7e1aad", "comment": "Malware payload", "value": "ccb762626eb5f2eb9a2ae6ae70c3f1c9d16d9f37301704834a8daffa1580df8ae48d9a62a4c20a6557e79a8a4cb1e09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595262, "uuid": "837f1d03-3c4d-415f-b2c8-dffeb1cabaa6", "value": "T132D49E1962E841B8E0A7A078C8875616D7F1788A16724A6F53B05BBF2F3B7315F3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595262, "uuid": "29cbe857-606f-48d0-ab4b-a05831f24704", "value": "1ce3d6f5d3e0d6ca5b78e72664fd4c42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595262, "uuid": "d4caaad5-8466-4b39-9215-c070c8783661", "value": "12288:GUxi3xULo2Vk4ZN7CqQDqPLP68etJeaBwnlZAlPQ/NdLk+17MtqqAPyYK8Twf9Dt:GUNNi+byYK8TU9DMzH2Kru11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678595262, "uuid": "9157044b-a7b2-46d5-a1d1-072327fb0de8", "value": 611752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678595262, "uuid": "7aa9e772-7adb-457e-8d66-010f353f9240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595262, "uuid": "c495b7d7-38f2-466b-8664-eda2b8f85801", "value": "SecuriteInfo.com.Variant.Ulise.387908.9551.12583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234a7d28-c099-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678599947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599947, "uuid": "eb853f4f-719b-4b2a-9a4f-7e9566f033bc", "comment": "Malware payload (LaplasClipper)", "value": "dcc96c9228494889f775f5e16e63e6bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599947, "uuid": "26bddb85-8200-49d5-b06b-3123ca0a6287", "comment": "Malware payload (LaplasClipper)", "value": "27e3f922b98770e95808283b65a90236ce39f376a45b448ef55e404685359fd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599947, "uuid": "c00127c2-80cc-4003-b558-e7cf1dcf28ba", "comment": "Malware payload (LaplasClipper)", "value": "edfd6b3b98ba93d2137036e3af91f4486a348428", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599947, "uuid": "06d15957-345e-4861-9e97-c402dba9d3e5", "comment": "Malware payload (LaplasClipper)", "value": "fb0e49a763b8d3ef80a3f796876878461fd8c4db96fd70fb5259c885b82c62e3ff1c254cbdb02007e0db8bba7571dbb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599947, "uuid": "166e7680-5ae0-44e2-b43e-df333ea3778a", "value": "T19D74BF12F3E16869F963C7315F3FC2E42A2FB4604F69776E22085A5F0AB21E1E563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599947, "uuid": "413a1d60-ce35-4226-8b23-96bb28eeae93", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599947, "uuid": "e3cdc114-2c26-43f6-bf82-4a30dfa19a72", "value": "6144:/sqgyzI+g+Ldd3TVLncbnL3ljvzVZj3tl/Q9:dnI+NdhTVDcTL9VZ5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678599947, "uuid": "e599cffb-a998-486b-bd03-f1771c7d5b19", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678599947, "uuid": "c939c84d-7342-4102-9811-c9a5475818b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599947, "uuid": "1d1efae8-e0b6-40d9-8092-285da8003615", "value": "dcc96c9228494889f775f5e16e63e6bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24c69a2-c0b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678614011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614011, "uuid": "5d9f8830-2f45-4bc0-905b-b991b325fa20", "comment": "Malware payload (AsyncRAT)", "value": "43c3f3e2e28157583e7eda204b2b103f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614011, "uuid": "d9bdf207-d036-40b1-be30-b71b651ddc35", "comment": "Malware payload (AsyncRAT)", "value": "280474eb2d29702b7026467d357d2a34d58c08c82a264c174bce9e4bf694c19b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614011, "uuid": "0736a10f-35f8-4e4b-9bc1-0ce5d397c407", "comment": "Malware payload (AsyncRAT)", "value": "43939dc8d125df242075d47edd696f6276f7ecb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678614011, "uuid": "fc041c0c-97ca-471d-9e13-6afecefb8958", "comment": "Malware payload (AsyncRAT)", "value": "b502739bf42d4e8c40888e62d4f515d73c227de1c8d0fa876005bc840c613dfd249a9d15408423ce344d08526b6428ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614011, "uuid": "33b04c15-4643-46e9-a192-35ee7fcdc61a", "value": "T1D67583B0E4BB49E6E00FC9401ABCFCA501B672F3DCD60DA5836C76445E6AFE87E4550A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614011, "uuid": "56ea2de8-ff27-4a59-8ac7-b8852bb38ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614011, "uuid": "03684217-f195-49d5-9bdd-e70b51e2b925", "value": "12288:qP5IhyeomsP5LxH94zj9jljH0bStIswondr1fDzqJVxLsE8LX:1QYrpDzq1uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678614011, "uuid": "78b917a0-4c65-4f5f-a6b9-e1609c7a7f9e", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678614011, "uuid": "cab7a94c-9ce3-4c95-899f-60dc91202c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678614011, "uuid": "9aa61836-7599-40f4-822d-ce9f01c99a02", "value": "43c3f3e2e28157583e7eda204b2b103f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee9cdb6-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678632608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632608, "uuid": "70429abb-99c9-423a-bb20-01bb0279e4cb", "comment": "Malware payload (Mirai)", "value": "226c93b8283f2e22aeeb90dcbb31d323", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632608, "uuid": "c039e9f7-ee37-4846-9b6a-49550722c2d3", "comment": "Malware payload (Mirai)", "value": "288da154ba67fa789d86922281e218e3a4d6eaeac40af7233dd823442cd43165", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632608, "uuid": "ab432e05-62e2-4062-95e1-62928ddbf779", "comment": "Malware payload (Mirai)", "value": "6e3ca1e62b4e9cc66b0e8b89dfa6045dd66b42eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632608, "uuid": "2c44a615-3f13-484a-be99-fca0987f22bd", "comment": "Malware payload (Mirai)", "value": "9f7999ea987764c784677373f8430dac70b4d4ee09bbbeb3b7cd64a4bab0a92ddb635ac35da86eb9646992ff6af41e5b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632608, "uuid": "9f901d9a-d79b-4121-b678-b4cf94ba7251", "value": "T11D03F2C182E25B83C0BE91B058BAD5672401F7DE2342879D95D4106BFEC7FB67A682D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632608, "uuid": "7c12798f-845a-45ab-94a0-d833300541ae", "value": "768:+qr2wMIDrJLbxdOOZ+7HX+R4jTfQp6aR+Hfws0KdvNnbcuyD7UHQRjW:4SJpoOZ+zX3Xa6aRuwsndFnouy8HyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632608, "uuid": "83460db3-df27-4d34-ace5-3961b3bab742", "value": 38184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632608, "uuid": "f36452bf-f91d-4675-a55f-bdc1acbfafc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632608, "uuid": "7bab2497-0843-4492-b87a-0bc4be61b78c", "value": "bbx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d650a82-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588072, "uuid": "78a03ccf-9a61-44d4-abe0-668ed101d9c9", "comment": "Malware payload", "value": "66ecb729fd1993d3f54e2e0936eb3515", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588072, "uuid": "ba121d93-f45a-4b21-9fba-7bb1cca413bc", "comment": "Malware payload", "value": "28950cff484550312f2c91e17d7da89300981f17b19a7cd9c5432a4b76e281d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588072, "uuid": "a6933948-1480-4a8f-8de2-8a3950091afd", "comment": "Malware payload", "value": "75d0cf857ac004b735c0182939586e5b1f47b183", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588072, "uuid": "406fe7ae-93c6-4fec-bb77-fa05e26fad6d", "comment": "Malware payload", "value": "cfbf90a0363e94ec2b6f8c51fa8708d68f35ff272800956912f0dd86ac44bcf94194bd183850ad082db56d027d356122", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588072, "uuid": "aa88c823-4472-40da-a1b7-ad54e73508ad", "value": "T158735B057AD1D871F67E29355464E6A16B3E79224EE08D67378A063E4F302C0DB36E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588072, "uuid": "6252c9ec-0157-4c64-91e7-134de20a6f30", "value": "180c50ea081b0bc6fc351b3b9051fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588072, "uuid": "fae2e3ef-1729-48bb-80f7-67a70ec1bde2", "value": "1536:5gKdL6WlDmkYqzPfwWXAUBfnwkkRdk7EH7ZkcsWkEcd7KWmivY:6ImifZZBfnwA7s7mVl7/mivY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588072, "uuid": "35778de8-b317-43c6-8acf-be26717c7e62", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588072, "uuid": "e1877895-083d-47e1-9fdd-fced21c9628a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588072, "uuid": "2c4dde5d-29e6-44bf-b2d4-54760c3ed958", "value": "SecuriteInfo.com.Variant.Tedy.179044.13369.9233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47049fd4-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678628354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628354, "uuid": "b719ca7b-1945-4240-bff6-7700c337e983", "comment": "Malware payload (Rhadamanthys)", "value": "1cc0a962c3a1ff3a4adbdcaa49809867", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628354, "uuid": "80c0c49c-d2d1-4a24-88c0-164921193c78", "comment": "Malware payload (Rhadamanthys)", "value": "28bb20329cf6024057a4834e899520a55dcc7bb6b22ad783069ab2d1e2124e82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628354, "uuid": "e528c344-d4f4-4848-9f52-fe58292ca898", "comment": "Malware payload (Rhadamanthys)", "value": "37310b0a95d16eec08305404abf3925657ce7e81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628354, "uuid": "27ab4265-7341-4308-a704-a059444309ce", "comment": "Malware payload (Rhadamanthys)", "value": "37edca2458a99f0a61c4d8dcf2fac76b02c2c3dd147309cddcfb5d72d1cb3823f046c0a4c618ef246253906096f0bf81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628354, "uuid": "5a6edbbb-af30-44ab-9fb4-78b4a4e9790f", "value": "T1D17501B51310C4DAFCC293B6924B48D095EDE012B3EF639B66A51A16AF11CDBF034B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628354, "uuid": "db1e8382-c68e-45a1-9399-dcb79500bf8c", "value": "533c5409968cfac36437ac5835c4d83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628354, "uuid": "9ff7cc6c-543f-4524-8a7c-5dc3799aba8c", "value": "49152:e0lrax49sKfUSM27mNWx9J7ZfCzOrUhzW:HdXv76GJZfSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628354, "uuid": "d9a3e71e-b2af-4669-921d-3aeb41324370", "value": 1613752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628354, "uuid": "1ad76d8e-1482-4a99-a755-cffc6dec2063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628354, "uuid": "86105842-67b4-4a63-bfc7-8a4567aedf2c", "value": "1cc0a962c3a1ff3a4adbdcaa49809867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42ce3df-c06f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678582205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582205, "uuid": "a9211de7-f122-4b24-b0b6-4612df95c9b5", "comment": "Malware payload (Mirai)", "value": "938750b37220bd208f6dd0afb0057c8e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582205, "uuid": "9429bdd1-2d82-43a8-8985-00a858aaadb3", "comment": "Malware payload (Mirai)", "value": "2c9fcdf2875779522bc8beaca188e2e732c307ea6317174790b85229d8ddf45d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582205, "uuid": "ae1c64fb-3ebf-4927-855f-ca96231f9bfb", "comment": "Malware payload (Mirai)", "value": "eaec647d471dbbae17b8d30c31d6e4a256b48ed2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582205, "uuid": "b1f86d7e-f47b-4abd-8910-40c7ed3cfc10", "comment": "Malware payload (Mirai)", "value": "0eaad097a238842b57f786231e8b190a5b953efac51af3eac75747a555b8118172b96269da4c8821912518e5a7d6e768", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582205, "uuid": "bae80de6-94dd-4484-a2d1-20beb08ba153", "value": "T164536DC9E5C3E5F5EC110A71313BEF3286B7E67D2069DFA7D3986432AA11602D11639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582205, "uuid": "3fc8cac1-6c8b-4942-b08a-6fb28a18a86e", "value": "1536:Z7qARubgzY/bEJyZRcpF80LDHhklv4JQC9DSW:NP+eY/bEJH/XBk9AP9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678582205, "uuid": "13222389-05de-453c-b003-27444b659d0f", "value": 62864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678582205, "uuid": "efb9901a-9f40-4357-8d47-47204bbc2415", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582205, "uuid": "8b38b411-c160-4740-ba90-35d8ff7c55f3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffdfa41-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629093, "uuid": "e382e571-3e00-484b-ae78-998c5aee44f3", "comment": "Malware payload (Mirai)", "value": "d91e40f2a5d24b1a9cdddda0dd7c51e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629093, "uuid": "f8bd3b58-c545-4dfd-83ef-00f99923b32d", "comment": "Malware payload (Mirai)", "value": "2d2bd9fcd06d07c2eb6494bf0a02ad064ffdf761617f048f5fecf1229cb46803", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629093, "uuid": "c9edd552-2c60-424f-a5ee-080180b4822a", "comment": "Malware payload (Mirai)", "value": "92bfcb7a77300f53a2e150ec71285ef3b49848f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629093, "uuid": "fc773caa-b6ce-4d35-8326-a2943d67ee90", "comment": "Malware payload (Mirai)", "value": "21b5ef901d7c25c39c09310432d9a932b0682843db6b3e44358c52fdfc43786ec834335f3646e08c07a711e188afc508", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629093, "uuid": "0745321d-1ab1-4417-8764-4ea5fae9e629", "value": "T17AA2E125E345AEF4DFEFACA45381C2C276E643C72746C8E340EEAF012906056FB89C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629093, "uuid": "c2bb823f-69a6-42e8-984e-4971b2bc92c5", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5XUM4uVcqgw05VxJu:9RxsSVsMD6xiJJE5zRWNZr4uVcqgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629093, "uuid": "59305d87-daec-45c3-8972-a45b4f163daf", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629093, "uuid": "320dabb5-7b57-4b77-aa34-e1b64501e6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629093, "uuid": "cf635285-9416-4322-8ba9-8e036498e1b1", "value": "d91e40f2a5d24b1a9cdddda0dd7c51e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c941243d-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648329, "uuid": "0d6f895f-0210-45b7-91d7-c632bb9d895b", "comment": "Malware payload", "value": "cb760c2f6c3fc14317d3570c25443b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648329, "uuid": "091d1501-d589-4cbc-b812-7915e18f0c2c", "comment": "Malware payload", "value": "2f0b87e2f28b9edfbbeb1e09c4b7cf8c3b6f0f833e55121e1c916652a69630ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648329, "uuid": "c31617ce-9d6f-49e4-8e9b-ba47f878a801", "comment": "Malware payload", "value": "97b8b32ccf2bc4a29b4d007e68170ab0c268293d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648329, "uuid": "9a5058e4-cb70-4c67-91d2-207f65e31bc2", "comment": "Malware payload", "value": "8f59260bf621e30931dd66f767e351f1eaa1c6ddc6f55be3c03417aeb6504f0a0dc6b77d0e4e10c6dc6578deee3c7bef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648329, "uuid": "cbbd77a8-b485-4642-8281-0b71e72628a4", "value": "T1D476334079D54CB6B4CF4F398472D03AC296272B2B9C1F5A9CC973EDD2286F5839698C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648329, "uuid": "9d92449e-f79f-4c55-a258-14975d3876ba", "value": "196608:/1Cb1InlEuQSJWKOpGUQwVLu7kOBu/d1oetOekv6J6:/1Cb+lEutJFOpGUQwV6aoetRJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648329, "uuid": "c6a27d40-96a1-4dc8-8b9e-14583d15861e", "value": 7323383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648329, "uuid": "b9bf47ac-b4bb-4d1d-b8a0-c9bb3233058b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648329, "uuid": "0f716769-bd7b-42cc-b4d4-cd09ab5e1f2a", "value": "cb760c2f6c3fc14317d3570c25443b74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf9b8f5-c0a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678603023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603023, "uuid": "29ac56dd-af1c-4aae-81d7-78078d408a3d", "comment": "Malware payload (RedLineStealer)", "value": "e512a0f832ae7cff56b580ddbd861eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603023, "uuid": "e62b7c4a-021a-4f82-a21a-b6d94e1eace2", "comment": "Malware payload (RedLineStealer)", "value": "2fcb4dcade437002919e163fded75262686d635276081812bf7367c7aff43205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603023, "uuid": "fe7983f7-4b22-40fe-9bc7-8beb4de598f1", "comment": "Malware payload (RedLineStealer)", "value": "e70cfe569944308c6eddd9b2cdeaa28fe21e4dc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603023, "uuid": "99412d12-dcd4-4893-a2fd-447babc162bf", "comment": "Malware payload (RedLineStealer)", "value": "97926e98211af42c5af309cf9a05d17b8b8d51bd2d7807d98c0fbb910db83fd352f3db7a26c7573f9f951a32cf5d2b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603023, "uuid": "a6cf7972-6961-4b77-9e73-70f3e1649e03", "value": "T1A584D01273F07DA0F963CB315F3FC6E42A2EB9614F69776E22049A2F0A711E1E462751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603023, "uuid": "318cc1eb-54f4-47d2-b260-4cba0609d6b4", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603023, "uuid": "8d2450d9-51dd-4330-b3b3-a8c580ca7c6a", "value": "6144:jqBPUJSWTbMKDMMiV119HqwTfnGxMAqu4oZ2C/T5DAPv:WxUiKQMiLqwTvWqq2uF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678603023, "uuid": "1bebe1ec-a3d0-4d5f-b2be-b661bfb3ef50", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678603023, "uuid": "3d847b03-56fe-4f7d-a272-61ec749a2fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603023, "uuid": "0d870cf1-540c-4d3f-8599-9e448fe7634a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346bf56c-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593533, "uuid": "16ff5597-7640-48a6-a40d-fe633e2811c5", "comment": "Malware payload (Mirai)", "value": "0459c0d4e46718aa202e55c1d7e14eb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593533, "uuid": "58d601da-2b41-4b5c-8c69-edbf0c77a4c1", "comment": "Malware payload (Mirai)", "value": "31cde0a7ea664c9146edd43f23e8f0393d08cb75954710b8682acbdbb0cd0180", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593533, "uuid": "c0ccc8b7-22ba-4699-8f64-4657a3a463e5", "comment": "Malware payload (Mirai)", "value": "22535ce92eb9c9965ec2e214b4d76726ca413a3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593533, "uuid": "780457b6-acc3-4a6e-8a2f-2c0ee5b70c53", "comment": "Malware payload (Mirai)", "value": "73509d95a5517d8a6b2a83270a5ff31a2376b0341ce0962049b0f45729500a7b1440ad8c0374a3a2fa84418529f0b3a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593533, "uuid": "ce700479-a5b3-45b6-8935-0d73a14f9d83", "value": "T12AD2E064294A1471C2713C7EF265C486371B03F5A27AB0E92B618BB197F58E453B1B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593533, "uuid": "591e5816-6730-4938-9c7a-4965199effaf", "value": "768:e/zoSW1rz7XA6QZpeGr6ZR3rpZHQMuULS1s3Uozh:ooSWRnQl4Gr6ZRtNQJszh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593533, "uuid": "5e190b3b-3824-489c-9a20-61f630a4de3a", "value": 28956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593533, "uuid": "f4c5e805-d3b0-40bf-86d2-107ee3713bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593533, "uuid": "01d11e8c-8076-4102-bd5a-8c8e5d0f782f", "value": "bok.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d59ca6b-c076-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585066, "uuid": "7ec05b7e-e485-4ec9-a6c4-83613fe624e1", "comment": "Malware payload (Mirai)", "value": "a2adabfc839b659cb773b3e7b8658f60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585066, "uuid": "4487708f-9cbe-4105-bc65-ef75dee6495e", "comment": "Malware payload (Mirai)", "value": "33a3912951f0d9279cc1c23762a252c5f6fbf1c5964866c136febdb4c3f8ebd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585066, "uuid": "068bd308-6e82-4d65-b377-af2ee484a30c", "comment": "Malware payload (Mirai)", "value": "01eea2015ca284722e38cc39d6c26b1831b01195", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585066, "uuid": "ea57fd4f-6df8-44c3-951f-1f871e917881", "comment": "Malware payload (Mirai)", "value": "3dd5b0c7cde45b655acd424c3d7354b7884a69da3153ca16ddc3fa62836ddd1ed99764a090090aed98d72862b1b3a564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585066, "uuid": "6db07a8d-8a9f-4c0f-be45-35466e0f8b7e", "value": "T1A2831946BD819F01D5C916B6FE2E108E33131768E3DEB2239D149B207BCB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585066, "uuid": "6a0b4cd3-990a-4a2f-9589-9ea704b23ca8", "value": "1536:ixnC8SFAEKpSIraGBYc7TukkGIajg0bdMxips4s8gRQg5CYG:mSFZKr4kwads4s8gRQg8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585066, "uuid": "81f2fe30-e2c3-435a-aecc-f67f0c0c4148", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585066, "uuid": "7ec4ed6f-04ff-4773-badd-e71779827fad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585066, "uuid": "820309e5-7feb-44af-9d6f-34e80987c1e3", "value": "a2adabfc839b659cb773b3e7b8658f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1799944-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629015, "uuid": "e63af5cc-0152-42da-a9cc-d183c78d2b8f", "comment": "Malware payload (Mirai)", "value": "10bd5afbd807764c556e0922cb36cb23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629015, "uuid": "328bbc04-2315-47b5-bd37-9a1dfec1e3b8", "comment": "Malware payload (Mirai)", "value": "33be504d50ea467f7edf0f5ab18dd6cf0a0e4a68b802f8b0e240d175f93a0988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629015, "uuid": "90b0f7b0-b1cf-4778-99a7-55ed59bde6f8", "comment": "Malware payload (Mirai)", "value": "522ce99fbcbeecfa80c3ff0d4f16c104c985832c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629015, "uuid": "d4190982-3f1b-44a5-a3aa-39ad6fb0b2b6", "comment": "Malware payload (Mirai)", "value": "17ed6336da71c4dd106f7e059e0f30a1962a8be23a7e5ba9ea5e7ca7632cc047849a003663797ceb5c2761aa217b3e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629015, "uuid": "e7aa037e-f8c1-4b92-92cd-023138edcda5", "value": "T17E43F231975FA3F6F7E01432D19A0491F3994E78DBE192E1361207CA2BC2A509AEEC59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629015, "uuid": "b87c066d-cf3d-45f0-86d0-58e4908ba932", "value": "1536:ly2ZHTO1iwmeF/Zw8GyB1JALCBK7R9IM3/csZze/M:o2ZHTTeTWytNYAO0s0/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629015, "uuid": "b7c0f3ab-744b-45f2-9827-03fe4932d450", "value": 59788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629015, "uuid": "201bfcb9-8186-4277-ac1b-5d2ed74355cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629015, "uuid": "13e547d5-2809-4463-ad76-fcf78ec40c6a", "value": "10bd5afbd807764c556e0922cb36cb23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a73706-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642817, "uuid": "9729757e-ddc1-454b-b9a2-459fb8d287ce", "comment": "Malware payload (Mirai)", "value": "d4856b3a83fd2c35d81153392f2aeb0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642817, "uuid": "f0001d51-862d-4122-9047-07294ee06fe2", "comment": "Malware payload (Mirai)", "value": "35dfdd55d533489de4a5124467fab4aeffb358b8fbbe7cea0715a482ecab88c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642817, "uuid": "197ff185-d5a9-40fa-9d72-f00627771334", "comment": "Malware payload (Mirai)", "value": "bd078d23866d7da9b969f72d3c3da49b007978a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642817, "uuid": "21dc479d-6d34-4e85-9403-dae850554104", "comment": "Malware payload (Mirai)", "value": "eddddb3a5b5c00ffdf8ba9db1abe050cbabcf0681cbef4ae16850057c133941db138937f08fb1bb34b76843ca22479ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642817, "uuid": "c565772c-3b91-496e-afa7-10fe84e6cc02", "value": "T15E939D72C8266D94C5664971B8F8CE3A4B22D4C012972FFA26A6C7795043FDDF805BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642817, "uuid": "b93da18a-eab8-4e1c-9df5-802df21ca877", "value": "1536:5a/1Kz2hDRFg2+TcshP9EsMTDwCgGK0CuzOtgxoYnbuLmOz:52IQFFd+pEsMTDwX500UnbuLm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642817, "uuid": "2993b9e2-5d6a-4072-91b5-8e5fda2a95d3", "value": 91564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642817, "uuid": "b14c22b7-7ce2-4122-80dd-b8e3b584ab51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642817, "uuid": "0bb47921-6caa-475f-945d-02c9140eb0f8", "value": "d4856b3a83fd2c35d81153392f2aeb0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c28c16-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678649075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649075, "uuid": "04aa6d8e-5dff-4348-92b6-95ad5c0df64d", "comment": "Malware payload (CryptBot)", "value": "81c1a4c3135df84530588d812b9c860b", "object_relation": "md5", "Tag": [ { "name": "81c1a4c3135df84530588d812b9c860b", "colour": "#DCB4A9", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649075, "uuid": "5bca8540-316b-4db1-bdf6-542f0ed535f2", "comment": "Malware payload (CryptBot)", "value": "3654fad9d471a913d6a4e4669c4cf6d0d93c35218d35793db325079a9f2bcb31", "object_relation": "sha256", "Tag": [ { "name": "81c1a4c3135df84530588d812b9c860b", "colour": "#DCB4A9", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649075, "uuid": "9c89769e-8948-4d02-84e3-1e552198b89f", "comment": "Malware payload (CryptBot)", "value": "d98e1eade1b6d333716cf47015e22208e04d4cd3", "object_relation": "sha1", "Tag": [ { "name": "81c1a4c3135df84530588d812b9c860b", "colour": "#DCB4A9", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678649075, "uuid": "302b9961-6da4-459f-8008-c1c22b895c61", "comment": "Malware payload (CryptBot)", "value": "54da048d3652d3abe302a7c63acc06dd62cb816426e7cab45660a5293baa917a9bcd28b982513508f51b14e930479f23", "object_relation": "sha3-384", "Tag": [ { "name": "81c1a4c3135df84530588d812b9c860b", "colour": "#DCB4A9", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649075, "uuid": "ab8e4ec5-9f17-495e-9d14-aac81e2c060f", "value": "T1D005022374998536C5D30A32855E7526F568FE2528E3705F33C4AD9FF228133AFB6292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649075, "uuid": "1f7d00b2-b954-438d-b4f2-a965aab97d9d", "value": "24576:AjULrWjEXNmzNqyRYpU/sdMgQf/HhmYs4ykvWiH:AqrFXNmz8yKpUCRmBs4y8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678649075, "uuid": "a45acddf-728e-4ff4-97c2-01279338463d", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678649075, "uuid": "e86e97f8-eb59-4217-b0fa-5039f4a4715b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678649075, "uuid": "78586a11-9a75-40a0-aea5-e244900d2ae1", "value": "81c1a4c3135df84530588d812b9c860b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f81390-c0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1678629321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629321, "uuid": "3eac2a3d-68b1-464a-847c-42760444cadb", "comment": "Malware payload (AZORult)", "value": "177be2c914b334bb9ae441b179c47ad3", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629321, "uuid": "18c078e7-4a77-4ddf-a639-cb3817d63f24", "comment": "Malware payload (AZORult)", "value": "37d4d7a7b84e4f6ead2e950ba252c23fa360a3176f49184942da3046fa693452", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629321, "uuid": "acffffd0-ef23-4b08-82f3-73d5a240a7f1", "comment": "Malware payload (AZORult)", "value": "ec3e5b9988da762df5797e6ba7e37321aaedc142", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629321, "uuid": "be758bab-f537-462f-b3d4-7e47f496bed8", "comment": "Malware payload (AZORult)", "value": "05f439163eda19cf6c63e7d834a5240c2c658d75b6c5dcb73d4a2ae5d580295930ca9c2476e47af36f788b456d56b719", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629321, "uuid": "95cad63b-05d5-4248-b326-a0321c51cdf1", "value": "T109259D956F196257EBC5A0B31804EBB6EFAC7D5C2427C0882EE13D8FB1B9D2C1111E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629321, "uuid": "39289e27-af43-4af4-b1a3-a1d9e39c1952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629321, "uuid": "0b15b7d1-9532-4019-8293-14474516f210", "value": "12288:HEX3jBVmNUfqBe4G/+69C9quC8s08jHJNXhInMvHE3iYusAf+1SWv5fs:+tYNUfqBpOc5CnpNx+MvH7YpH1SWvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629321, "uuid": "76fde489-401c-4c7e-bb38-c9cd8b350cdc", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629321, "uuid": "2c55cee8-04ae-4ea7-8a34-0d126a25343e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629321, "uuid": "62f270cc-16d2-47cb-9b47-aca189da2fcf", "value": "177be2c914b334bb9ae441b179c47ad3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92148078-c0c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678620319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620319, "uuid": "e2fd67c7-6da3-476e-9762-22efa063877d", "comment": "Malware payload (njrat)", "value": "4be5c188f62949ff4f06f3ceed5a7244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620319, "uuid": "acd1cdad-eef4-4674-9b4a-70ff6d2dc6ff", "comment": "Malware payload (njrat)", "value": "3839ae6dae764844a340952116bad3294baa5d35506b8cc472a7b98a0718e8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620319, "uuid": "c1f31727-9c9e-4603-827d-074f8c4e216a", "comment": "Malware payload (njrat)", "value": "83169a5193526d22e05f3b7ccd72f5f70ab639bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620319, "uuid": "527de14e-1a5a-4ce6-9cf5-d5cfbd9a7732", "comment": "Malware payload (njrat)", "value": "1de07035fa0786b95ef071c1d5e4a3c5800be9a9ba9798babbf53f963960a630419a064faf467976533d0265b22781ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620319, "uuid": "4fa04a28-dee9-40f9-a819-971d47f64b4b", "value": "T168E21AADFBFA4465D1BD0AB50571950013B4E103E523E77E4ECA24A62B7B3D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620319, "uuid": "d4c33152-385a-4ec0-a36a-acfe8da34aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620319, "uuid": "e1b57ec4-200a-4482-9aed-56c38daec283", "value": "768:wbS/69DdxkzxP6bGCMGHfQNvgVQmIDUu0ti6/j:JqqeziIQVklj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678620319, "uuid": "c5d34ee0-2bcc-449f-804a-a02195dec692", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678620319, "uuid": "f655de06-00fc-4193-9bba-ba54a3096b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620319, "uuid": "ff716783-9a6a-457a-9360-19a083f52d15", "value": "4be5c188f62949ff4f06f3ceed5a7244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e934a72f-c117-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678654395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654395, "uuid": "a7bd8311-d58e-4fbb-985f-ae9c3c0712ad", "comment": "Malware payload", "value": "37b59801169bc5a899535e4a48181d6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654395, "uuid": "689a79bf-4558-4a65-ab95-4003ebef48d2", "comment": "Malware payload", "value": "399bc631edb3875dab6c101d3ecc1cca2d92a188dd365714e726f6c5ce9c5582", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654395, "uuid": "3da9e8b7-c7c1-4ea0-8084-562e56710275", "comment": "Malware payload", "value": "f33fc44cb17bdb6c11bc369485a6e6fecd15b740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654395, "uuid": "ebb166a8-8e35-466a-a222-adc1c88d35de", "comment": "Malware payload", "value": "b990814b9dc9f9a8713af16dfba29170e1b6ed591a9e5008b28c2156b3d7f8cec4f91f035a59f3bf50cebe7ae963fe6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654395, "uuid": "44396821-bc24-4b13-8134-a15db1ad7804", "value": "T12644BF3293E17821E5634A325E3BC2E4A71FBC61DE6957D722186A1F08B01EDC5F271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654395, "uuid": "b6778635-9875-43e4-96f1-7202e2e1c58b", "value": "8f077cc2038fae85c4e9d8c60b51a269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654395, "uuid": "524bf2e8-56de-42b6-8f4c-850c759d619a", "value": "3072:3mr51jZiarYl4JDRbsH0+kNdwBGIKHlFkloNLKlEuaGNHlX621v/:2F1tiOYlg6U/NCBDmklkLKlEfGNHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678654395, "uuid": "b68f6f63-01ac-47a3-9355-86c1f867fe8c", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678654395, "uuid": "b68a4e92-6731-4324-b17c-cc6df2603982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654395, "uuid": "8c068909-5b03-4a99-b05a-2c89bb748ff2", "value": "37b59801169bc5a899535e4a48181d6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62a3c21-c113-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678652645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652645, "uuid": "b48378d7-215a-4efd-af0b-f1b756599981", "comment": "Malware payload", "value": "aca042ff3879a53b09a6089012c0dc3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652645, "uuid": "b0a42417-d4f3-4933-97ef-258380478418", "comment": "Malware payload", "value": "39c28f0244bfeb2fe54808cda05f80ad36a886f1e2c75960779ede0894a9219d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652645, "uuid": "a3fbfa30-6144-4632-9f61-e977c764f9e9", "comment": "Malware payload", "value": "cffcd52ebc1dac648c06abf22a73fed5e631d932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652645, "uuid": "f26f8eee-fe23-4e8b-8e85-53a6ee6293b7", "comment": "Malware payload", "value": "683bbca629f215d77f4e9464cbf7994318405eaf36b2b68b2a1714f198e8933d893f0703db6a70fc4435e862d31226d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652645, "uuid": "8a2044cd-5be4-4ff5-84b5-9a75f26b6882", "value": "T189C62393756500DEE8FA4972743BBCFC30F22E9A978698B4A6F67B401132753861BD07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652645, "uuid": "2445b0f8-6f28-4eaf-af81-f1df17f2f24b", "value": "32b37a1ff8b4e9d40e4e5c4a048ee542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652645, "uuid": "8bc4ca88-a94a-4aed-929e-a02d8d19901f", "value": "196608:W9x9G9JpwtykN94/4KdH3WPdv16lzYrcttP5Kzn/cpCXH2zcgh0YZZoJ8wnVSh7U:WxRtykbuH3+x162r0Pkzn/c4XH2zcU0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678652645, "uuid": "48df1495-d3e4-40fe-a265-becf6e5f95e0", "value": 12301312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678652645, "uuid": "2b057361-f6b7-4220-9643-76627736e213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652645, "uuid": "fdee69b5-6693-4c6f-b887-f23b67f6cfbd", "value": "LauncherSoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75f1195-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647118, "uuid": "86b0f71f-bb16-4479-8534-7923e2b5e017", "comment": "Malware payload", "value": "af732877d559768744a14634c14686ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647118, "uuid": "ea0e13dd-8e23-4b4b-9066-b868791e659b", "comment": "Malware payload", "value": "3a0e50bf1a90925d4d255b7e5febea46e173a1081c2208d6bfef90cd0724c4f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647118, "uuid": "1c30690e-42f7-425d-b684-4e142f40876b", "comment": "Malware payload", "value": "85d5d8636f0f2b19133450e94bae6dddfad30aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647118, "uuid": "e225f773-9a61-4238-8e3a-268de060b12b", "comment": "Malware payload", "value": "da85c6c8851222f3ab4adff2e9ee11d152854185818c18951aa049524a6594819121eee8c66360b1d4fd0585bbed144e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647118, "uuid": "5cadbf2b-9382-477d-8dd3-a2d04d20c352", "value": "T14126CD9333049AECE82C4B77E07D215956196DC1B2B6F1E54E1BBEEFA9F05908274F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647118, "uuid": "ee096a10-5680-47a4-92d4-1225e43cf35b", "value": "f5bb3bf3856cb08782d3dbaa36a5825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647118, "uuid": "8b0d3b21-0ff4-4459-8ffd-9a85f820b07f", "value": "98304:okFRP61hlce+gu3O+UHKZc+sRZvojwn6MTSrp:okFRPQzceZHOc3RxAwZG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647118, "uuid": "9d5ed217-ad39-4fb0-b377-469d046064ad", "value": 4861296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647118, "uuid": "987197f5-b6d5-4c1d-9926-a978c9a99a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647118, "uuid": "33406fc2-988f-4bc9-9824-eac77b4c9866", "value": "af732877d559768744a14634c14686ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473a7a9c-c0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678606879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606879, "uuid": "48c038f3-2623-4175-8246-c9f4ce75777b", "comment": "Malware payload (RedLineStealer)", "value": "d20ebf51a675e7682220328fbdd8aec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606879, "uuid": "4c2201b0-a2c9-4dde-86fa-c42c105b426d", "comment": "Malware payload (RedLineStealer)", "value": "3a8c163cfde1817542745cf8268615a020af502da9e14f5f8744a31dec276029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606879, "uuid": "84b7f745-62a5-4610-b9d2-b17ce45593ba", "comment": "Malware payload (RedLineStealer)", "value": "6a8892f0923981ac352a52eb387b04ff3031fcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606879, "uuid": "bba827c3-1430-47b7-9a15-f7dccc68ea76", "comment": "Malware payload (RedLineStealer)", "value": "d70a95328c6c87c13adb53a2e2c7c695d6c3f25e77328123e98744f62cd15671537f29158b5552cd83a9944bf750df34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606879, "uuid": "6a15ccdf-6cc7-43ad-8693-f8458403c4d5", "value": "T1C164D01273E17D25F6A3D7315F3FC6E91B2FB5614D78675E22046A2B0EB21E2E122312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606879, "uuid": "52e888c4-cac5-4362-8380-8673e099ce6c", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606879, "uuid": "2b601574-e961-4d8d-9417-2d726ac1bece", "value": "6144:7q0t/n5r1J3/xn1PkAj0Uukb3CBPBYc9sJChxtM69fO:uwn/J3/Lk8fSH9sGxtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678606879, "uuid": "7b9ff493-b213-4c5d-811b-8f1dbfadebd9", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678606879, "uuid": "4675931e-3a46-4c52-9335-0c0b9c66a0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606879, "uuid": "bc3463c7-e988-47bd-8a4d-7918c22aa158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1398266c-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678642870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642870, "uuid": "4cd97436-c3a6-4722-b894-edc4ebd5a0b0", "comment": "Malware payload", "value": "140ee8d1a1016a55c0cf4cffe7b41acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642870, "uuid": "351dd337-10f3-4ba9-b9e4-67ece43fa70a", "comment": "Malware payload", "value": "3b56189c57179213b2c423e2a4c36b5f62193a018dfb365e1780df86153a8e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642870, "uuid": "b9bde37a-1dc5-4cbe-b8e6-7a5ed17ae0b1", "comment": "Malware payload", "value": "d34a04f9a5a06eae124137b59dd245f1bb5a5f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642870, "uuid": "27d64264-4c3f-4d69-889a-b2eaebd82325", "comment": "Malware payload", "value": "b8cfce4485b8a99d1ec027e43a03b37403bcbcad9240c9f424acec60f2f48ff751cc75d9b8270de877a9f260127b4c99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642870, "uuid": "e3a22d9d-17db-4246-9388-824a5f6e94bb", "value": "T1D724BE113C97823E87107BBABF6A9D67C4D83E41937385AD47BB903E84438E164B1DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642870, "uuid": "db25b0b0-5715-490c-9aa1-829b465f01c2", "value": "6144:zRTUqom1BDSOXp8TVAQnWoWejqMPHHd1fANTQbsI:BdnSOXpevWq7oCbsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642870, "uuid": "8746c6b7-6263-4e39-9b72-f2664da3b64a", "value": 219037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642870, "uuid": "be4021bd-3204-4262-9306-5169707fe2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642870, "uuid": "384b056d-9054-4804-9fa5-38be6e1db48a", "value": "140ee8d1a1016a55c0cf4cffe7b41acc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cea83dd-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678642617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642617, "uuid": "16d30dce-d1ff-4ab1-be72-9067178d2e70", "comment": "Malware payload (RecordBreaker)", "value": "f5aeb35a24e38397b451a3b5a134c8b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642617, "uuid": "dfa043c1-3c7d-40c9-9687-46131db4da50", "comment": "Malware payload (RecordBreaker)", "value": "3ba1ec1d96966a307f6c4257c853caa040b0407803cfebf0ab53fa6f2ba5a6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642617, "uuid": "a58ce5bb-e194-474a-9010-b1c2e0a77e93", "comment": "Malware payload (RecordBreaker)", "value": "3dda93197d5874b33186e06c8352a2f635fc0b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642617, "uuid": "be2266b0-81b8-44e5-a270-9b040d6de569", "comment": "Malware payload (RecordBreaker)", "value": "54ce229a075ac702accac6fdda2348dd708852fdfe599d63982f3ec3b4108c1d3fc8b49fd65aaca8e599ba26195e07ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642617, "uuid": "da2a7af3-9f68-4c9a-9d95-cfb361fe9665", "value": "T1D1273373B3648488D1D1DD365537BE9470F33F6A8BC1E8B86087B1C222F3A51EA16967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642617, "uuid": "d843347c-dd46-4d79-b55c-31bbb2d65cca", "value": "69ced1ad11dc0af68759e861c3ff436a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642617, "uuid": "3801907c-9822-41f6-9e6f-e5b51a44125b", "value": "393216:OX520KzlIOxqMMB8PnXDU3T6XCkR0XCbivMNP:W8RJIkqlBQu6XCkRhbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642617, "uuid": "332b0ebe-3805-4065-9d20-2396f0c94750", "value": 20591359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642617, "uuid": "828ecbbf-bec4-4efb-a5b2-a3d343eaa266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642617, "uuid": "61f2f90d-4a07-4148-9281-d32192c1e0c7", "value": "f5aeb35a24e38397b451a3b5a134c8b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17373f0d-c0be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678615818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678615818, "uuid": "2f8cd2d1-5716-4f7a-a7f1-9a57e10433fd", "comment": "Malware payload (Amadey)", "value": "2c8f053f9012464271de31c14a6af256", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678615818, "uuid": "ed2047ad-ae04-45c3-aa13-104b51236224", "comment": "Malware payload (Amadey)", "value": "3d95a27f83fd54617bea6e4d7ecf9eb9c5e7843ee2ff2e3aae74f918a31b24e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678615818, "uuid": "0bd2f742-8690-469a-a526-77d8e4ba68ba", "comment": "Malware payload (Amadey)", "value": "df99c85c453232db443da8ea8f9aa7a99dadf666", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678615818, "uuid": "e103a3a3-8547-45ed-92c7-665140eeec98", "comment": "Malware payload (Amadey)", "value": "bc8eca6a8c923d833666090162f27333767c7dfe5948fa6f741390fcc4a3bb01deb40d5132cb9cb472d99561e1a100e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678615818, "uuid": "ac50c4ec-3c6d-447a-92cd-343cb4785ba1", "value": "T1DA34BF1292A1AC35F6776B714F2DF2E47A3EF4614E6BE7DA22146A1F09702E1C673301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678615818, "uuid": "75f59748-1d27-4111-a653-84363869631e", "value": "eb7c24017bd43537a43eb41342fa9874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678615818, "uuid": "f5f5f98e-9b0b-4439-b29e-163b4f0e5f15", "value": "3072:LHKmHoSk8TEHZOx56/WZaylmvDmZ25osUFKTLVDhkapgYk/JF:joF8TIOr6IqbR5o1KTRVkcra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678615818, "uuid": "144bb23d-19a0-46d9-81ae-5d3485497e8e", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678615818, "uuid": "7e22a47c-121f-4642-959c-7867f0b8281d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678615818, "uuid": "85299e43-a7c8-42c9-856a-37c47bc36f46", "value": "2c8f053f9012464271de31c14a6af256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa6bf21-c0cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678621523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621523, "uuid": "4a4284d1-5244-4998-acf6-a2a0db0838a1", "comment": "Malware payload (DCRat)", "value": "4cf7c87dbd16d19ca66edeb2bfc7a0cf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621523, "uuid": "e09021f2-591f-469a-b0c2-e0567805184f", "comment": "Malware payload (DCRat)", "value": "3dfaaefe829cd1c617be92520a845c1ccc76c6f407045024ae82c895143f3924", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621523, "uuid": "bcc58043-8f3c-40c7-afa8-e500e882d36c", "comment": "Malware payload (DCRat)", "value": "b148fbb4e486ff83a8b932eb32645ecd605618f6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621523, "uuid": "1737e6cd-5bc6-41bc-9c5b-a0b0d35a4e4e", "comment": "Malware payload (DCRat)", "value": "96b3a88f48433273fc38f862f1dce31d4504379c1ac2318f2e667fcfd19d06ee5d26b64625a92378784a65a0a2547fab", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621523, "uuid": "cfa14816-d8bf-4207-82eb-9c05814eca55", "value": "T172C5E001BE448E11F0981A37E3EF45484BB0D9512AA6E31B7DBA377D56123977C2CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621523, "uuid": "8045371c-5042-48e3-a0f1-82f21d9ad28f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621523, "uuid": "83996fa3-4bd2-46e8-a0c8-fb442fd48561", "value": "49152:T9jQw9M/zsm31Ey6hzBDio79PKVSK4856hgly7p:pzm3E1Ou9PRK4856hglyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621523, "uuid": "a0cc29e2-76f7-4ca9-a91a-5c6a983b4869", "value": 2608128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621523, "uuid": "058ce72c-b032-47a5-93e7-43d5f9144eaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621523, "uuid": "cafeefe8-97a0-4b82-baaf-483dcd848c6e", "value": "4cf7c87dbd16d19ca66edeb2bfc7a0cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df447de2-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642353, "uuid": "b9b50ab4-0c1c-4721-8b4f-373362c34ab0", "comment": "Malware payload (SnakeKeylogger)", "value": "fb84d5a612a1f0cc5c7370568f48a29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642353, "uuid": "1774181e-a170-489f-b02e-7d86b3c02a43", "comment": "Malware payload (SnakeKeylogger)", "value": "3e7876ca0922fbf2aba45def5d4025223c91e868b107f2b4b4870b2292a341a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642353, "uuid": "16091a36-4cd6-4624-b4d5-08601acc2960", "comment": "Malware payload (SnakeKeylogger)", "value": "1d2061bebdce3a1052ba3e213b9e8425a82abc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642353, "uuid": "d97bd2e1-961e-481f-b405-ced8f5d08e85", "comment": "Malware payload (SnakeKeylogger)", "value": "94ec0d6baa3aeeed81f4b157625e2549ebf9a766700905b00eb53cd83ba4b069a280bbe85bfcd7325a86187f71a33420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642353, "uuid": "22a794c6-2300-4abe-9592-e1d4d9162b52", "value": "T140159D046361AA39CB76A7BFF5612D241378785DEEBCD6485D4930CB08ADFB04881BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642353, "uuid": "ffe77c13-19a7-4971-9e6d-a6f577f4fb68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642353, "uuid": "5177d807-a216-4387-9985-3927425235e9", "value": "24576:9YKmIigmlbtJ6oNXzwp92kGD9jzxikqKUHum:9LmIElpwp9zi7DUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642353, "uuid": "d50500b5-b9ba-4c0c-8c65-383a9026cd8f", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642353, "uuid": "435c0cd7-9c8a-43e1-87c5-d8e2b4225bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642353, "uuid": "c9d08628-dc78-4963-b0cb-f6420fe09964", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd1cc0c-c0e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678634510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634510, "uuid": "e6ff28bc-2310-4225-abac-350fb7010360", "comment": "Malware payload (Mirai)", "value": "39e5a292f7dada468fd7881eea7e5abc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634510, "uuid": "53d38f11-784a-4898-b201-8317d5115019", "comment": "Malware payload (Mirai)", "value": "422a0f6d6308e26a868483bdd22eec1261c0047dea433dd2c9eb81551152179e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634510, "uuid": "6e4c306c-8c99-40b5-afcf-9b3e8cf6afa5", "comment": "Malware payload (Mirai)", "value": "661633e309a2ef2f2426c38cafc038032e9b0ea9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634510, "uuid": "a41b4b60-d36e-4907-b1a6-edbca7a718c8", "comment": "Malware payload (Mirai)", "value": "607229d17c5b121974cd43ded351014e01451b1c91b3aed7c5105a02498f8a595272f30eecc24f7d1470e73a6d402458", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634510, "uuid": "5c9b1a31-d2ed-47e8-93b3-9a784c9be46b", "value": "T1EA13E15D90FAAD07CDED9E76B9979B2EC61080C172C7BF79970B8C60A8A440F744847A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634510, "uuid": "4391e7d5-5842-4ae9-9294-515cb6c1619a", "value": "768:s6JOJw1Zl9yEJ+mjJDLh7IG9IXtl95PRayJS5MXYWapEcGTrAqEWz:s1AUE3xz6L95PRabWq9cUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678634510, "uuid": "61434e22-33ea-4588-8759-d1c34471c372", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678634510, "uuid": "69f957c3-19dd-4d44-a11f-649fd0cbb5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634510, "uuid": "166d971c-6065-4fe6-ba4b-8567c7f4dbaa", "value": "39e5a292f7dada468fd7881eea7e5abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "065386c2-c0a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678605052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605052, "uuid": "b5ade241-d6be-4389-abcf-2967cbe64091", "comment": "Malware payload (Amadey)", "value": "5086db99de54fca268169a1c6cf26122", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605052, "uuid": "35105ba6-4458-44a5-82de-035ecb54b2c1", "comment": "Malware payload (Amadey)", "value": "42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605052, "uuid": "3cdf2850-6769-4615-a503-85fbec66d291", "comment": "Malware payload (Amadey)", "value": "003f768ffcc99bda5cda1fb966fda8625a8fdc3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605052, "uuid": "a8f4db09-f84e-4023-8f27-89eb621f5764", "comment": "Malware payload (Amadey)", "value": "fe6c92ce24023921b82782e8bc557d4b2d32eeb1c0ef601674c7d6738115aff50ce07a4ab105f1e229f367532535388e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605052, "uuid": "2641c146-69c5-4f38-beea-29b7508ff756", "value": "T1FF341A217D16C031C56051B729B9BFF2C19DA8259BB049DB7B800F7BDA122E67A70E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605052, "uuid": "6890f470-8cc1-49c2-b77b-fdca26f1dfaf", "value": "ece97832960209c4f00f3aefed6c0555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605052, "uuid": "7a84787b-2ced-4ebb-8006-164173c8354f", "value": "6144:f36hrz456we4lz7zzZ5my2IuViMqJnyJQ:Pxpz7LmeuVi3nN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678605052, "uuid": "e8bdf3ce-4d9f-4425-bbc5-9a5c027916b9", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678605052, "uuid": "b07216f4-20d6-4854-9db7-cfd1eb4a8b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605052, "uuid": "c8f7d546-7307-452e-8db0-446320516df5", "value": "5086db99de54fca268169a1c6cf26122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888b17d5-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678628463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628463, "uuid": "33db5c2e-bf0c-46e2-876d-7e0c795d5475", "comment": "Malware payload (Formbook)", "value": "35d8096ec350977585b99a2b66c46bdf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628463, "uuid": "ec602d6e-3d08-4fe4-b72c-70355411dfb0", "comment": "Malware payload (Formbook)", "value": "4460c3e6d2bed0e73b62272dd9e68844480c0f3323a48fb66bca284482e81bae", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628463, "uuid": "045c885c-21c9-407a-9bca-8599235b6162", "comment": "Malware payload (Formbook)", "value": "98ff2217e8080bd7c6708fecdf5ab04fd9fba83c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628463, "uuid": "ea1294a3-3ff8-43b5-83f2-5b43fbaddb72", "comment": "Malware payload (Formbook)", "value": "56a2f664a84dd6972c91d8dea61f60ed6f62842dca9bcc767f0b83f72a7e6c4a717acaa7c0c3a04a83f049968dfddea7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628463, "uuid": "d92c3bad-e5d9-4b76-be7a-4a5a8e527139", "value": "T10B85383439FA502AF173EF7A4BE479AADA6FB7733B0664592090038A4723D41DDC153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628463, "uuid": "55671c93-d63f-4adf-9ce2-ed1736af6564", "value": "12288:gaBbBkPelYFLRpzg/QtCC8Bg+fWwITDrB5DksSkKcDW87HmD07vhRUNlgM7DCxF0:RdNfWB1z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628463, "uuid": "0b9f82af-ce0c-4f17-8c2a-dfacfd044b0a", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628463, "uuid": "3eeb42b5-2cf8-47f6-8ff1-88ae68cfa5af", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628463, "uuid": "c2444949-083b-4143-8ae8-5ab5f8b36938", "value": "nRFQ120323.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339c928f-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593532, "uuid": "30781e52-e4a0-4e87-b6f7-192526293213", "comment": "Malware payload (Mirai)", "value": "ff8876ad3d74f54de1080fe2ac2a2fcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593532, "uuid": "2d05935c-1980-471a-a3fa-b617867946eb", "comment": "Malware payload (Mirai)", "value": "4463dcb9a23e3cead700d2d8259d23ae0af161338195c246ff57d88983c2a12f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593532, "uuid": "4e8fac18-4d2e-4697-b9e1-bff73dceedcb", "comment": "Malware payload (Mirai)", "value": "151f19870f309dd13b6b2749c08a1f4f087f6176", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593532, "uuid": "4a1b18cd-b6bb-49b4-a750-a7519d997163", "comment": "Malware payload (Mirai)", "value": "5f48e4dcda396c89ed011cae0ea253c432007716199607f84041c8d34ecd30e8eb8e1d6e19a66b8f6048a2e09cb7aaf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593532, "uuid": "343fbe0b-2f2d-4239-9290-0ec96cd76458", "value": "T179D2E0F59B9FD550E3200D39782C52D172364BF6D5BB23C36298F630B3CA44A11B651E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593532, "uuid": "06de9fb1-d9a7-463e-809d-cdfd2f5b958c", "value": "768:LgOG2wQY6KZq1kSz6d/lUYpOXmig3renrrjeWs3qV9PKs3UozDo:LgvwXDkSG9nOWigbOfjCO/zDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593532, "uuid": "c8d20f96-077b-4ead-aec0-5aba7a2e95bc", "value": 29020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593532, "uuid": "f41f2745-7ee5-42c3-8205-a9cc4b0098f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593532, "uuid": "0c78a4b1-0033-40f9-928d-4016d6581e5c", "value": "bok.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ca6a40-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642355, "uuid": "7c2fd964-0037-4c86-8dc5-a2a0c3ea2ca2", "comment": "Malware payload (SnakeKeylogger)", "value": "8019195a617005bc20d1d02f6fa22831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642355, "uuid": "e3716f3c-f86d-4f8a-868d-4dd804c0f213", "comment": "Malware payload (SnakeKeylogger)", "value": "44c07d9336c6c18ce42c26a7efa257ec48e26bc8ea670c4c2aad9016f350a220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642355, "uuid": "60fe2625-9fcf-43d5-a35d-b470b5a824f2", "comment": "Malware payload (SnakeKeylogger)", "value": "731a7119bbc275889499ff2b7fd056ec01b381f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642355, "uuid": "c89b4ba8-1ef9-4ef6-9b96-fb4c634def26", "comment": "Malware payload (SnakeKeylogger)", "value": "3a620d30fa93a0cd0d8e8fb43ee915d7df3b2d0f81f72a3588ef17a12847ad7ed9ff4b58bc5d8c74153e2008a6616ce6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642355, "uuid": "7f6cba88-ff01-492e-b1e4-1396ef17600c", "value": "T1D615AD441361AA7ACBB7A7BFF5612D242378685DEEBCD6480D4930DB089DFB04481BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642355, "uuid": "15351dbf-3216-49d4-a612-facba788f6aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642355, "uuid": "e5c96b9c-973a-4456-8084-fd9c994aadb0", "value": "12288:H6b4FlLKHFjcs1KKm1O5iMaV5rm8BjiJbh2oYr55Z78AhQ3rfmYUqlmNfo+ArZJF:aQKmIic8eY5Z78AharVUqlTZ70KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642355, "uuid": "0ef09b1e-0a88-4bc6-8311-df7bdddc5a0f", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642355, "uuid": "f083d014-683d-4205-9b0f-4ff01a55e58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642355, "uuid": "f7761862-06f9-4358-b36e-5db49251bf06", "value": "M9SwqYTfy7VKIGA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4319594c-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1678648963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648963, "uuid": "4d6bc852-ea31-41e9-8ea0-7b6528becbf9", "comment": "Malware payload (PrivateLoader)", "value": "3ae876e56ca9a650b3a9a3f3f66748e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648963, "uuid": "74e73967-8360-482c-8794-6775cab35ee8", "comment": "Malware payload (PrivateLoader)", "value": "44ee2445a8afa4123bd2edb2bcbe258f8c344f73fda88d03097e22a7928d313d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648963, "uuid": "e8de62eb-00f7-471c-8e88-db05422f5f6e", "comment": "Malware payload (PrivateLoader)", "value": "73fcc337713a4cc0e7f9c32b6f7d282b827f16ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648963, "uuid": "73babf8f-3d76-419f-b6df-14c028f1db63", "comment": "Malware payload (PrivateLoader)", "value": "a655560805ecbfa540701af6f6b319972f02fa120483c59733f7a8853477be3564f735d9f736a6f91c1ba7f52eda790d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648963, "uuid": "32071d67-fc48-4371-9242-55d2f21eeb60", "value": "T10246334D193F42D9DB68497E002465F0EA22FD9EFC81AD2D76D8233B92331D38B56627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648963, "uuid": "a43e525d-d458-4d33-8ced-00425b6e88f2", "value": "31a14226d3e64a75d1fc504da54b963c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648963, "uuid": "764dfa1b-e9b6-4706-89fa-7a0e84c96b74", "value": "98304:P1h3ucOg+2rajZV1rrcl8SgvUImkTtR+To4eboVEdZlgCyPBJeWLZktIDyWM+hdl:NEc9vraVRc8sU/+E4r+dcC+BQW1kqDyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648963, "uuid": "628d5881-d364-4783-bf40-8c1b81e2a7fd", "value": 5862400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648963, "uuid": "eb81a878-10ab-42aa-b10a-8bbb10156ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648963, "uuid": "c8e27b42-8eca-4b9f-9c32-adde91f16b33", "value": "3ae876e56ca9a650b3a9a3f3f66748e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363046ee-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593536, "uuid": "7df2d1ff-2864-4389-b1da-aea3b2cc71d5", "comment": "Malware payload (Mirai)", "value": "e02517f554862fd467c26b6feb7cc772", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593536, "uuid": "b830095d-de22-4f53-9ad7-fa1891c1c940", "comment": "Malware payload (Mirai)", "value": "4695ec44f1e9b8a7c7b42ceac4a07ed5a39f6f59347206c0e3503ed88edd0460", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593536, "uuid": "f30ce107-f818-4ec8-a39d-2fe35e5834b9", "comment": "Malware payload (Mirai)", "value": "807a47e3fda3ac4bc856a4ed356c46bb7462e697", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593536, "uuid": "4d75c5a0-379e-4f42-8ce8-3565904efea0", "comment": "Malware payload (Mirai)", "value": "195d423bf6f548d602575d5beff2c28c20df03422af767ff5897110882cd1f168528d57a4f39ff64043d2c29cc203928", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593536, "uuid": "3e14eb71-ecb2-44a7-a823-5f0ca01f30ed", "value": "T15A531207F83001D5CBB73C308A155E4C2A8A9A3599BDD8FB0D752A8435DA1F657F4B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593536, "uuid": "fe2301d1-502c-4ed6-ac96-71a9b4d5121c", "value": "1536:+++SJN5DLPbk9wq+9XJ+tr0Jyw7xc9lxLQKQL1+9EpW7M:USJN9LQ67+iH2LQKQLIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593536, "uuid": "1533053a-eb7e-4abe-b365-a6f8dacdcaa7", "value": 65664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593536, "uuid": "4c57f3ed-1885-4c9d-93b5-f7f398cebe96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593536, "uuid": "9de02b9f-83d5-4d11-8681-b743854e8a76", "value": "bok.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201df53c-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678633872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633872, "uuid": "19fe40ce-719d-431e-905a-8fb3442167d8", "comment": "Malware payload (Mirai)", "value": "5de35daa71ead1e0085c3976161d3f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633872, "uuid": "9820615d-6a69-41b2-b291-5f0a8f643695", "comment": "Malware payload (Mirai)", "value": "46a9d97c404280c9923cc0c3eda8ed33c70ea9785ae6535752dfb6aa2d87c30c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633872, "uuid": "76e7f451-a522-42ab-80db-505dc9bc7099", "comment": "Malware payload (Mirai)", "value": "6898f4a7c54fa30742b9b8afd57bf4d36549466c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633872, "uuid": "88a758b8-0914-4b2a-a671-ad3c2bc35e4d", "comment": "Malware payload (Mirai)", "value": "dca409c563be2aa1dead28582a71ab17477ef5662949d1a19f186f29eb5c328445771b1650b05afe8b4c607b0ca2ffab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633872, "uuid": "1f206778-c719-4021-bdd2-30037fe9d64b", "value": "T109A39E34D4AD9DE0D2554530BAF9DD344F12A244A2A33EF79AD58EA500C3AE8F10AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633872, "uuid": "aa91797d-baac-4f3c-b65c-827618702718", "value": "1536:BjkU0+XzsX+adwtcWNQgnjNgx7BE9INfkuYGVfs392tg9TnSUlCrC0jb:Bjr0VOOwQKhI7BEGfkuRf+wtg9rSUl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633872, "uuid": "ee10c8b4-5722-4229-ac9d-ab0405e95ed1", "value": 99640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633872, "uuid": "9e982d5b-5aa7-4909-89f8-82389e77d7aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633872, "uuid": "e9ff4aa5-2950-43ee-8c7b-96ae45cbcdf5", "value": "5de35daa71ead1e0085c3976161d3f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800be9ef-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678643052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643052, "uuid": "50c482ee-e3f1-4f3c-9433-45807adf9945", "comment": "Malware payload (Mirai)", "value": "e5cb9f0f04b586d1874d07cac9c56c12", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643052, "uuid": "c6460695-f7d6-48fc-a1e9-8c8d24df6148", "comment": "Malware payload (Mirai)", "value": "46dae25828521e9f3f1316330ed733d6e1430cb7ab0bc09af58df70e6c760015", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643052, "uuid": "e0aa0ab7-8244-4745-ac31-d806fd8ee51f", "comment": "Malware payload (Mirai)", "value": "8fa9e5d5e667160854f418fd0b84b0479e3657e3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643052, "uuid": "08e50a26-36bd-4591-8eab-7a993a78db16", "comment": "Malware payload (Mirai)", "value": "717c103fb8441918e2356912732c810bc5d4468772791e1d9f21fcd133b1954092e812e75bd74e33cf229807a16444e8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643052, "uuid": "7d908b18-5032-4698-b5e4-93850b8cbcfe", "value": "T19523026E71F7370CCE5DC2B98C1B7E4F0D3C3596BA6B5A4484C5206E35992643C35EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643052, "uuid": "efa08774-f5c0-408d-b395-deb514e44e82", "value": "768:TzU2fk1gXJV/kDYoR/EowyihPFthgV2NcLdW3JG/Omxn872sy6Qcqbw4WJbFXe6X:b81gXJV/kDYojwdZFXglLdIuFEva9bwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678643052, "uuid": "c53e152f-f501-43ef-abef-9dc3c9f6880e", "value": 48472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678643052, "uuid": "bc0afa81-59d4-467c-b124-d9d994881eeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643052, "uuid": "ddb00465-5880-4750-b48d-cafe9d471461", "value": "e5cb9f0f04b586d1874d07cac9c56c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3d3776-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678642668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642668, "uuid": "aadd28d6-819b-40f7-9a3e-95d621b77ea3", "comment": "Malware payload (GCleaner)", "value": "354895bd5079cc205b265799b71ec05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642668, "uuid": "b24ef40e-1aa8-47d3-9802-d02ab3d60230", "comment": "Malware payload (GCleaner)", "value": "485cadde1de44b50c205f7019b7f63222af1e779b9a14b9363bd811d6933f80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642668, "uuid": "33b6497d-3246-40bb-8923-97086d25982b", "comment": "Malware payload (GCleaner)", "value": "1016ac93fad8d1706255e96f7807c1950bd3d78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642668, "uuid": "0ea0a276-6a44-4ffa-89c2-ce716ad2e5f6", "comment": "Malware payload (GCleaner)", "value": "598d5923764f55cffec69f03809e5a72c1ca4543a6666ec0066acb2b1c96a0a5989105546bc7e3630120f883609d4337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642668, "uuid": "9562d69c-895f-4a04-ad8f-87aa72be6478", "value": "T16954D04276E16C30FAB2D6315F3FC2E4266FB6610E79775D2224276B0EB21E1E532342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642668, "uuid": "c955fff5-5033-469f-8e72-ce7a05611ae5", "value": "ff0e6f4c900d24bd98d621e36b5327a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642668, "uuid": "7f1fec8a-5b8c-42cd-a37c-f06be7de94f9", "value": "3072:qmEFfQzn7IRveaMP7osVhZTTqadpBtrWAbTJhzoxM7viqOUAX6xJ9n+T6:UFYznoeaMZXbSAp8pz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642668, "uuid": "56aff9ed-7f3e-44bf-b457-c1aa80ab8604", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642668, "uuid": "92b2c9db-d11f-42f3-926c-2c4d88d47f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642668, "uuid": "bc48359f-590f-4fa5-a889-fbf6c8699f96", "value": "354895bd5079cc205b265799b71ec05c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9efa60c-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678648840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648840, "uuid": "ceec50b1-ff8d-455c-92ee-0765d9da5830", "comment": "Malware payload (Fabookie)", "value": "8565d0fd2511a79ebbbf42b889c2ee94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648840, "uuid": "38b0e0cf-937c-4930-8918-4c36c60dec77", "comment": "Malware payload (Fabookie)", "value": "489faa789029f722f29115ba14fa4848b38bb8a5214cd3c7e8812357946be54d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648840, "uuid": "55381c68-21b0-411f-9675-5541940d10d5", "comment": "Malware payload (Fabookie)", "value": "abcf97dbfb019296088b8b3eacef56f31d1a2762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648840, "uuid": "3ff86169-b9d3-44db-8e00-436dc7295adf", "comment": "Malware payload (Fabookie)", "value": "0ae3af1a106e2c07f3cdaccd2da125e240a20faa41df448b7f69532f34f3f7857eb86473bf6cf3b50751d88034f0228c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648840, "uuid": "dfbd4780-02ab-4c60-be05-910bb266d6b1", "value": "T12405AE219122C95BC310343CD885A5F5EA9CBC60C759CBE3BA55BC1E7E36AA94D3C0F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648840, "uuid": "cde29f9b-7091-4a4e-90cd-3af339de533d", "value": "a0ad82b564665412272991ba09f43857", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648840, "uuid": "89bbbfac-d744-44d3-85d2-e50f419a6d91", "value": "12288:qrtKU5Nk7yK6+X/P6+X/6YCoPsk7vFIlv:SpEyFg/yg/6YCUsk7vFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648840, "uuid": "01cc48cb-b1c0-4837-a7ef-023ec2f39ddf", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648840, "uuid": "f1a95cff-4446-4181-a2e6-be37a5dbe0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648840, "uuid": "0a6094c1-e31c-4a5a-98c3-b8665939f910", "value": "8565d0fd2511a79ebbbf42b889c2ee94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda47012-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648819, "uuid": "8c04a093-65b9-45b9-b199-40d8a338845b", "comment": "Malware payload", "value": "21c1cbbd72cb9f53daa5192a9e527e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648819, "uuid": "72567333-6f8a-4367-93eb-a8a27c81602e", "comment": "Malware payload", "value": "48a3255b59e92f99afd5cfb2f7c4336e61aafa1905d7ae5358df9d5cd57cdbc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648819, "uuid": "2c59ff5c-ab4d-47a0-ad94-245fcda9a4e6", "comment": "Malware payload", "value": "3271f80853c54ae0b6fd7a76b5e7591ec2861333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648819, "uuid": "f1b85c64-7cbb-4cf9-a8d0-cea851da96ad", "comment": "Malware payload", "value": "398bd4f4bb4356654fde644d575936d537e7d01037de600bcc06254de43c111c77cd99014f6ad7d40c9ff208011b0c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648819, "uuid": "36318a9b-1333-4caa-9223-917a792d8117", "value": "T180C5F0A135FC54F3F2C1665A4BBBBBD7A1AC32D1191186CD0798D0833D2B52227EE29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648819, "uuid": "f151b346-a33a-4c47-950a-c47b8bb5b6e6", "value": "49152:icnPS84mGeZEO5GnmF+2GOZa7hNkyBiHM+UX/3Z3Rg6apCqX+5clSevZbgdL/oe7:vT4pPO5Gn4SOAjkSvBTaPX+alSeReN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648819, "uuid": "b26e8d5c-169e-41de-a5cf-dc5d4ea3f587", "value": 2540551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648819, "uuid": "06d363e9-8cd1-4b5e-a5f1-7a1dbae48762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648819, "uuid": "16031a78-a407-4fc2-8195-906265a46420", "value": "21c1cbbd72cb9f53daa5192a9e527e5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd99192-c10f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678650967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650967, "uuid": "cbd429c1-102b-4a25-a9ec-abf040710a67", "comment": "Malware payload", "value": "af597baa8ee9b4090929933f8bde92dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650967, "uuid": "ee1d799d-af03-441e-806d-d8a0a2ed69a7", "comment": "Malware payload", "value": "48d58386a33079f98e91f163836766f0b7c4f61aa71f9f0a45d85e0f5cc92d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650967, "uuid": "177b5864-9ed9-446c-be12-edf63a2609ce", "comment": "Malware payload", "value": "d3aa246932e055f1b8542dbfd2acc1a37e5125cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650967, "uuid": "3acf3da5-5985-49bf-9045-60289c0367b2", "comment": "Malware payload", "value": "2903357f40cd2a8230c9b2efd4f95e7df622a50b38e2e0c2303981e74d9151180034a7c6273b5852a95f088fb41f03a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650967, "uuid": "0532f6df-ae76-4bcd-ae8f-4ab4833bfda4", "value": "T13B56338BE9D951BBDA1986705CADC0225D4ABD96F078742D31F18CFC9FF722A61B0123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650967, "uuid": "8e02e7d6-ee5a-49bc-894f-43d0418fde7d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650967, "uuid": "611daeae-9ba6-4296-91bf-5cc8293ed5f7", "value": "98304:3W13mLni/5bhO58kstEdxyL+JLiJf8ictNAxfxkLJsrwolpUt0m/i4a:YssNO8VyL32fGLJUwo3USx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678650967, "uuid": "72f1b852-4b2b-4a58-8fe3-75cfeb4291d7", "value": 6205000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678650967, "uuid": "af663158-e158-4fe2-962f-62317e91c1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650967, "uuid": "0f1ea500-b2d4-4bac-956b-1d1c0317f7fc", "value": "af597baa8ee9b4090929933f8bde92dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ca9d1a-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593530, "uuid": "4c13c42d-59fd-49d4-b5de-f300246c7dc6", "comment": "Malware payload (Mirai)", "value": "2ae8481880537b9aa3c8f35a66396869", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593530, "uuid": "965ffe36-2b77-4e4c-b4e3-8e001ca66b59", "comment": "Malware payload (Mirai)", "value": "4956c7c023d7d93d08aaea8ea3111d6f2057ba1a79eac2fcc9d214242743eb8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593530, "uuid": "194d1c1e-9052-4705-be4c-6a4be0ff626c", "comment": "Malware payload (Mirai)", "value": "a3f09656e11a8786dc416e54e2b8c80dda1bf9a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593530, "uuid": "206dc4de-9222-42b3-9873-93e86d8f3fe1", "comment": "Malware payload (Mirai)", "value": "9e84a808bdff335e7ec335eeace52ece4d6d44c49aa7bdc64632919de7ad20f3770b618407b2333c5e10fc2f13033451", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593530, "uuid": "3c3c94fe-cb44-425d-b32c-ef1e1b938b2d", "value": "T155D2E16741D746DBF1EFB176488F3C8D11145068B48441E7A689A373CED1B2D2B317D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593530, "uuid": "c08c391b-2c92-45d1-aac9-eda83910a4e6", "value": "768:Tdc4emtMcOE0hHeq/+vGFnJATCjEwtcuinbcuyD7URQRjZ:5ckrOAS2wtcuinouy8Ry1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593530, "uuid": "2047bf42-f637-40c6-8806-db805e05792e", "value": 28684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593530, "uuid": "7b3ffbe1-8547-4dab-b7b6-54101568d5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593530, "uuid": "9c2730aa-c087-445a-9eb7-e623da803cd3", "value": "bok.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c93453-c0e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678634497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634497, "uuid": "af28aebf-eaa0-46db-88e3-db13edf6a2de", "comment": "Malware payload (Mirai)", "value": "1fbb6dee137498ad36fb7f22709a184a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634497, "uuid": "48109d5a-09df-43d0-96ab-349f7105fe35", "comment": "Malware payload (Mirai)", "value": "4969799cfdaf5d4bf4970affdc49df0bdeb7fa8b41c4842de3a6fe9a2ce23cd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634497, "uuid": "f8e433ae-6638-48e8-8965-17794ff158ac", "comment": "Malware payload (Mirai)", "value": "525583760b8528d5c53eb63834efba75874dc51f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634497, "uuid": "57b08c17-1318-4311-8ab5-a709f6597cbb", "comment": "Malware payload (Mirai)", "value": "96184d28d5c5a90f786e5a694e8462153eb9dc52be5ad4e653c1fef3e7c84d4e307215d1a7cb20909154b9dd92afec31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634497, "uuid": "f7c225cc-6759-4233-b327-603e7004e0b4", "value": "T172831A5878110E9DE9DB5CF8513A8F1ECD115340AA530B1B6AB7FDD339A31A6BF0688C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634497, "uuid": "8916fa19-466b-449d-9a74-522dbb6f58df", "value": "1536:6ye6E3ISvNvTjmZD6H++QX4CQdilR2487/DfQg1pb434Yr2yi:556H++QICf24aDflpboOyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678634497, "uuid": "a5f7fa38-b90b-4dd4-a903-a9d747e17371", "value": 84216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678634497, "uuid": "98b916c7-984c-4006-883e-f6486c280f8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634497, "uuid": "d7c35df6-eafb-462c-a0a1-d13b794b1c78", "value": "1fbb6dee137498ad36fb7f22709a184a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9deb77a4-c0a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1678604877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604877, "uuid": "ae464646-f42f-461d-be2f-61196338960a", "comment": "Malware payload (CoinMiner)", "value": "7846d9f085af3277a786b1cb74624381", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604877, "uuid": "3555af87-b130-415e-aea3-997c8f567255", "comment": "Malware payload (CoinMiner)", "value": "4ae790344d3f254d01f448e1a9596602859ec074feca13c839b060c0134dc91c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604877, "uuid": "3434c375-8f37-405c-bf23-73eef02bddf3", "comment": "Malware payload (CoinMiner)", "value": "1361cba08be9a441baf804e17e34158a37e37041", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678604877, "uuid": "3e2dabc1-fbd2-4a7d-8fa9-f1d880a17474", "comment": "Malware payload (CoinMiner)", "value": "12dec6343e36436bcf7ab09bda96a1ae80fbf147cc85e4852df9ec7b45cac2340a0888766f5c6b3303c4b5324ae00e0c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604877, "uuid": "c61f7eef-169a-48dd-b8d2-4b4e868c71da", "value": "T17C753346D6F187C5C67198B5EBB7E4D01C7107F0EC8CE146353A1F1EB302A7AE4AA096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604877, "uuid": "e5f82072-d248-49e0-9edf-50add01c849b", "value": "8926ab145a838a66e92539a52dad0e55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604877, "uuid": "9ef679e7-9960-4c61-94bb-73dc13705765", "value": "24576:JpkBPpYLBABg32MlXbq2XlnRd9QeTYiZsTyKqr14mvN/UEZ5SVU86wraBSUhk/L6:7kBKLX3XBlXdTYYqm5eu8CYUhu2jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678604877, "uuid": "95e67ecf-0a5b-438d-a29a-0e164fd1fcdb", "value": 1628336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678604877, "uuid": "5d427402-525f-4dfa-b337-bfc2e14394e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678604877, "uuid": "c8d5c1a1-7fb5-42f2-9e8a-34a283b9b504", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b374d0-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648947, "uuid": "0be4ae46-ff78-4b21-bedc-97a91495d27f", "comment": "Malware payload", "value": "9efd5a709547c1b8bac35e9add11d033", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648947, "uuid": "aa659f1f-5dc3-462b-ab70-9bf322722c3c", "comment": "Malware payload", "value": "4cb429b96ca8adaf8a2182689ec42060aa473abbf5ead9e1b440e22a013cc3c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648947, "uuid": "e6fc8f75-03f9-45f1-9872-4f1dbd0ecada", "comment": "Malware payload", "value": "84041451f666a42d2ba67ea461e8303d913ae34b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648947, "uuid": "58f8b9b3-a4a7-4d8f-8df4-13c8db7c4268", "comment": "Malware payload", "value": "cfc556eb33d0c075ea70a8a19958ba9b36a1fb41e884cbcbeea03a260d1c0d022cfa92f3ef41b0cc2a35f23df467f7fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648947, "uuid": "8c45eb31-6990-4a86-9c14-0b4b69adcb40", "value": "T17B45F155B3EB45F8C267AA78717EA70FEA2930440B7086D747FC1D081FB27C065BA6A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648947, "uuid": "1804e78b-00f4-4009-90f7-54a5bf0b7d3a", "value": "24576:QTCkmms+5i8SQ/dwpagBFFikcSXZfR/Y92XbxKFD8/aOJPb:QTCpZ+8HQ/EagBFjZZ/dW87l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648947, "uuid": "82639563-e430-4b01-935f-d3c4ad7ee1a7", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648947, "uuid": "8632c22c-8653-4361-bea9-058900b671af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648947, "uuid": "6e4b595b-2d15-4a63-9bef-34522f1e6e16", "value": "9efd5a709547c1b8bac35e9add11d033.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c723faca-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642312, "uuid": "58093794-be5e-4bb6-8c40-c5377f83b0b6", "comment": "Malware payload (SnakeKeylogger)", "value": "9b47804d0627d4ffa417b7c077db791e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642312, "uuid": "f3fcdc99-1483-4890-b9f3-00b5473d3e5f", "comment": "Malware payload (SnakeKeylogger)", "value": "4e989e5fe7e8bcdc1c2d8a5448355ca557200a7a6e15bb8978150e0c47394ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642312, "uuid": "0b57a76a-3227-456a-93fb-a775470da7ed", "comment": "Malware payload (SnakeKeylogger)", "value": "06b515a5a59076e7ed48783f00d27ca3cad2060d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642312, "uuid": "1e57e7c5-07f1-4c75-942c-bb678d08f677", "comment": "Malware payload (SnakeKeylogger)", "value": "1f94513d3a2daeb738d9ee03abad7764af33165553ed169cfdf23fbe97e1929134c5fc15e493631518a886dfb56adb33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642312, "uuid": "31beee29-7ae4-4987-8b27-ef0d480ddb84", "value": "T1CB74175063A88637E1AE37F5A47509144AB5ED43B1BAEB0918B839F91C33782DD5233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642312, "uuid": "bf0fd982-eb06-415b-ba45-9b27da61d0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642312, "uuid": "cbe290ed-e9a0-47ac-9723-3dbe22be6860", "value": "6144:lXL3rCi1FULFfqOcp6ZcP0pt/lzuQkJvsH9Sh4qRWzY7:VF4tqKZ9ttDovsH9S2qRWU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642312, "uuid": "030c6943-0207-4400-8e94-2c84fb6953ad", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642312, "uuid": "5ab9f539-164d-4e8d-8e3f-f7882bd8b7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642312, "uuid": "a196b5d3-2cad-46cb-84f2-4e254c37a6f3", "value": "9b47804d0627d4ffa417b7c077db791e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3386849-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642306, "uuid": "58a057aa-97b3-4044-9c0f-65b6036aa9d4", "comment": "Malware payload (SnakeKeylogger)", "value": "a26f1b93f140948fc5b8d835cede4a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642306, "uuid": "540c30af-5fe5-44df-b257-c697095296fa", "comment": "Malware payload (SnakeKeylogger)", "value": "4f48aa68e2528bbb436a646599968ff79c12c6829468843de2a4d9792a90075a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642306, "uuid": "433b723e-6100-466f-b662-a915946a194d", "comment": "Malware payload (SnakeKeylogger)", "value": "5f2534d0e5c739d5f8285083716736123de5e077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642306, "uuid": "8964b23a-5f28-40dc-9bb5-a1ea5b45501f", "comment": "Malware payload (SnakeKeylogger)", "value": "f71ba192db34caa9afec2edbf05f19f6910cd9b6a2f3e57d7733fd1847e403c176ce540d4e07c77b4dd01406295c3ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642306, "uuid": "970acf30-77f0-4f34-a8df-6e60511723fd", "value": "T1CAB4D079468C9B1FD93890B5AD6157E2DFEBCE901B2C15D7050EF78A2FB53838A1A043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642306, "uuid": "613e76cf-bb73-4208-a859-140da0c5f1ce", "value": "5cd73d4fe9c48777d6612f3405785de2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642306, "uuid": "7357605f-cf56-40a3-bd33-f888f9efeb60", "value": "12288:R4ljq7Njv/AyRBFTj3a03eHwcQXO7nq1jmkpFB:7dvZRB5aPwcQe+1JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642306, "uuid": "8f40cda8-3682-4abc-9805-b8a919e4f91d", "value": 528724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642306, "uuid": "e4fef867-f60e-4eb2-b24d-172eee6b5217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642306, "uuid": "64ec1259-c964-463a-bc10-cee3aaed4028", "value": "a26f1b93f140948fc5b8d835cede4a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db1fd66-c092-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678597146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597146, "uuid": "2fc2dd43-1395-4d68-9e63-846d79bc36cd", "comment": "Malware payload", "value": "ef57f8d8a632b8cf2b89021e2a7be68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597146, "uuid": "c25003ce-fd5e-4e14-9c64-2639daf8f498", "comment": "Malware payload", "value": "504eeed5061605b464f6dd44aa72d78efaed7d8ec0704d6db6595c977b7dd68a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597146, "uuid": "e95b018a-3fdd-404c-98aa-529791411c0e", "comment": "Malware payload", "value": "06fbf5fb5ae8e307e2016a4c4720e87f53179b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597146, "uuid": "c84c6746-3681-4e85-8bdd-6515daa1c7fa", "comment": "Malware payload", "value": "d1201128c7f858117d62eea02740c9056f94c0bd3ad1240ba0064e2da976127e5e8b5ab230fe1230bdd15865342873fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597146, "uuid": "37536bbb-a788-4ab3-9ba1-1497ec9ff156", "value": "T16A046C6232A542B5D5B7C078C6839A17F6BF7455036097DF03A04B761F63AB0BA3D3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597146, "uuid": "c9e254ef-baca-4aa0-b015-fe9ae22f268e", "value": "f37a61d96b690f7b944e7449374d4371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597146, "uuid": "f3799b08-2f2d-4d4c-8000-4ab041dc9839", "value": "3072:Lm1ReRExqa3HodDUMTW3FCh3tnigcQnbMbAvmppijpV:kReREl34DhqoJigcpbUpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678597146, "uuid": "8830dd54-3e98-4c7d-b415-052abc568d41", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678597146, "uuid": "8c678520-9768-45fd-9dac-63fe19b4e426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597146, "uuid": "d8301c51-787e-451d-846f-aa5bddb5228d", "value": "ef57f8d8a632b8cf2b89021e2a7be68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20ab9d5-c0d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678625151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625151, "uuid": "4718080d-abde-4fb9-bac6-841275fcf41c", "comment": "Malware payload (CryptBot)", "value": "0a17073d2b0900c2a0179b5bab94d839", "object_relation": "md5", "Tag": [ { "name": "0a17073d2b0900c2a0179b5bab94d839", "colour": "#082E69", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625151, "uuid": "61b1f9c9-ee35-4cb7-adc7-c3bb9ee21824", "comment": "Malware payload (CryptBot)", "value": "50ba755456d579ded57364b16df9d601e166555acca48cb97daeb8b9e70c62c5", "object_relation": "sha256", "Tag": [ { "name": "0a17073d2b0900c2a0179b5bab94d839", "colour": "#082E69", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625151, "uuid": "c221258d-f37e-4fb5-bbc5-a917709c2d99", "comment": "Malware payload (CryptBot)", "value": "57129acb0c62711598892fb7a2f9323652c2e912", "object_relation": "sha1", "Tag": [ { "name": "0a17073d2b0900c2a0179b5bab94d839", "colour": "#082E69", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625151, "uuid": "60d4751b-158a-43a4-8be7-b09af57b7461", "comment": "Malware payload (CryptBot)", "value": "0ea409b3c067f2790a96aafc2d732968c055504009ea6a92afa6a6cf3b4d7a716361aa2e67d0d8599c1f64ec725c910d", "object_relation": "sha3-384", "Tag": [ { "name": "0a17073d2b0900c2a0179b5bab94d839", "colour": "#082E69", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625151, "uuid": "58073feb-1080-4677-be20-57f547b0310a", "value": "T142050262F857D53EC0885BBBCE0720396674FA320579846B73F4692EFB1C0B2676B521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625151, "uuid": "e49ea6f6-7a9e-4094-8c0d-7d34b75382c8", "value": "12288:Rb+2XQPzGZPO2gFISnd5KMcttQvqyEjC+mOzQr7MgvC0yws+lRe3mLUH:AHPzGPgFISnd0bHGSElC146AUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625151, "uuid": "3882d93e-1f00-4f8a-ba22-c9d66ff32a9b", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625151, "uuid": "d1985871-5d77-43d0-8c5d-0f906a0b8879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625151, "uuid": "3bd84cde-9012-4dd7-aa65-01e1cd33d792", "value": "0a17073d2b0900c2a0179b5bab94d839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab69d56c-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babuk)", "timestamp": 1678646990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646990, "uuid": "41381d4a-f5e1-49c9-9df7-2d24a884c6af", "comment": "Malware payload (Babuk)", "value": "25dca003650ee8b8d909ac91e0fb3401", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646990, "uuid": "65af37e1-542c-43f2-987b-17f7348d55e2", "comment": "Malware payload (Babuk)", "value": "50eba374f306f9a8094b7458dd19001b4a921b8c955eb2b5c7a42f41ff45f865", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646990, "uuid": "65e0ef91-e0b4-46cf-b186-6c91bef3f831", "comment": "Malware payload (Babuk)", "value": "5c970d664002d1eca6dbd239ec4fe9f6e6c5806d", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646990, "uuid": "fbe544b7-024b-4e93-9e19-6d66b0795d2e", "comment": "Malware payload (Babuk)", "value": "3da3329c7cd39077e1f7973afbc7076ad1c5916141de77b46b15889c9528bdc449b297e7720a49a7dd246cb8040847d7", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646990, "uuid": "803ae8ca-c0c0-4121-9988-bee3966b5784", "value": "T106C4E53D9D742FD5E133F6700A66E091F6D082FAB301CB522BE68A4852B5735A2DF41E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646990, "uuid": "0969d592-7709-4df3-ac84-344b4824e622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646990, "uuid": "70c83819-5957-42b2-8061-bba62d471cc0", "value": "12288:2spEOE+fVpXb25YM/iv+6yvs8t5Q8X5QATXEEy4+PB06rGzcX3LwlZ+5Ix0PQcXL:o83o3r6xkckRp2Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678646990, "uuid": "706f6a71-f52b-48d6-a7cd-d33a4c23a317", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678646990, "uuid": "19a5614c-aace-43a0-acd1-b4008602e9ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646990, "uuid": "a98fef75-ffc3-4bea-bd4a-f1c98c9d44be", "value": "25dca003650ee8b8d909ac91e0fb3401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe381195-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648847, "uuid": "20ae4297-ef4e-45dc-a662-f22b401e5424", "comment": "Malware payload", "value": "79d98f8b3b828fea78116bb1da773c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648847, "uuid": "1aaffcf4-195c-4336-bf60-364b55748b00", "comment": "Malware payload", "value": "51b52cf60701b991d132d79beaff6f141306ee76b33cba0583d9feb28d01849b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648847, "uuid": "911f206d-db41-4e50-885c-e0b6264e9f1b", "comment": "Malware payload", "value": "db9698c7831b6222cc79fadc55098b52ff7c8428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648847, "uuid": "1c4f22e1-1485-48ed-8f68-c57e492f2182", "comment": "Malware payload", "value": "5b89760290170e24e2a8e8f105b17e70977f1f67e3784386ed2cc2d539fc7d0519953b76d8c633efc98b0f9ffcf09b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648847, "uuid": "2186cae4-7b18-418a-ad6f-a890ecbc555f", "value": "T17CA5F0A135EC54F3F2C1761A4BBBBBD7A1AD32D1591186CC0798D0833D1B62227EE29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648847, "uuid": "20f8dd7e-50c6-46a8-9af1-70d9ac1965cb", "value": "49152:icnPS84mGeZEO5GnmF+2GOZa7hNkyBiHM+UX/3Z3Rg6apCqX+5clSevZbgK:vT4pPO5Gn4SOAjkSvBTaPX+alSeRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648847, "uuid": "53b4f869-9b40-4fe8-ac40-34142198a791", "value": 2173951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648847, "uuid": "fb70a78e-66e9-479e-ab6b-0339ff1dc4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648847, "uuid": "60878044-51fd-41a1-9c2b-48320e13f6ce", "value": "79d98f8b3b828fea78116bb1da773c8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36c9cb6-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642387, "uuid": "f25b6def-7618-41ce-b3ce-d20d5c0c97c9", "comment": "Malware payload (SnakeKeylogger)", "value": "acc7440732ec76cb1e9bea38cb8631c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642387, "uuid": "d4ffb10f-7c7c-48c6-b788-10365957c7b1", "comment": "Malware payload (SnakeKeylogger)", "value": "52ea0ffc3f25eb55699eb8f05d1adf93d0c5a8e47e93c2149e706a50d529c4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642387, "uuid": "4823e20c-9ff6-464a-811d-9f16276111cf", "comment": "Malware payload (SnakeKeylogger)", "value": "3c81676437518b6d126133fde59fefea378b4b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642387, "uuid": "ae66b016-5de2-4d0a-8866-1570c134afe5", "comment": "Malware payload (SnakeKeylogger)", "value": "5d8bb6fa3b4f9e2436d05967415593a756f6adea2c29e60faf476055fd9e916e888e5cd1525e8a211f2140164d89105d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642387, "uuid": "4c3a6288-96e6-4307-bac7-10c1533a32a6", "value": "T1D444129872D0C59BF4E64BB22A7A359AEFB6ED190454230713808E7C7438191FE0DF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642387, "uuid": "8ce9f9fd-da29-4f08-b3c6-4b832b82a35c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642387, "uuid": "17ed4fbf-d1e0-4560-aa5b-d99b127f5da1", "value": "6144:PYa6bpRoH4dlISBQd6xI97EsqRPTBEu8BdGTQK:PYxwHCIwMKM7EsoBE3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642387, "uuid": "a49d37e9-a499-412e-9262-668e228d2271", "value": 258104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642387, "uuid": "dc6b9cb7-e32c-4383-9649-42985b6004e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642387, "uuid": "8b858dcb-14a1-4114-a5ee-0dd2ab2ce548", "value": "Balance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6cb420-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648629, "uuid": "648313d3-6e5a-4e00-a6f4-66a32d3b5165", "comment": "Malware payload", "value": "f30519d0761df332abc8a3af5a903349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648629, "uuid": "0e9e32b8-a8ed-4ae6-912b-debd14019a23", "comment": "Malware payload", "value": "52f8ff807edb596e952e0292db4015a491385d5eb28ab93755b9bf56feb34dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648629, "uuid": "cb12a9a3-3872-4077-b042-25a80928b74c", "comment": "Malware payload", "value": "1e7354196d897bc56bbf46c8f2bd04b7746bb595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648629, "uuid": "b22e6a1f-9eb4-4b8c-9078-7c9148417213", "comment": "Malware payload", "value": "b00d361e6a6fb3fab6ffad5c872ced15e8d5dfef420cf9253a21f03b87c5df8e005d7dec363d606bcb1bf0065c3dc466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648629, "uuid": "75af894a-3bc8-48be-9687-655bd28a84bf", "value": "T1ABD58C32BB049132E5D211F1C91C1BAF894CA53413B940D7E2D53AE969E0FE36B36B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648629, "uuid": "43be6324-5ace-497c-98b1-872409584092", "value": "612edbc3b53f6e607818891b34ab969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648629, "uuid": "5a0ac5d2-0f03-49e5-bdfa-442ff68da9f3", "value": "49152:JxoBBFCmp+qBROa7kOO1vkptyeM/R5LCGUp8STELt2OGWejmMefxa:HoB7ClzvKYd/R5LCG0BTy2Oa9ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648629, "uuid": "d7af4bfb-d8e0-4f40-82a5-6595f4b1010b", "value": 2793472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648629, "uuid": "d4058f3f-6a70-4161-a976-3b8e3a4df987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648629, "uuid": "759430f4-5340-4d02-86f1-8626ea60c00f", "value": "f30519d0761df332abc8a3af5a903349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4b89af-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1678648097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648097, "uuid": "ff585922-0c84-4049-a55c-a640b67b8e89", "comment": "Malware payload (Fabookie)", "value": "995631952f15f38358c589d9c7edcf16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648097, "uuid": "fa3f33d7-2c11-4a90-bd72-6d833af52414", "comment": "Malware payload (Fabookie)", "value": "5391a7633161e6b598557a56d313b89d27619d4f819566f8c808f84522bdef4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648097, "uuid": "e9d6cb46-f47c-4208-b3c8-46a647bf6121", "comment": "Malware payload (Fabookie)", "value": "451ba15da8fbe1a7eebe60ce826e9647d1358e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648097, "uuid": "a955c035-ad69-4405-82a8-c5e282791161", "comment": "Malware payload (Fabookie)", "value": "0f7246836f5d961c91eabf9c83bd1b7992281a476c7915e297834b29293189fe44610d02d14a3020612c83fc421d4746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648097, "uuid": "1e788b49-ca3d-40b7-8eee-2e8c53b4fcf7", "value": "T12AB45AC1B514C38CD81984319CD2EAF54A71BEF2DE2909DB35E1BF2F7CB5122252269B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648097, "uuid": "d08808a4-da23-4328-abae-b7a816951803", "value": "cb238ad11edc9989f023bcce9f933e46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648097, "uuid": "c34e24cc-0d00-4080-92b4-28dc6df1c665", "value": "12288:bTTx5KRZ78ztSo+szd5IugOOZLM3EMekf:0oztSo+sJVOZQt/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648097, "uuid": "b615039b-7ac7-472d-a871-78197670eeee", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648097, "uuid": "1db26583-da50-45b5-b6bd-f1ecad9ae805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648097, "uuid": "adeddbf9-cb84-45eb-a826-1e148b301fa4", "value": "995631952f15f38358c589d9c7edcf16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcd7585-c108-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1678647991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647991, "uuid": "b9e0207a-82cc-4ed8-94ae-383a202b1151", "comment": "Malware payload (PrivateLoader)", "value": "fa5e6e0f5063eab559c91a91a01c0835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647991, "uuid": "5cbf1ee6-dcb3-4994-83b5-97003f049f82", "comment": "Malware payload (PrivateLoader)", "value": "549f00b759a2d18d2958ac46b06bc7b043a4eb6b8842c104abd966127aad63b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647991, "uuid": "4fd43e3a-150d-4fa2-81bd-56f84a1df4ff", "comment": "Malware payload (PrivateLoader)", "value": "3a64140ea301da95b986a834eba843d81a541ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647991, "uuid": "9df8b0f2-b722-43d7-b4cd-8b5ffec4f39c", "comment": "Malware payload (PrivateLoader)", "value": "9b0e448efb1e5bcab86d11c869e30c233e04d8b43a8950613427342ff92a0c93426ff0065ae8267d38ab478d01be689f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647991, "uuid": "f4c66573-92b5-4f1d-8684-ccba0a260680", "value": "T132855C21E310F069FCA240AAF2BB09FB59241A30738514FBE7C29E957BA26D1F535D17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647991, "uuid": "fa924a99-74d1-487e-a0c6-55a9bd69d289", "value": "49152:kHEP1Ytp7MnOYoH7NzvsfZHXlIZELxmuY88jIvnPojMu:GEPuBSONzvsfZ3eCxmQ8cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647991, "uuid": "a2aa91e6-f9d4-4780-9751-6493a591e7f7", "value": 1822906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647991, "uuid": "dddb4274-f527-452b-9c30-f097497105c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647991, "uuid": "6f4da898-33c5-4306-b065-abab0e2f5ad0", "value": "fa5e6e0f5063eab559c91a91a01c0835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11c84d5-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648798, "uuid": "6826d899-6b65-470e-a8f1-1672c6a7dd38", "comment": "Malware payload", "value": "3b4691ea50fd1a923dfe6d7d139be848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648798, "uuid": "e91c33cf-2403-4b5b-ac1a-00de8f46e2c7", "comment": "Malware payload", "value": "54ccd5c0f8202618b382c77151ebbf26451099ab4ccb3cbde51dc68af78594e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648798, "uuid": "a1a9ee91-6a57-4e38-922b-07ac2cb1ded7", "comment": "Malware payload", "value": "e0c43500f79a73e649e49a6c8c71a2973c009e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648798, "uuid": "e87a475c-96a1-4453-b04f-278affa07368", "comment": "Malware payload", "value": "50b69a7012adb66c989c471662ad430fc820eb9ba4613a77216127bdff4117f8656324c690db4b3e639b3377a765e205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648798, "uuid": "dd7d52b9-baca-4962-9f83-ebe54090c95c", "value": "T1AEE5332B5CF69523F06C8F767135C11794F8E8823BAB2C64C80B41C79DA86E675DB478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648798, "uuid": "a763216f-1fb9-41ed-b159-4873d5a1f8ce", "value": "49152:es1km+UclRGJIWzC5Z32UFEUltWNyR2azTK8kBRvaFlc4ExoJkGgNwJlrH:es1MU4RPZVtWSitaFlEWDgMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648798, "uuid": "aaa2fc1b-c054-4b13-b6a9-bbaa3ef9be62", "value": 3102252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648798, "uuid": "be91d1e9-066f-4bc8-806b-db66f4ff2bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648798, "uuid": "38c171fd-7375-4a40-baa6-12369c06a86b", "value": "3b4691ea50fd1a923dfe6d7d139be848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355a53c5-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678633907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633907, "uuid": "ff10a0c2-1c44-4b07-aaf4-67c07c1c9fac", "comment": "Malware payload (Mirai)", "value": "58988bc4c78bb3ffe6498394b0b0246e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633907, "uuid": "56cc61a9-83b1-4955-bde4-c47f63f4b9b2", "comment": "Malware payload (Mirai)", "value": "568364d59a5a2f44036297ff425cae073598082561e6dbeeb7197fbfbe646636", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633907, "uuid": "48de2bd8-890e-4df6-89f3-e1920ab60da5", "comment": "Malware payload (Mirai)", "value": "b13c95888875ce908ba4e461025aa6626a602f1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633907, "uuid": "9c642b52-2ee3-49f4-beb0-47107b13a843", "comment": "Malware payload (Mirai)", "value": "04a7c156a7f02a2c05fab7d142a7bec5f4d1d1b20fe78cd88ca0637d2cf2f2dcdaf80e36dc3eb6a5f63612377d23f65a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633907, "uuid": "0d9062ae-1bb5-49cf-ae0e-50fa193ac4b3", "value": "T11313F226915527A3CB232973D624CAC377E31BB9857DD0460AFA84386BC29C7BD312C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633907, "uuid": "4f5b7367-4606-4761-8843-fc9582c374f9", "value": "768:tlLPsLAVIdI0xGB879q0H8Lh5Xyzbl3p/JllsrgU19q3UELu0:tlLBIdIQg8ZqSKh5izblDDrLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633907, "uuid": "a958d933-cd0b-4027-88cb-00083e524ee3", "value": 42828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633907, "uuid": "ee2f794b-cb87-4aa8-adc0-8269c81ac956", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633907, "uuid": "2fb83cc2-c150-4484-8042-5622e25b389d", "value": "58988bc4c78bb3ffe6498394b0b0246e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf29197d-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642299, "uuid": "4ec94d62-1577-402a-9ee8-1853c41b99ea", "comment": "Malware payload (SnakeKeylogger)", "value": "2ca18729246b046753afcb954ddc55e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642299, "uuid": "b4ca79cd-d769-47f6-87a0-f95b114d3d13", "comment": "Malware payload (SnakeKeylogger)", "value": "56fbf1b7fc32a3fa23aa809c590845884770ea3653c5281bdee0d2b6e2af9c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642299, "uuid": "7f30cd5f-692c-47a1-96e8-1ed9bbc5eb7f", "comment": "Malware payload (SnakeKeylogger)", "value": "8e717e739b328ba53b972dbd5482c2b4f5eed008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642299, "uuid": "3b541483-6832-44e4-b5d2-ef7381c7f834", "comment": "Malware payload (SnakeKeylogger)", "value": "1d1c3916b13ed1cb7c840b41a434ea1f8dceac220c7b74d5d582a1c19199c7c32d2b174693d0b29d2f6935b0412b5702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642299, "uuid": "2dcb3046-119c-4782-bd5a-cdafa9d7c292", "value": "T105146079CB94A90FF8B847F995328E29D567EDEC0931C1196F1E34B21B3BE941C0B612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642299, "uuid": "46aee710-01f2-4d46-8778-46ce6aadcea6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642299, "uuid": "749d823c-c954-495a-a9e3-5d2bcc3543a1", "value": "1536:JcCruVNoNvnp6SGSbdJ+qXfUdSEXYbzbPw1oeMf4kiFtQIb5vZ45W9vcXsjoAGY3:JXruVKdGs0ILlh4kiFtpr4A9kXsU9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642299, "uuid": "33a81789-e277-4e1b-9aef-436fd80034ab", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642299, "uuid": "15e750aa-bf2c-46fe-9eab-ad07582f3e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642299, "uuid": "f23c4b2c-b4f5-46bc-86fc-50bc5936798e", "value": "2ca18729246b046753afcb954ddc55e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b3ad8df-c0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678605919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605919, "uuid": "4fb03822-1f10-4e2d-8396-267b1fa97830", "comment": "Malware payload (GCleaner)", "value": "3c99122d8766057f2b6b6a296411991f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605919, "uuid": "313a718f-087d-4350-93ec-b96b89014627", "comment": "Malware payload (GCleaner)", "value": "5a155e9c5903604dad0919df4b7ed4a0210c4e770f2cd093002642e4451f8fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605919, "uuid": "72c20a90-7d4c-41a6-9c02-2b074525d89f", "comment": "Malware payload (GCleaner)", "value": "1e97836671212188686378ecfecd585892c3a74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605919, "uuid": "67e787d9-067f-4b46-9115-fd37d21e63b6", "comment": "Malware payload (GCleaner)", "value": "c87d21ed7f874ab77ca81eb49b0fc3d90edeb0b2ce5d9d12848155fb67a5e1ca21fbc34efd644bf18f12021952b861f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605919, "uuid": "22918cc0-28e0-433a-9b53-f09919042a3a", "value": "T14BD533165D4D64F8E2019535EC3AB4654F623EE74BB87EB6B3EE090E4B3F82360485E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605919, "uuid": "695cc38a-9e0d-4f49-9992-ecc67d78ca0c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605919, "uuid": "17dea28b-3882-4c5b-8647-24b2d3e9a908", "value": "49152:AGWX39tRDzZ3rQgIr2BVf7Ux+op6M5smcfJyUyZU4bNHBGT6kDbOKz:dWX39VBVDU0E6+wJyUyZJ/GT6KOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678605919, "uuid": "8c3154eb-8899-47fd-8cce-36a60b1a6df4", "value": 3007733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678605919, "uuid": "9bd31b48-94a4-4ab7-b247-8d980b71701d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605919, "uuid": "7853a1c4-15db-4f04-8d7f-57e452ae4d26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89b0d5a-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678648757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648757, "uuid": "1071fe82-c0a6-4068-855f-029287b95557", "comment": "Malware payload (RedLineStealer)", "value": "4014cf0fc0646d1d1a7e0b09ad4aa1dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648757, "uuid": "a4f3009c-87ba-42f0-840a-f6bf2f9ff7e5", "comment": "Malware payload (RedLineStealer)", "value": "5a978f3c62ee4fdc15a36110b6105d384c7176a056c371a7ab957b9c479f4fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648757, "uuid": "7afa7b28-899c-4e74-94f9-c74d20df38ab", "comment": "Malware payload (RedLineStealer)", "value": "a632fc28b4e1946d787b3c895c020c2fd0b588c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648757, "uuid": "ffdd7386-2903-421f-bf08-f47c69828f9e", "comment": "Malware payload (RedLineStealer)", "value": "80431c1a973958590f041e2c55bcbb5d89a0ffe32a756651e99667136ad3ed6cf4ea1737c5c2f47c7292482748dd9d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648757, "uuid": "fc122310-f6c7-4505-8254-40d3603429d9", "value": "T167C4F112B3E0A871F673C7315F3FD2A42A1FB9708F69676D22085B1B0BB11E1E566712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648757, "uuid": "a6972282-09db-4ec8-9c5f-227da276aacc", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648757, "uuid": "dcca33f5-1b02-4cc5-9f54-840a0e36cc59", "value": "12288:5d5+vYnP4MFbt9ZJM8HHJE/aey6Pl+sZKXIm:5vPLl68JERySl+3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648757, "uuid": "c3300228-4fda-45ca-80b7-5674f5525cdc", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648757, "uuid": "d1c14691-69f1-435a-b44a-095bab0b1ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648757, "uuid": "49432abb-0b8e-492b-bcaa-050d9f17af18", "value": "4014cf0fc0646d1d1a7e0b09ad4aa1dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54325372-c095-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1678598311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598311, "uuid": "bad71655-dc19-4a5f-8c4e-1bbcb05d0386", "comment": "Malware payload (Chaos)", "value": "17ed08ee4b730ff390179ecc05589c2d", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598311, "uuid": "97a2959f-ac96-4a77-8889-0afa74f90ccd", "comment": "Malware payload (Chaos)", "value": "5ab74f0fff69e6c6ddbdbb4bc00262db055a5dde45c60aa7d12f34a8044c0128", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598311, "uuid": "87631d5d-d8db-44d5-b8af-c6db2b337fa1", "comment": "Malware payload (Chaos)", "value": "993232f694230a2d5f573d819910dc36c4c0a631", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598311, "uuid": "0fbd66a5-0a66-4904-a890-80d4d887ed32", "comment": "Malware payload (Chaos)", "value": "02e017270e2ea195c86ad2ea4efcb57084678436f3a80d02486a0d417cb6c9624fb44780ac9c0a1fea28d244c2086208", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598311, "uuid": "725f19d4-a02f-41f3-aa08-e471911c4dbc", "value": "T16BB2D51867FA4A39F6FB2F7C2DB221105B75B857ED3DC74C188A004D0922B9CCDA0B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598311, "uuid": "8fca779b-63f4-494a-8e8d-a973320ce1f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598311, "uuid": "25e0f2ba-89d3-4c1c-984b-5dabc8ba7602", "value": "384:T3Mg/bqo2VcxtivpTUc3LTAzkQJKr91CAfb51eq:lqo2YtMpTLbTzYKr9/fbjeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678598311, "uuid": "30aa3137-6233-459a-b83f-38e2dda35960", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678598311, "uuid": "cab506ec-d147-46bb-9fe3-220a8d4546b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598311, "uuid": "717b294d-9661-4b93-aeac-991bb5150709", "value": "Bad Virus.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a553564b-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648698, "uuid": "cfaa9ec5-4e3e-47d5-a092-fea2393f37ee", "comment": "Malware payload", "value": "785be66853ae5e45dd315de32fedab12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648698, "uuid": "9524d7aa-4db1-406e-83b6-a90382444e74", "comment": "Malware payload", "value": "5acdff040c340be78ce724b10a827a3322c40a8365942d43831eda4fbeab3486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648698, "uuid": "ab192568-e3a8-447d-8d49-fff63101772b", "comment": "Malware payload", "value": "4fa0fcfe371804780c6fcf7a4a05544b82ac1a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648698, "uuid": "c60cfcc5-7e1a-4e2c-aff3-4422e99be94a", "comment": "Malware payload", "value": "ded71f3cb653a26482684315f2aeeb05332c78f21815a78e49fc5491da5422cd312c093cd98ad76f22ad985cd5092b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648698, "uuid": "4262ed64-0fbd-482c-a301-74ca7c162fc9", "value": "T180F4C06E82C600B8C27590B09EBF69F2D076F02505245A1F2BCBEF725DE4D75268BD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648698, "uuid": "b1385d31-f604-40f7-8768-e9e7e8af265b", "value": "12288:Pg0ZOcfP2a8/KSbvi3wyllwsCd3thlTSjmu7ssd4IRRlYrLi8PY5:P/wK2D/Kvo3thlejmu7lZlY/dP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648698, "uuid": "1ce7bd0a-19f9-4047-a00b-043ea71fa4ce", "value": 751433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648698, "uuid": "52ae7c98-1713-4c3c-baaa-ea09d609aff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648698, "uuid": "0d86c4a6-b521-4a15-ad27-c880e2ddf201", "value": "785be66853ae5e45dd315de32fedab12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d526acf-c0eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678635317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678635317, "uuid": "ecc0d136-5646-4003-a862-61da502530e7", "comment": "Malware payload (DCRat)", "value": "1a1b160218e7f32e9a9e281299fc7d1b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678635317, "uuid": "e17312d3-82cf-4751-abc8-2d0eeb6efd63", "comment": "Malware payload (DCRat)", "value": "5ba1b028da2c0e52c38c7a55bf1e7952cc50c907576ec2f22b6a25d691dde2d6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678635317, "uuid": "3dfe81da-edb5-40b9-8978-a0e456364811", "comment": "Malware payload (DCRat)", "value": "38613fd431f18ac8fcac96b2598c5e68d0b04147", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678635317, "uuid": "65783f4a-db47-4785-9467-1942f96e7a44", "comment": "Malware payload (DCRat)", "value": "68340f98e1b2b06ca2ee4e667f2c151f5848ead56e6a707f66e408cd556dda4a5080d939d2dea9f19991522ae08230d4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678635317, "uuid": "2c1e63b6-7b87-4458-b2c6-dfe85dcf5690", "value": "T1FCD5AE02BA408833E02A2633D9BB49545B74BE102EB5E65B3EB93F1D5F313927D186D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678635317, "uuid": "1ae12c9f-701c-4872-a725-7bcc8da65df1", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678635317, "uuid": "f0ba8c04-331f-4d46-85f4-c20b114ce3f4", "value": "49152:UbA30whzaUW4BKal8Ivx+gX3dB0+wKDo1Gp:UbMhmUW4s6vx+gX3dBwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678635317, "uuid": "14ef1183-d7f7-4b53-8af5-5b0fe9553ee0", "value": 2856448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678635317, "uuid": "ff90cf8e-0af8-4296-a86a-29a30ecebdc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678635317, "uuid": "95364821-6004-42e0-96b8-98d7d8c6a33a", "value": "1a1b160218e7f32e9a9e281299fc7d1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b5f394-c0aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678607415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607415, "uuid": "0ade5a7a-2b0e-460c-a0cd-853ee564cc99", "comment": "Malware payload (Amadey)", "value": "a67cee708b5adc2b87ac77a029a73535", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607415, "uuid": "05f3ba01-90d7-44f1-8f86-4b20df024817", "comment": "Malware payload (Amadey)", "value": "5c94874fe63306a85fbf9860a1bfc210b58c14c432fd9b30d5e570d809e300f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607415, "uuid": "ecc4b04c-3896-42c5-a1cb-6c0c3d92d798", "comment": "Malware payload (Amadey)", "value": "f6133c6947bfbec4cec51ee2e38675fdd410b2f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607415, "uuid": "0a7e0294-0333-4cdd-b592-cc44b9f8493a", "comment": "Malware payload (Amadey)", "value": "4f1f1c3447d628f16f6143b90861f2cf51a508d8787104c5e6ce57f4933bb953caa242ac9987ba0a9ca19abcec9767f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607415, "uuid": "c50b329a-25e9-41a2-8849-7fd4fa40ad54", "value": "T13E14AE0273E17864E6B3CB729F3FC2F46B2EB4614E69676D23145A2F0AB11E2D572311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607415, "uuid": "63777698-1472-4d05-95a3-feec38edddc1", "value": "498ce63ad5da17e4362994ba9a6fc26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607415, "uuid": "2fc9ee22-3def-47dc-b4f1-3ff189b00eb8", "value": "3072:fRyoqIlGeeYiQzl6kuKoWGNt3BR93M6yFboLX67+TJ:fDqeGeevMNuRVtxv8pFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678607415, "uuid": "ce7141d8-56ae-44b9-b3ec-ae4e4a39f2d2", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678607415, "uuid": "9cabe327-7fb3-4d44-ae47-7b79429c2203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607415, "uuid": "ae0aef7c-61b7-4430-a398-6d007a2bf09e", "value": "a67cee708b5adc2b87ac77a029a73535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882426e6-c087-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678592385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592385, "uuid": "2a536122-a439-4bba-b2eb-00e2b0b0da57", "comment": "Malware payload (RedLineStealer)", "value": "37b689438fe31e3b84bb2a126d6b6235", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592385, "uuid": "256ba082-46b8-42fa-8086-7b776dad002b", "comment": "Malware payload (RedLineStealer)", "value": "5e08524b23191616f63b71bac31557a50cf3df87629b413ca7c61de698ecdb92", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592385, "uuid": "292172af-3e00-40b1-9f91-1f8ebf3b96f2", "comment": "Malware payload (RedLineStealer)", "value": "377e74ee61133a7be0f1263d2bb3cb9061dee5da", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592385, "uuid": "4d87b237-8b8c-4c47-a5fe-f205c2f48521", "comment": "Malware payload (RedLineStealer)", "value": "1bd9b5d55c177b40007f417eb7ab23660fd73e14adc68ab9c31b983fefc0bd4b728e3d15ca7afa654f9d71d2c14aebec", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1515", "colour": "#D79557", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592385, "uuid": "a2322175-7119-404c-9cef-bfe7d792407f", "value": "T16A76330D221ED9223CF0AB7BF47158F2219F5BBCF895E55CC22552CF04EED692988663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592385, "uuid": "90fe4c36-d891-4cac-bb9f-a675614c08fa", "value": "196608:EBWxqj0USZTKWJ+36ztmz51LKJ12OadmE0PZJeTnFaL5gAa:E3SZTXcLKD2O7EPTF2gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678592385, "uuid": "195b8f79-a8b5-482f-9412-1d0b5cafa542", "value": 7827566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678592385, "uuid": "936118a8-2fb0-42fa-9e13-12cc7fa60d73", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592385, "uuid": "a1c447cd-e2f8-4b47-b86c-83b0e8036486", "value": "SOFT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761f5d92-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678643035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643035, "uuid": "5473786e-f7bc-444d-9690-9979b462a019", "comment": "Malware payload (Formbook)", "value": "68e4e02abb6cfe1a980aa3a97bcad4f8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643035, "uuid": "f819489f-9f85-48a4-9265-2b6b9240de02", "comment": "Malware payload (Formbook)", "value": "5e83e78d0fe81ef4fdeb85e1a97ee390aa9259349ba37abb7e32648ee2246404", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643035, "uuid": "2c61627a-aa18-46ed-ae61-080a28514573", "comment": "Malware payload (Formbook)", "value": "15885c44c852a92ccb8beb656e6f9e788794f833", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643035, "uuid": "dc105c02-4146-417d-8f1e-9e09ef2dd641", "comment": "Malware payload (Formbook)", "value": "1cebd71972cc7fd7c4f0056de6e56e5e8555529c1159124900c83c79d94d1ff253f59166019218d17962d9c930ea3713", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643035, "uuid": "1a45af49-e6b0-47ec-88dd-fa450959db9d", "value": "T1F732A70067CD9AFAC368F27342B5944849BEFA7335121BE5B49C90863BBE50D65F81F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643035, "uuid": "ff28dd2a-102c-47c3-8b5a-26b8a8c817ec", "value": "192:iAum75aReNM6p05FiVB+YjY+NYjRiUkqjZvWgtLChIvJZqc5vEQrfcPZSPmfzezZ:ihZGMJiPv8IYjUUDjZvWg1Ch2ZBvEQjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678643035, "uuid": "70de74c6-c5cd-45c7-b24a-0b7ac6622b56", "value": 10944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678643035, "uuid": "56c442f0-5f7d-46be-a4f7-bea1c41c148c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643035, "uuid": "e4d43364-82d2-46e1-afc2-77b0a18e9ef9", "value": "68e4e02abb6cfe1a980aa3a97bcad4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c60b4f8-c0a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678602915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602915, "uuid": "b3e35b4c-bee2-4c12-9365-8dae7a7e4c8d", "comment": "Malware payload (Amadey)", "value": "0602726e092d3e4a506fdbdd72fa8adc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602915, "uuid": "d9e22129-d0e5-4c60-b5d2-2cee706ce76c", "comment": "Malware payload (Amadey)", "value": "5e89b46386dafbc416a7339a063b398d19b2203176b58c44d6b59340db94e300", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602915, "uuid": "b524bdb6-302a-47c6-9d92-ed5c5660af67", "comment": "Malware payload (Amadey)", "value": "2bb5628f08d7edb578d7aabc461fbafd82cfa418", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602915, "uuid": "33012899-5f30-4e45-8350-53a2334c1f83", "comment": "Malware payload (Amadey)", "value": "fb75e8e22abdc24374734a68344382bfb8f299a1246dda77c6d0868f72324bd2d4557e75ec0602de44726dd051465f0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602915, "uuid": "710a93f9-13e5-4914-811d-b17d692dc5cc", "value": "T15A449E02B3E16865F563CB31AF3FC2E42A3FF5618F65676E23085A1F0AB11E2D562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602915, "uuid": "6ed5854a-fac0-4e6e-8545-055e41f50893", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602915, "uuid": "e76195c5-087d-45ac-8af1-87f75fd82963", "value": "3072:cdCiqni4foH4slQQ3XmIsf4fcyQwAVTcgfm6sX6o+TDqYI:Gqi4foHd3Xm3f4FQw0Xts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678602915, "uuid": "89f644b2-753f-421e-94c4-bfe10de38fa7", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678602915, "uuid": "b7557633-d6d7-435c-b271-6334d2b57e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602915, "uuid": "430047d1-9649-46a9-95ca-9d51c3e1bf31", "value": "0602726e092d3e4a506fdbdd72fa8adc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787be55c-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588064, "uuid": "59895264-1f7d-49e7-96ef-51ae0d7301b7", "comment": "Malware payload", "value": "550f42c5b555893d171285dc8b15b4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588064, "uuid": "f13e266f-9e16-4f40-b8c6-8261c0c98ad4", "comment": "Malware payload", "value": "5f187393acdeb67e76126353c74b6080d3e6ccf28ae580658c670d8b6e4aacc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588064, "uuid": "845fa257-af8f-4e35-a472-ec346caca36d", "comment": "Malware payload", "value": "36fb60b9aa51cf8ad9353b2aea24bc80545a9b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588064, "uuid": "e04c2de8-1211-4532-95f8-9014d786e651", "comment": "Malware payload", "value": "6bdd983d287f111fe3fe4b5d146eedea8939f8efc3c232f03fbebdab56a44bf530d5014438a643624acf0361f4894939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588064, "uuid": "ca2e0c75-225c-43ab-841a-9c4220954b9a", "value": "T12BF3295375E08460ECB1497169F194B01F3F7C220EB9A86A27B8A73E4F72A51DD37722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588064, "uuid": "355fe565-9115-4c7b-a165-2c3875c732e8", "value": "c8a247ca80236d13e8666489872047d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588064, "uuid": "3bf74d67-b298-4a3d-a63b-d176e57fefb1", "value": "3072:KO0J2HpaGm14EpPDK38yn1knptUsG8iQOzrh3S8II:x0sH1mHDK1ZkORS8II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588064, "uuid": "0cc7072a-89c1-42a4-9d5b-823b8d5b9da8", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588064, "uuid": "26f488f5-445d-465e-9b71-7f0709113cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588064, "uuid": "6cdf8791-2091-4da2-a9e9-b916c916361a", "value": "SecuriteInfo.com.Variant.Fugrafa.266661.22019.31016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51a9fc4-c11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1678656026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656026, "uuid": "8f6b2d46-5451-41dc-bc45-cc00ad577991", "comment": "Malware payload (njrat)", "value": "23a64eef3165c092e570dbfb8448336b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656026, "uuid": "ce3c769a-3af8-4188-a51d-eada7aa83b59", "comment": "Malware payload (njrat)", "value": "5fe1825b29c570c4e3414669e7c61254771a53b4f0abfdc103f7c41f901355f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656026, "uuid": "1783da4d-f551-4a69-9efd-4ddd92ff0971", "comment": "Malware payload (njrat)", "value": "a15b3bceea2641ad389ae74885e80924c6b331cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656026, "uuid": "b58282c4-1da4-49da-b225-3195ad24a09e", "comment": "Malware payload (njrat)", "value": "3594371801563cdcb6c5d65cb9f900821b80fc6723a089c58d46979399017b26d1bc3c01708d325962bea13bfa7508de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656026, "uuid": "7d42f55e-b1a6-446c-bb20-b4701870ae14", "value": "T11E64AE497BE48E5FD6C85F38D0D22304BB35E9077682B727879454392D42BDBAC8C89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656026, "uuid": "9d893a69-cb4b-4b8c-9dfb-f51c23eb8a22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656026, "uuid": "5f91218a-8a85-46a1-ae6c-07df48045e89", "value": "6144:Sr4a28zQ8upEXyJOUml2AgG1h2EDsP4AdNAkZf1fAHwFZbjdgKOrVEGNbP23BabD:SrCgyJ1mMAgGb2J4AzQ+3KyGNb7s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678656026, "uuid": "8c6b2ee6-bcd2-4a7e-901a-a83f6a2e4f4c", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678656026, "uuid": "3787fc71-d981-4b67-99d8-d41df469010d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656026, "uuid": "a95139af-f94a-4414-b3ac-8870e29cd6d7", "value": "23a64eef3165c092e570dbfb8448336b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3930bb6-c11e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678657339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657339, "uuid": "d732c258-b1f6-498e-b253-00dafe635bea", "comment": "Malware payload", "value": "ccb79f890454ecca985c303de399ee6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657339, "uuid": "6551c9e3-118e-472b-80e9-7d2d68b15e3b", "comment": "Malware payload", "value": "60b346fe162b2fc00328d09a35696cfe21f22925716d15fe9841f5fb9bc629ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657339, "uuid": "ae7b40de-8477-48d3-abf4-6c42c82cc971", "comment": "Malware payload", "value": "75ae53f445dff2f3987efeb2efa71ac6a6e32ec0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657339, "uuid": "83974ab1-4c9f-438d-aed9-a74dd4200d6a", "comment": "Malware payload", "value": "2cfb855a29cccb92d8b7d941526342d5ab6658932b1198e35b91ba8648fb705df49d9907718896955cd6a5a7809133e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657339, "uuid": "d4a5371e-f415-4388-84cd-292e794a0d2f", "value": "T1D344AF3256E1B861E6234B315E3FC2E4261FB8619F6966DB23086B1F18701DEC5F271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657339, "uuid": "e9fbbfa8-ca9a-478d-8785-1e15b25b17af", "value": "8f077cc2038fae85c4e9d8c60b51a269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657339, "uuid": "01518015-65a3-4f73-a567-51e32da5c225", "value": "3072:yQot1zGUSFj9bDeFy3i5AVWyaIwezaI7JolHbG+ViD6OkjI6pcETWIDX6Jmv/:xi1CUS5IDAVzaINWeGHy+sDCjrpcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678657339, "uuid": "589d6dd2-7bcf-46e8-862e-9e5f7bacf27d", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678657339, "uuid": "c6d698bc-80fc-4bbc-b47b-0609e543f11d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657339, "uuid": "a08cd417-237f-4b2c-9500-889a9e8fe06f", "value": "ccb79f890454ecca985c303de399ee6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b6c25f-c0d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678625405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625405, "uuid": "0fca6f06-8b54-4a78-9d8e-a86261d47db2", "comment": "Malware payload (Mirai)", "value": "98a7f38b48ba33ad7c440e231c385a60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625405, "uuid": "0bba02ae-6e34-47be-b79c-72a4eee5d498", "comment": "Malware payload (Mirai)", "value": "6198577dc3df0b2a6627a137d9e18a9120907596d041d2039b77cd2c9d999de4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625405, "uuid": "b8ad87bf-ef62-4b03-9527-03334a66bc81", "comment": "Malware payload (Mirai)", "value": "10141ca0d903b8ea339f0eec431d38966395400d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625405, "uuid": "23700ba6-3857-4b87-a667-60e3cc029c54", "comment": "Malware payload (Mirai)", "value": "62b9fda9fba12278ba656da34a5741c7aa9a09e2fa3cdc6a96c72418d4adf0c7cd6764dad3a016cdbf7d90d272137f53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625405, "uuid": "5b9d49b8-7d8d-4fe2-b14a-99b02af29f92", "value": "T194230271890E8EB164703C76EED9939376E12AB1C6672013D6280A3C2F757631E5BE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625405, "uuid": "08545cea-3964-4214-a40f-0809e242ab97", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3e9q3UELbUXfi6nVMQHI4vcGpv9:gECFd+A6YHAxDLRQZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625405, "uuid": "4aa414b9-b849-48fe-bddc-3dfacb1e99ac", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625405, "uuid": "5182ea4d-1afa-4ea9-a026-bdaae845b677", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625405, "uuid": "32376740-ca42-4f60-be40-57bbfce0c01d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f82a2d-c124-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1678659621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678659621, "uuid": "a8944806-87ac-4d12-be00-9fae2746d044", "comment": "Malware payload (Stop)", "value": "06b0a5bee593079754ec299aa900b9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678659621, "uuid": "33376dba-4ae0-4512-9903-5f0a6dcaac1b", "comment": "Malware payload (Stop)", "value": "626da43e5e9f4209332a9f0f7ad3680084e5aa481c71bc1ff6d299ac77fb0d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678659621, "uuid": "dc72080d-4f60-40da-b1c6-6302d4ffb6c1", "comment": "Malware payload (Stop)", "value": "942bb557466e2fc08b478fee97d14ab2756591bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678659621, "uuid": "00fbfecf-491b-4ea3-bf27-beb333fb0096", "comment": "Malware payload (Stop)", "value": "67d524d0a08c1ff59ed7c3056cd56e7c9129d87cc416799c7bc04d335bede18eb0c1e9ac0285cd895214461a9f694e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678659621, "uuid": "b025681f-9d75-4d21-b08a-a8daa5c01c5b", "value": "T14CE5F692A505BACBD48E17B99667CFD1E82E4FF903350943A868B8BE7E73CC1154BC14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678659621, "uuid": "cd60c1df-809f-4f1e-a074-48be88e71fc7", "value": "fcdf2e82d7ffd2b0b7147ae3b1f9e151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678659621, "uuid": "63bac601-e224-4e95-9ef6-1c4506de95b9", "value": "49152:TFuEcgU4vR2a8vl2zrbCWLAWrcBGZmeVL0aPrQ3zvX/:3vYl2+WprcBImeN0aPrQ3zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678659621, "uuid": "843a9262-5090-47c4-a804-e6c2d8076e1a", "value": 3227641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678659621, "uuid": "cdb24652-72ea-4647-bc7b-f2a4b84e9ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678659621, "uuid": "3aa20e20-1fc1-4532-b73c-bbf55da6cc2b", "value": "06b0a5bee593079754ec299aa900b9b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b21042a-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588068, "uuid": "bb35557a-ea57-49a2-9b25-ef994ce6ce8a", "comment": "Malware payload", "value": "ef62f2b7c05210471d56b8bee8072d2e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588068, "uuid": "4e84022d-fdf0-4d33-96b4-2c1ec0d4699b", "comment": "Malware payload", "value": "64255ff02e774588995b203d556c9fa9e2c22a978aec02ff7dea372983b47d38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588068, "uuid": "7a671e98-ccfe-4523-898a-eb29f33118f2", "comment": "Malware payload", "value": "c71ad39f0551a334c7f27261b660f2b54db097ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588068, "uuid": "9e7031d4-bc33-49a2-89c5-ba34bfe86873", "comment": "Malware payload", "value": "0342e15f3b2df6a91f409a10ce2d35b47b1c5be63fbd7eab014f289b670b14e5d750182e241fa63e2050bbfe28d01ebb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588068, "uuid": "90ce9a5d-49d7-42c9-856f-af67a3620ff5", "value": "T1B4B25C826749E4F2E8410A3630D7BFB6577CBFA81255AA03DF07ED76496313AF538202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588068, "uuid": "7a73c6fe-cf9d-4c2f-ad4a-d8af34e2efb5", "value": "20ea8a16f6d13c8cd72d49cecf55dd95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588068, "uuid": "ff568b49-6440-4751-8dfe-a9213a8475b6", "value": "384:RpWPvA1Malq+fy0iI43xc/OuM55qPKBSBUvbPljy/mmkezrvplI:HzlJySsxc9MePKBSByzQmmkefvfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588068, "uuid": "21ab5cfb-6ed2-40d7-94c6-b0e6900c8df7", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588068, "uuid": "80df7e50-5aa1-4a0b-8d5f-10ebf78124a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588068, "uuid": "ce372cd9-3c96-4984-acf9-c48f93623220", "value": "SecuriteInfo.com.Variant.Barys.321621.14825.19589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f4735f-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642304, "uuid": "2e1b8ed0-9380-40dc-a9e0-0a9ad58257e1", "comment": "Malware payload (SnakeKeylogger)", "value": "2955ec6dbe745f90707ed0f550125a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642304, "uuid": "45abfdd7-65a2-4e8a-943e-226fca928fde", "comment": "Malware payload (SnakeKeylogger)", "value": "67768864f24ba7a78e166bdc7e88eda674c67728645be4126b19202118bfdd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642304, "uuid": "990b8ee1-3ae4-4008-b305-f9aeb1d78bde", "comment": "Malware payload (SnakeKeylogger)", "value": "0e2dc22bbbd4db1efa37fd9231f537072cfaffe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642304, "uuid": "0fbe9c40-83ec-42d8-a2d8-0ec0c60676fe", "comment": "Malware payload (SnakeKeylogger)", "value": "4214d3561002959390c493db22547d4fe367fd02bd422af4b9f36f318b2df365a8956a3315360ab313f9495a5bf4a603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642304, "uuid": "bc0325a2-d5a4-4aec-bc76-2fe84cb11b10", "value": "T12805BE446351A97DCB67AABFF1161E24227C6C1EEEFCD6884908309F08ADFB544C19DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642304, "uuid": "90ee54ef-969c-42fa-94f8-70613b0b9a6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642304, "uuid": "c5c01a4c-4bdf-47cb-b6cf-151de91a8871", "value": "24576:4DvcyKWLrnL2bQTH6kkzsFF3ThVulwHJMMyCWyuw:4DXD567zsn3ThVulcGMyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642304, "uuid": "a1a5a961-1c12-4ab6-9c1b-bf6243191001", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642304, "uuid": "b1e9b4c0-cb03-46e5-bba0-bf84c09be7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642304, "uuid": "c115efe5-0f71-4d34-887d-ecd77b0cc584", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bd0853-c103-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678645721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645721, "uuid": "07c1a00d-41d1-4604-b9e8-3d41eeb87294", "comment": "Malware payload (Mirai)", "value": "8e7c99a20455928b8ec76d98796e07e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645721, "uuid": "d5e78734-b420-4ea5-98d5-9d384cb8b86f", "comment": "Malware payload (Mirai)", "value": "688f8befc7bc9ef121b8b6df1d7d1a96743501481db36ed8bdb339821764bf09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645721, "uuid": "4dbb3898-ef0f-40ee-9477-57c516a2fcff", "comment": "Malware payload (Mirai)", "value": "1e6e04f8eb0a209298239e835627573bc1fea7fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645721, "uuid": "620b54e5-cc7c-4c24-8e46-1291749c96f8", "comment": "Malware payload (Mirai)", "value": "1cc81bc0ea477f3979f4094e893bd37ff5c1a9b8876cd3f28d8e8e3f19e03c8ef967d6c00caaa3aab6a7b2e8dd56e16d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645721, "uuid": "f5c03a18-e496-4fee-ab77-fba50e7f5cba", "value": "T17C331795B8819A17C2D463BBFB1E51DD332163F8E2DE3207DD112F20768A81F0EA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645721, "uuid": "fbe7391d-cae9-46f6-9f16-03519f1c3243", "value": "1536:/h6nzyBD/du9SdFZF9lQ92t5tDevYtgXzF76rf:/h6nz5SfjQ0b+YGzFgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678645721, "uuid": "31b71211-d2f6-4507-a782-df8da4badf45", "value": 55032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678645721, "uuid": "4884ee2a-6cb4-4a2e-9f7b-b3b566d0d048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645721, "uuid": "d0b09793-f9fc-4957-ab30-e35e4ede283f", "value": "8e7c99a20455928b8ec76d98796e07e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db68181-c0a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678606568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606568, "uuid": "129f9788-ee15-47af-bbd3-499afe41d36f", "comment": "Malware payload (RedLineStealer)", "value": "66b0d3c28906f0d8c53c8d8821a5c552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606568, "uuid": "ecff764b-8f1f-4eef-8fea-f80b0871c544", "comment": "Malware payload (RedLineStealer)", "value": "68b94eab3ec125bb1388c138dc5785953d3b45f845dcddc2e11337c94b126c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606568, "uuid": "9178668d-beed-4747-93c2-7d07439bfa43", "comment": "Malware payload (RedLineStealer)", "value": "7ab73f3d8544ffdc26d04bb4e86967d573c4f78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606568, "uuid": "ea0e97db-325d-4bce-8929-129bcac309ec", "comment": "Malware payload (RedLineStealer)", "value": "f1b68127e31815a7a790c21cbe28573d9ab8d7aa9ea859b611d4832a10155a036f1ad73aabfc601f3c54ec91b62418ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606568, "uuid": "0ed39878-2b52-4026-bece-e369f8258e79", "value": "T11154D14273E06821E577CB319F3FC7E42A6FF5618E65675E2304AA2F0AB11E1E562312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606568, "uuid": "f0cecc66-5db0-473f-ad97-161076ab9246", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606568, "uuid": "44f5dc9d-3d49-4b9c-9f1d-2f5537dbd729", "value": "3072:ejdquyWo6SeqqOujk684UDN+/A8PdhgWTnaYJ2mOAxIJMwh6qvdCfaqEy61b1ATm:YqrWo6yuPU9Yd5GmGJfcq14WhIvo4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678606568, "uuid": "6f4cd036-2977-4d78-a736-6f09cba52db7", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678606568, "uuid": "fb61f4cb-ea56-4de7-91e5-a082b448c6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606568, "uuid": "ec1b174f-2baf-4540-9a11-ec2ce0195629", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4622d34d-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1678648968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648968, "uuid": "45779910-4245-4dbb-b7e0-adfad3ccdcf1", "comment": "Malware payload (Nitol)", "value": "1fb1714e0a89fdc555e773f3acf02e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648968, "uuid": "079f1817-512f-4290-825c-0a5af45bd475", "comment": "Malware payload (Nitol)", "value": "6a1313a927c54d184777177d54bb0c2a4f59c6bcbf7afde5529f141827fb2374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648968, "uuid": "1e6ca5db-6073-417c-ab4f-00c3815a78ac", "comment": "Malware payload (Nitol)", "value": "f32fa0871f47caed015ce9069bcbf3752bb111b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648968, "uuid": "cd7e0da6-552e-4d42-b5fc-63325aaa9946", "comment": "Malware payload (Nitol)", "value": "d68fcf4d7477d0b477be2dffdf49c2e8c53d048e5aa3035e12873afb3fed3a43500b08296e8d94a862455ba4286db0dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648968, "uuid": "d0249aaf-c56b-449d-a711-a1f417341175", "value": "T17FF4334B1B625AB8C4D55FF5B223E23DB639CE0D78CC07AB96B135417A50ECC3E84925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648968, "uuid": "26ac25a8-742e-4340-bd58-c2e1c8680459", "value": "33b00bba7b6a1f337d5d9b9762bdc904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648968, "uuid": "31ede2bc-02f9-43a2-900d-91e67a26778c", "value": "12288:rHyDt31ZsVch9lodLRI2IJRJmM3hIvWZD6c/ucfQzbYp+vdiueDxEBti2n0PT2Tw:rHQbs6h9iTm/mY1ZL/GzddiL9EBtQo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648968, "uuid": "daf7a675-781c-44c3-aa89-1d53f67e04d0", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648968, "uuid": "b805a898-16f6-4b39-bcd3-a9161221181b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648968, "uuid": "b47e6ca2-fd63-4dd7-a222-d0085025c2b0", "value": "1fb1714e0a89fdc555e773f3acf02e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad6bc3e-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678643043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643043, "uuid": "965eea33-ccd8-474e-8045-0782af34f4dc", "comment": "Malware payload (Mirai)", "value": "1ca329b6f612b53ec0a20bdf3cd776be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643043, "uuid": "b2bb0f04-0023-4cb9-aefd-bbd7351bd152", "comment": "Malware payload (Mirai)", "value": "6a30534f04f465c6e6f0360bd9abd9efb8c3dd4f1019d3d8e7d5992e85c96cc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643043, "uuid": "c86c4e61-88da-433d-a6e9-3675c908f77c", "comment": "Malware payload (Mirai)", "value": "041be20760ccc075d16f56717e6c3975fda5b508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643043, "uuid": "387c64fb-5c37-40ed-b7fc-33774d295dad", "comment": "Malware payload (Mirai)", "value": "8cae914c0cbd71f0c786017eeec66b62039ef8dcca6a379b57434c71d627e02b5100293dbdd6bcc52b9aca5d16dbc6e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643043, "uuid": "efce1274-4cc6-4e60-92b5-a8aa9f05be3b", "value": "T1CFB35C9BF800DE7DF44BDB7604534E0AB630A3904A831B262367BD97AC731956C57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643043, "uuid": "abd816c0-3011-4e70-8dce-01ee6b115782", "value": "3072:uBisBiqOrZwp6wHy14WImTm9ih8VwIGP+5mCYJ:25Hy1vImTmcCwNP+5mCYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678643043, "uuid": "6d7c0914-f287-40c8-bdb3-dcb9548872c0", "value": 110808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678643043, "uuid": "86afb7b2-14c9-4f49-821e-bb8d60c2d2ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643043, "uuid": "9975372f-fcc3-4252-bfcf-d246209c7f1c", "value": "1ca329b6f612b53ec0a20bdf3cd776be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cb4275-c0d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678625644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625644, "uuid": "bd7f2937-0c2f-49d2-9d06-3024ec92d233", "comment": "Malware payload (Mirai)", "value": "eaf24f2f4b654bf7c4d4ad31fae7abfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jaws", "colour": "#4F0A5E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x32", "colour": "#9E8FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625644, "uuid": "52043246-6390-417d-9c4c-61a3b84925a0", "comment": "Malware payload (Mirai)", "value": "6abcd0d8dac7c799033ab3edf0c71372f60ad2af06b8ded7e4d9fa30a5f82b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jaws", "colour": "#4F0A5E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x32", "colour": "#9E8FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625644, "uuid": "cb574d26-9358-4803-b589-2296c899db8b", "comment": "Malware payload (Mirai)", "value": "f86d12001976bed042a5bb55fe7d2a945f4dde1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jaws", "colour": "#4F0A5E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x32", "colour": "#9E8FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625644, "uuid": "888ad043-429b-4837-a5cd-14e79c930601", "comment": "Malware payload (Mirai)", "value": "0e3ac1bfe402fe5b539735aec27536fe8bece5779a5da25333e0a55d33922786bd97736760376d1c3457fa4b42e30c8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jaws", "colour": "#4F0A5E", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "x32", "colour": "#9E8FE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625644, "uuid": "8eeb0015-149d-408b-a9d3-55aa702ce6ca", "value": "T1E8F2F1828858C5F8C0F998B60D5FBC050550B71BB29DEDBADFD0699B03905A5B7BC317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625644, "uuid": "3b2460eb-52d4-4181-9dec-541ce0d55b2a", "value": "768:N+XDiWNtJwAOBdNAcu6Z0TAfKvUOr8PnbcuyD7UiyqZ:NAiWNtivBYcu6Z0TRUOrAnouy8ZqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625644, "uuid": "369f4203-563a-44d9-afc1-334c3b9a3d0a", "value": 34516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625644, "uuid": "851e9d6b-5177-4d76-86ad-1e56212a6e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625644, "uuid": "5d944823-7540-452b-a355-d08b0718be2a", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8e2f4b-c128-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678661404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661404, "uuid": "501fdef0-313e-4abc-8726-932edac4138a", "comment": "Malware payload (Mirai)", "value": "8640dd0da4be5efd6e523d43de16daa0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661404, "uuid": "c74534c3-3ede-4b08-bc1f-b0a04050ba14", "comment": "Malware payload (Mirai)", "value": "6bc66ba1f9325bc670b58ae51a5acc56dd044c32a1b0068433401b6bd2c810c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661404, "uuid": "158de00e-54d0-4745-a8c4-8feb0b2709f3", "comment": "Malware payload (Mirai)", "value": "a2ce990147a52f109461caa490f03c83289ed3b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661404, "uuid": "cfe48b95-6a03-4a3e-bcaf-1369f7b8176c", "comment": "Malware payload (Mirai)", "value": "38ca4a4e8b8acce70b57802df627a35abcd3d6c7423af73e1d1b28bb631beb0954bf12f612741a6e7e523b6b59738efc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661404, "uuid": "921498da-ec4b-4952-a463-201fde41a48f", "value": "T1C9C2E0A71A0546FEC550A93CA0095E4E0F1F95C45F788AE32F0CB76F8E9B678602C41F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661404, "uuid": "2af11bc5-f52d-400d-bc8a-28d7e2fc621b", "value": "384:MWv66YgiokzDM366q1tl8vGo4+VZt4rOt0N/bTt1fGh+StmyuAfwIaD0qyJD6+vG:r66Y4hy8OoZZ+rOuTLHOmyPXE0Tp1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678661404, "uuid": "79e5ac81-1125-47a1-9381-0c919b898803", "value": 27200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678661404, "uuid": "ebd1c66b-6441-4d8d-8d70-555de5850343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661404, "uuid": "c1ce5f14-b2af-441e-8848-3f2733cc51b0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044ddc8f-c0a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678603331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603331, "uuid": "95073af4-f21d-4b55-a005-0a83b399f277", "comment": "Malware payload (RedLineStealer)", "value": "016640db4cf85d42734ae27a2a595a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603331, "uuid": "e5b88815-08ff-4098-ba92-87f6003efada", "comment": "Malware payload (RedLineStealer)", "value": "6c2e979e42aa69492f7f79dcf51549fba9afa56ffa40db152d411361b826cab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603331, "uuid": "33e1f492-7ec5-41f6-a0dd-030dbaf49fa1", "comment": "Malware payload (RedLineStealer)", "value": "916bb709bba08d595d0ffbdce179c41e43b603fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603331, "uuid": "3037630e-8e65-4379-b746-676a0ea411de", "comment": "Malware payload (RedLineStealer)", "value": "71599f554dbd5449f652ca572091cf95407e3d335ed25445dab9bde5db31c5eef6a348b3f388ef6d9d05e146e0a844a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603331, "uuid": "ca69e8f2-04b7-4c4f-93a0-342f88620da9", "value": "T1BD64CF0273E06D61F6B7DB315F3F83E42A6FBA514D68775E12146A2B0EB11E2E532312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603331, "uuid": "021fbe78-12db-4144-acfe-cf9a51fda72d", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603331, "uuid": "16088ac6-a842-4c65-bdbf-6a32967fa017", "value": "6144:cqSU1KzZ7O3Coew+nFZ22MccRVvCG+fCssjOv:lD1aZ7O3S/XMccPCDKssj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678603331, "uuid": "690588bf-e19b-4f89-a94f-96895f6481a7", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678603331, "uuid": "b96a83f1-3959-423b-9092-347add53b7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603331, "uuid": "157e6bc3-bea5-4161-85a2-54aea74adaaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55296f2-c077-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585562, "uuid": "eabe19f3-6580-481b-bd9b-dfb10b1a085f", "comment": "Malware payload (Mirai)", "value": "053352a3daf0e520cdca2ab6c65541a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585562, "uuid": "d7bb53fd-2dba-474c-af03-d249028adb04", "comment": "Malware payload (Mirai)", "value": "6ccb1671cd36b9aea632bf260525e35bd59d15e40a049fe986102abd3eca7bc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585562, "uuid": "71197fb0-a235-4a84-9035-5b93ffa9dabd", "comment": "Malware payload (Mirai)", "value": "64928365af0b1ce43fec882d5ca602da4e1f316a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585562, "uuid": "dac334f4-5cdb-4052-8b76-ebbc87b1307f", "comment": "Malware payload (Mirai)", "value": "d08ba07bbb9742d085347f5385a26b9d5cb152d3108e3f421e6d16f6c41e45aa526e30c79147550dbc40a5865d492f0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585562, "uuid": "aa3f326b-c228-4ce7-936b-e5bafb52eda4", "value": "T1D3939309BFA05EF7E8AFCC3345D92745288D555A21A83B79B930D928B21B24F16E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585562, "uuid": "b045c9b4-a2b7-4c3a-a901-4c8364dd5187", "value": "1536:a5DnSB+v5RNQmuq17YE49d6xZLu8vJ4TGo86:a5TSB+v5RNQmL1vFrvhr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585562, "uuid": "1be3f565-9b7d-4ecf-8945-c2c7df73ea7b", "value": 92512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585562, "uuid": "a9794536-a315-4e2c-ba7d-eaf09eed2548", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585562, "uuid": "535b24d3-613d-4a92-a0ca-1245aab1acca", "value": "053352a3daf0e520cdca2ab6c65541a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37939038-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593538, "uuid": "995e69ea-c731-456d-8e2c-0542e60ec3f3", "comment": "Malware payload (Mirai)", "value": "d08dc70513143cc61c8ba737f53bb0b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593538, "uuid": "00819644-1c7e-4dfb-8381-ef49f77869bd", "comment": "Malware payload (Mirai)", "value": "6dd01c696ba79ffd5fd600d18dd464a7d85534148aff25bed370ed90ec025423", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593538, "uuid": "0fdac2ef-63be-4642-b0ec-30ac7fd2d32a", "comment": "Malware payload (Mirai)", "value": "e037f75afc2489c9a942f35aa4c2d1d472bad721", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593538, "uuid": "8dcbf392-2c57-4ec8-9bb3-6eb908bdc896", "comment": "Malware payload (Mirai)", "value": "93483f03ec0b84b810422cdd4d0b94a32ed5aac76c4e40b095fd4be4175286b833a937f9fa29fe8a05a9d9e0c5e2b08a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593538, "uuid": "a0cd2051-485b-4c3e-95e2-db1779b2b995", "value": "T14D03E18FA7F07D2ECB6E1A7961DA017A0DE07548588B8B67E3125C8DFC1F527E14007A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593538, "uuid": "01351fb9-5af2-4b9f-9968-54e39573f7f1", "value": "768:wxJ06HVZmAcDS+3LJREz8CAoveorosRn4G5xKph7Kb4pdWw+wDPxWU:wnTHnmXScNREoCA4FBRn41PdswDPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593538, "uuid": "f66d3977-c98f-4485-85cb-02a461d7660a", "value": 38652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593538, "uuid": "62935c89-4639-434f-a9af-1c7d7645c0cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593538, "uuid": "762a1748-d5fd-4321-94bd-ef3603243b57", "value": "bok.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06ebcae-c103-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678645737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645737, "uuid": "92a5dbc1-1dbc-4268-9554-c0c89d7185ba", "comment": "Malware payload (RedLineStealer)", "value": "2b900d6a6a8b00254ee2d663c87e96bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645737, "uuid": "2b6bb41b-a7ae-410f-8de1-8d929fcbd610", "comment": "Malware payload (RedLineStealer)", "value": "6e0365200963ca607182c929ba38904c92aeb7e68c98d1a7062928c3cb053b4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645737, "uuid": "9da60df0-33c4-4541-affb-6db445c95cfc", "comment": "Malware payload (RedLineStealer)", "value": "9684696d48f1320b0ba71be7c84d9bb0cd59138f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645737, "uuid": "d2d3b756-e245-40fd-8c35-a5135a568e69", "comment": "Malware payload (RedLineStealer)", "value": "a7f75ab4a8015335759ef486e156b52b05bd20792c968272c4466bbfe234cce7ee7f7d6b712b3f0d8bf56baa36adfdeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645737, "uuid": "4bad424b-30ba-4d27-9730-dc2cf383bdb4", "value": "T1B754C032A3E17811E5629B318E3BC2E4262EFCA19F6557D722086B1F19711EDC1F271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645737, "uuid": "d4776cde-1a07-47c4-afb6-7f6463f82103", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645737, "uuid": "9ff9dbd9-9bac-41b4-b8ac-dc14b891bb80", "value": "6144:jWj/LkrWGT9W7UzQszFNX/06wpa4GkHjNtE+:2zkrW5Iztz/vo7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678645737, "uuid": "c5251ba4-7696-4f6b-bc34-6e830eef606e", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678645737, "uuid": "6aab0311-d426-495b-9b6a-148626c3b70c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645737, "uuid": "b50341c2-2ecc-44b7-86db-809230412945", "value": "2b900d6a6a8b00254ee2d663c87e96bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8384ea3-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648837, "uuid": "9b6ef79c-b334-4cef-8a2c-8a96739953e7", "comment": "Malware payload", "value": "b51597e6b13d5c98dd0c798076674584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648837, "uuid": "50e359cc-b97d-47bf-9667-557e5563e661", "comment": "Malware payload", "value": "6f44685480b6961646b61690437a4297fee311b3f3e5499ca82bd3517f40f87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648837, "uuid": "087d290e-5dbc-46c1-a818-bd311fe19d3f", "comment": "Malware payload", "value": "d8e6b40c40357d4d6beb72462e2ef3f726502116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648837, "uuid": "ba3d7b58-9d16-4f34-9f25-65a20d0b5b69", "comment": "Malware payload", "value": "b891898f03677abd57ed0a439a88c8c30c75c247bc8ca9fb880ee4d452d2a5798ba6315ec5b8536c4c344bba137253eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648837, "uuid": "b4388a6c-a10e-443d-8f92-2f5aba60faf6", "value": "T1692633996A2E1754EA020C3FD005A556F64E1F8FD802FE4F77A59068889F74AF3D386C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648837, "uuid": "5e912f20-256f-4eea-b286-a0bafbeeb5be", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648837, "uuid": "007f7dc1-c913-4919-9be8-9e7dba0378bc", "value": "98304:2pFfeaPmgFHV/+abrBeudEKi/Omgzr7dCX:uFGaPmo/+Y0Ki/Omar7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648837, "uuid": "7d7852c0-4ce1-47d6-955c-d00cc81e71f4", "value": 4511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648837, "uuid": "5a4a877b-5dc3-4681-bf1f-61592a59ca41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648837, "uuid": "1c86f84e-9c0a-4bbb-ad5e-00ad0af27e38", "value": "b51597e6b13d5c98dd0c798076674584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818ff10e-c076-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585073, "uuid": "7fd529b3-792c-410a-9449-0a47dbc5e0cf", "comment": "Malware payload (Mirai)", "value": "3072d9b71df9397d74f81fc3d792f654", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585073, "uuid": "acb005aa-5732-450e-ad58-db24807ab64c", "comment": "Malware payload (Mirai)", "value": "6fe958721fcc0b999cd133c47377556986151e6da70a058e2c9eb563b5a7cbfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585073, "uuid": "beac3f5e-7848-415d-be63-91da0e22193a", "comment": "Malware payload (Mirai)", "value": "3002d33d3d8d41d8159838d199d4aca4a89bc324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585073, "uuid": "d1559fbb-ac3d-49cf-b016-e849ed42a37e", "comment": "Malware payload (Mirai)", "value": "9280c60e2c84e8dc07f57b345ca80a76cc8fda314903617f39608ade4390f82f5e9bc99326fd960b98a701cd3bcbcd50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585073, "uuid": "7ac0c048-caad-4ff9-8b3c-d2e701280f19", "value": "T161733ADAF800DEBCF40ADAB68527480BF531A3518E920F366627FD977D720A44D27D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585073, "uuid": "341b5eeb-21ec-4384-8ea2-88514a1f1ff6", "value": "1536:Tf1Shag/IQVrdz5R1rtjkUwo9uy8cWLcY4I8R6OKG7wIN2uV:T9QV7R1rtjkUF9uHiIG6BPuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585073, "uuid": "c0c19440-b3a5-4f0b-bbe2-df65012132c9", "value": 73520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585073, "uuid": "f982ea4f-bd54-4b73-995e-5aa52508f5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585073, "uuid": "ebb3c747-80b0-4fe9-9474-5c06b8b5b6c0", "value": "3072d9b71df9397d74f81fc3d792f654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfda22d-c10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678650055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650055, "uuid": "27813c40-fe4b-4ce0-8be2-a537c441c588", "comment": "Malware payload (RedLineStealer)", "value": "bd6158f5efa00546546efe3e95e85bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650055, "uuid": "f839b12f-511c-4327-bfd2-24190dc52ebd", "comment": "Malware payload (RedLineStealer)", "value": "708c855a1c23a0a0a51284d81704fb339b53d9b43b7a7fa26359c34441d5855d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650055, "uuid": "378e5172-0378-4b6b-b608-43d3c6dd2945", "comment": "Malware payload (RedLineStealer)", "value": "3e4cebb733da2bbc0c381fea446c09d82f8c599f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650055, "uuid": "212566d5-7330-497f-86f6-b18ee929d2f7", "comment": "Malware payload (RedLineStealer)", "value": "a7760c6374f58a372ba237b0705f13a417b0623fe7dcf6fb74c7007443e01c186442a6af6413bc9a476d57be5bbbbc58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650055, "uuid": "1b9f96ad-f307-4509-bd90-6a886aad897f", "value": "T12154195BC388B0A5E45994FDE8694C62448D6037238F8B7643880EFB5CD3B8DA5EC5B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650055, "uuid": "b18e2232-dda2-47af-b2d1-cdc219077a43", "value": "ce02c2c69b4ea04873b5d37f16f49ae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650055, "uuid": "cd55c428-2e44-4ff9-823d-086e6229516d", "value": "6144:e3Aafpi6utSZuaOvlk2z3nr+BT72/TCwkKdrrN+OIJ5tXwpEADuGvrRAGdZ1kgrA:XafpGVBns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678650055, "uuid": "f76cc8da-f72c-481d-9314-6f7b350fb1cb", "value": 293744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678650055, "uuid": "c199a08d-8164-40c4-9176-0a75e5230385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650055, "uuid": "6d8a090d-7bd6-465d-9003-5c7ede28f78e", "value": "rfdaemon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6f0e55-c0e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678633570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633570, "uuid": "2011259a-fc16-4967-ab0c-9c5716afbd31", "comment": "Malware payload (RedLineStealer)", "value": "990d291c9e2287594fcf3186d2e140e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633570, "uuid": "c71d3941-a46f-460c-a64d-031294b71e8c", "comment": "Malware payload (RedLineStealer)", "value": "71de2bc85aa6e8838bb645432e55a7b99a4f6755e99daa23bae112dfc5a3f127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633570, "uuid": "eccb4c67-fe99-41da-a6f1-954017cc9ceb", "comment": "Malware payload (RedLineStealer)", "value": "d249820d87dc50d700dbecb288b788bbbf398f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633570, "uuid": "a7008365-bfd8-40fc-b8bf-8b2d038e0cdd", "comment": "Malware payload (RedLineStealer)", "value": "a9cb8b1711212af15d511c3075e97a89b2f8ddc43b81b4a09495a37eb520728ab579ea0ad186d37b4eb5fd30a4ade163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633570, "uuid": "58beacc5-3832-4955-8a72-79a63208f87e", "value": "T155A4F11273F0A821F577C7325F3FC2A4666EF6614E68636D33485A6F0BB10E1E562722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633570, "uuid": "48111a0b-6519-4b17-8572-071fcabe37ee", "value": "3d4c16eb468ed7fad4115f689c8d6af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633570, "uuid": "2612caf9-4b33-4eb7-9870-3353669f5585", "value": "6144:hpqCfjcHwMbLU3dw4QHVa8GcVCZMh9jbMxCC7Nx9ipAEzmq4JerYh0K:hkAkBbQ3EHkpZ+9jbMMC7diiEZ4ArGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633570, "uuid": "7ef6b26e-ebc9-40bc-9929-d7671cbfb36c", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633570, "uuid": "40b21049-4375-4cd9-a55b-66d769f697e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633570, "uuid": "21d33c44-befa-4b58-ab87-61487806afbf", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5d7683-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1678648760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648760, "uuid": "60f56e31-e420-4118-9ac2-051f57ed8811", "comment": "Malware payload (PrivateLoader)", "value": "7fe97c1ef6fbf00093805ec6bcbd2676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648760, "uuid": "231e56cf-9a77-4dfb-8d42-fbcf2db11003", "comment": "Malware payload (PrivateLoader)", "value": "723e7f0611944c13a36874c4567eeeafc1dff1bd7228414562c5544c6aa761b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648760, "uuid": "f2e164a0-ea0e-4d94-8218-e0fe8c3188b5", "comment": "Malware payload (PrivateLoader)", "value": "494d23591eccdd8115208b0f78a7a1946d2706f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648760, "uuid": "03b2ec28-c70f-4c61-b5a4-01d1452a1eb4", "comment": "Malware payload (PrivateLoader)", "value": "c8bd57dad13a88d493fd2393a6964f930d7eb2537ae484163357e88014526f17ac38a0425d5bfd85e8ef9914344baa78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648760, "uuid": "476f6a04-fa18-4396-ba41-cb38b2059934", "value": "T1C00639693936277AC02904F88DC3ABC2D39453A5B8514B43CCD6BB7865A2C876FF72D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648760, "uuid": "2fa76779-f149-4eca-b196-74426d4069a4", "value": "682c694eba9e0616a4c044dd4ddddb2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648760, "uuid": "cc404c18-f9c4-4d47-a17f-768686b0ed57", "value": "49152:AM3mNXOGX5f3jpePSFludHU6xUx4+2DDJEq:AKmNX9XB3jpePSF0BNUx4+2D9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648760, "uuid": "7dd16949-56a4-472c-b72a-e3cbb79b16d2", "value": 3693360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648760, "uuid": "37392167-84d0-49ef-b51d-56bd906aab98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648760, "uuid": "ff79ee0c-ce26-4c72-bce4-b0a4b669f736", "value": "7fe97c1ef6fbf00093805ec6bcbd2676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ddab5a-c0a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678603951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603951, "uuid": "2f785659-f1db-4396-a27c-8c640344e3aa", "comment": "Malware payload (Amadey)", "value": "854aab2aa82affc24eaffc62d1993bb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603951, "uuid": "7ce05056-2eda-41ca-a758-ac92d630de79", "comment": "Malware payload (Amadey)", "value": "728e0c7a06dbe2e064e7cdc65b2c36413a830a8a4959893dc3149b8569f0641e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603951, "uuid": "ff8c1580-e73e-4424-b030-238b359f7977", "comment": "Malware payload (Amadey)", "value": "3ef7a3b4d882d48b0f9613a2ae5c1dfe4272bd3d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603951, "uuid": "6f3860cc-8d39-46f6-a524-40d588d8d1f7", "comment": "Malware payload (Amadey)", "value": "8035d68bf0b01e8d47a7bae06241d6cb449bf604cae08df59e55cc2ae525c21e56addd6d5d22ff6ceb896f6e41f24e8a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603951, "uuid": "01722d31-455d-408c-9b4a-9133584ebfea", "value": "T15EC4F112B7E1A811F577CB319F2FD2F42AAEB5214E68671D22085B2F0FB15E1D863721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603951, "uuid": "86c1c56e-625e-4a09-bc26-98ae45747257", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603951, "uuid": "cc64ade8-f125-47c2-99bb-f66aa493f337", "value": "6144:XqL9GjRW/5Zo92OcwaB+ZKLVo11w6QDyCWNEbQbZE2WVtXv+9NeeeQPyKO:6pG9QAKLVo16VKa3tXG9YgPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678603951, "uuid": "b35ec68f-67ed-4876-bf76-f46c448920c3", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678603951, "uuid": "2904378f-568d-41bf-aa44-871c1440039a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603951, "uuid": "7faa3f56-d7f4-42ef-bebc-60ad7a45c76c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f688215-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1678647158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647158, "uuid": "86ce7127-81e6-459a-9610-be2de4491317", "comment": "Malware payload (GCleaner)", "value": "b085ff032424f75a96d2b27bf595993d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647158, "uuid": "973baa93-3fe9-4488-85b2-0eedd0dff632", "comment": "Malware payload (GCleaner)", "value": "73ba62cba32b3737dc24ba697a638848ca97df33d4e3ebe87debeb3c140de23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647158, "uuid": "c89c454b-7dc9-4e58-b3ac-e5eecd27ce6f", "comment": "Malware payload (GCleaner)", "value": "3a555104add6236870e7a1555c1a7e4ca2f7c4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647158, "uuid": "0b3a63f5-2db2-4ed2-964b-459e08b80637", "comment": "Malware payload (GCleaner)", "value": "a43190a2fb6f860839d765a50e63efd896f1730915ffc708948177e50f60f2b31710731a030e544e121b4c4f38586055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647158, "uuid": "5e3fa114-a7a7-40be-8186-928f2cf2eedd", "value": "T1F5D533DB726388B3E294553079BE64905FB07EFF6D3E4454B20C4F9D1E2A581A42CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647158, "uuid": "3607f52c-3abe-4c22-a9e5-c577111e5b5d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647158, "uuid": "42aa1c14-a060-4a5b-9484-9f83e6d7c387", "value": "49152:AGdcptDCQLO5IfemIjf0Fita138FjwlSnefJXN5V4jEHcb3cNgzf6yLoOKz:dOHD/OGfevAFiIt81wlhRd5VIMCr2OKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647158, "uuid": "8de58edc-2fd8-4017-93ba-dcc621424b46", "value": 2995083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647158, "uuid": "3b952011-4575-453f-a0ea-16d0a1d89f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647158, "uuid": "88b97c8e-f0f8-4396-8e93-de651dd133d0", "value": "b085ff032424f75a96d2b27bf595993d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1540f6ff-c0e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678633424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633424, "uuid": "daa3904d-1da5-4046-bd52-d905ab2cd26f", "comment": "Malware payload (RedLineStealer)", "value": "0d6fbee1231d96c261e86165656ec7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633424, "uuid": "7c52d796-e4b6-401d-99fa-880a433bd872", "comment": "Malware payload (RedLineStealer)", "value": "74b17de2be43b4246889d3794d1d1dbed51cc29b997e556e34b363bf64a0602a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633424, "uuid": "5827cf6a-ee8e-484f-a31f-a2d944a92226", "comment": "Malware payload (RedLineStealer)", "value": "44a4198219bf6414617ba089b343dfd9700ca915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633424, "uuid": "4fee4451-9448-47f3-91c8-4b68af66e42f", "comment": "Malware payload (RedLineStealer)", "value": "667ad04a6137266b7551e0caa7bd6ec08dde80ed130a66f7b14dca167c3a2e6ca535c76b73de8dbc72165bfed44216d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633424, "uuid": "6022b9c7-dd18-4d28-8ade-91f314f161f6", "value": "T11DF40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633424, "uuid": "c3185616-a751-4b18-a9da-5a84f1ea8ad2", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633424, "uuid": "f0e80a96-ea6b-4566-a6b9-ebc3582c8e67", "value": "12288:wtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:wtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633424, "uuid": "0d2659ea-20ac-4d44-a758-26e51f380852", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633424, "uuid": "586adb28-f97b-4394-a203-83330563ece8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633424, "uuid": "d2fb8472-1d42-4fc8-b7bc-a8633630396d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb01a575-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642829, "uuid": "52e1a562-7a28-425a-9360-67c8c08e5021", "comment": "Malware payload (Mirai)", "value": "5e12de0496801f9e058b6c0dfb4681cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642829, "uuid": "8d50dc4c-0d09-4925-aa23-d5b6226a70d4", "comment": "Malware payload (Mirai)", "value": "74ef3782efc9684c00faf0008e24835f8fbb6c4825a5454f01a392c9cc9a250c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642829, "uuid": "0fa9215a-0051-4043-8f0a-995043006156", "comment": "Malware payload (Mirai)", "value": "9a76e96d8e1a284dc4ec78fba66032ea8f0cf65a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642829, "uuid": "11aac078-be20-4255-a1ad-94e973bef403", "comment": "Malware payload (Mirai)", "value": "6b2f9592e272bf71a9d5eb257eb1fbb6b9c0445d73ea252c379777ceb1421d6c0e6b489c5b221932e5be6873053dc980", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642829, "uuid": "ecc8b891-3020-40f7-8b88-0ac6c83b0a3f", "value": "T11BC2D0BBA1527763F324F6BA05E05F763F1B8AD7061458478812588C691F80EF312ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642829, "uuid": "bcb02c1d-50c5-4e92-9739-207fd53cf5ab", "value": "768:KZDGFtNsCIyekWFGKk2sN8SCGZHO+mgPsL:KZyIy+EKk2QbsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642829, "uuid": "88fe19a0-82b8-46f7-b66d-788384cd9969", "value": 26532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642829, "uuid": "5a77f3c8-5f83-49dd-a944-f285217b01e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642829, "uuid": "b743fb57-efb7-414e-b5c1-292a97d448d3", "value": "5e12de0496801f9e058b6c0dfb4681cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c41a1e2-c111-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678651501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651501, "uuid": "8f036231-0c21-48cd-abf1-b42e8e3eedf9", "comment": "Malware payload (RedLineStealer)", "value": "2c3c1223da65d88a5969f120e2910f12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651501, "uuid": "d96cb2b9-0ec9-406e-95a5-0ccecf1d2bf8", "comment": "Malware payload (RedLineStealer)", "value": "752b04cf961d18e55f69e68f1d279a8da2c3cd259dffa68a984a0bea8489b98c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651501, "uuid": "c6e9f038-a24f-429e-910f-236ab7fb2182", "comment": "Malware payload (RedLineStealer)", "value": "384a69714fc5bfb26252685c08f65901af976af8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678651501, "uuid": "b2db5a04-8661-4570-a6cf-29978ad3b6b2", "comment": "Malware payload (RedLineStealer)", "value": "1598014d011448a6aac62861fd23ae28d02a27877efeffdaaf79f162b5bb16f7f435ef881c76fdddf2f1f9c325db830a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651501, "uuid": "d9ec031a-c6be-4291-8c02-7f78f575f3aa", "value": "T14054C03397E27410E5624A318E3FC6E4372EF9519F2A57D722186A1B09B11DEC6F270E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651501, "uuid": "706de280-35a6-4973-8c71-dc05bc19b9ab", "value": "8f077cc2038fae85c4e9d8c60b51a269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651501, "uuid": "29a90591-ec57-43a3-9335-dcdd3597622c", "value": "6144:x+W1w5MV8ejCBCGzA6SjDvqN5XPANydoArS3:8gw5MpeBCGWqN5XP5doA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678651501, "uuid": "10656142-209f-4ba1-95ce-42a27325bf20", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678651501, "uuid": "67244883-aef6-4b3f-ae4a-f696eb512062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678651501, "uuid": "45307b08-4d6e-414f-8ae3-8b69ed5bcaab", "value": "2c3c1223da65d88a5969f120e2910f12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aff649c-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678647151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647151, "uuid": "96d23633-b10a-4310-8905-1c306156c8c8", "comment": "Malware payload (Smoke Loader)", "value": "49ec758b402dd7f9f6fba77ee859c7cf", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647151, "uuid": "e7d90cda-e189-4da4-95ab-c7b460e10b59", "comment": "Malware payload (Smoke Loader)", "value": "75cabcf2be5a7fcb0b2e34c7d70423cd8d3f9d49cd976ca4231041fa67d6dcd3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647151, "uuid": "53649350-e352-4afb-a89a-da42acdab516", "comment": "Malware payload (Smoke Loader)", "value": "b022051a811ee96a486a302b26f353c071e6f137", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647151, "uuid": "3427aee9-cb73-42cd-ae7b-ebc5da9e948c", "comment": "Malware payload (Smoke Loader)", "value": "f0bc71310d2e82b471b3ed36da9e20dc3ddd819f4f9e50df167848a0e9664c2c49763d51ad7016947b78ac341a74a9d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647151, "uuid": "12c80f97-36e4-400a-8436-39a7355e395a", "value": "T15F149E1273E17861FBB2CB319F3FC2E42A6EF4614E69675E23045A2F0AB11F1D562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647151, "uuid": "20178121-632d-4024-a687-e4c018b5b1dd", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647151, "uuid": "75eeb1ea-c60c-436e-a0de-de05dbf421eb", "value": "3072:YjXqFmOe/ooqqCAjEU81kmIzNM9J8TVTWd/qX68+TIYI:8qEOe/uAj581k9zNKUui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647151, "uuid": "50e4dfbb-cd71-4138-bc27-5152a97fcd97", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647151, "uuid": "326eb5ef-b4df-4914-a5c5-86d256ef6852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647151, "uuid": "906d8102-7157-4464-bbd5-23a9bb0f49e2", "value": "49ec758b402dd7f9f6fba77ee859c7cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214a8bdc-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678647188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647188, "uuid": "d6e62bee-cd9c-4fc8-a9d0-2a8047635749", "comment": "Malware payload (RedLineStealer)", "value": "38bae45f83ec318543d4a30a1457800a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647188, "uuid": "d23c5b51-782d-4a75-b7ae-1f618166d73d", "comment": "Malware payload (RedLineStealer)", "value": "77583bb7fe59fe794e135ee5a969dca597500a6c32443fe95f46bb995b8e1224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647188, "uuid": "1cd72e96-97b5-4585-97f2-633db3f0db5c", "comment": "Malware payload (RedLineStealer)", "value": "a24287ad68fefd0383b9332739eed326bba181d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647188, "uuid": "5c281b18-a315-4506-ae3b-a39c2226257c", "comment": "Malware payload (RedLineStealer)", "value": "ca7f68af0dab546018bb57afe0ad1e76fb82bba5fa6f7c10f13c9c69f76eeb92df6c973951ea3466e1aca89a51c221be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647188, "uuid": "993158f8-49af-4d8d-b90d-a6b2b2c9d00f", "value": "T14864C0129390E825F352E671AE3EC3E83B3EB5A15E78779A3114593F1CB12E1C972352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647188, "uuid": "2ac2f39f-4bb9-4776-a2b6-2c7404093adc", "value": "858e6430e3652e12355faa06f640c4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647188, "uuid": "481b6e96-949f-4ed6-8c9f-705d354be1ca", "value": "6144:TFmlfxA9U4J0qVt912akf96sFHMPYFdNDjN6jOk9hrIz/9h:x+xA9Ug0KYdfs+MCdN94Hre9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647188, "uuid": "d48f93cf-23f7-4a51-8c12-3c6f5ce42f44", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647188, "uuid": "3ddc717a-fd49-47a9-9e22-43a9f2685b52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647188, "uuid": "5227339c-5438-4095-816f-608704a2aaeb", "value": "38bae45f83ec318543d4a30a1457800a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae21ed9-c088-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678592739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592739, "uuid": "c195765d-2665-4c6d-ae34-3780b9f52d40", "comment": "Malware payload (RedLineStealer)", "value": "1a1c3d59d98acae1cbb61d7684f23630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592739, "uuid": "1b1a804e-c459-4cbf-8391-8dd8b8116f7e", "comment": "Malware payload (RedLineStealer)", "value": "78a85115cf45f7aa9a78d2c858b38901f62c912372dd8fe02d9fc1d157d51b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592739, "uuid": "77e85599-2a8b-46ff-8c6b-014bb84bbe32", "comment": "Malware payload (RedLineStealer)", "value": "c460bb203135a1501ed262ad0942e31e00b120c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678592739, "uuid": "19ff30a8-2e75-423c-92ca-8367345851da", "comment": "Malware payload (RedLineStealer)", "value": "488e47cc870bafc9ad5c3cf5f9e3f9ca7693f8ecaa335b228417ce137782fc69942b2b01e167f0fba9fc2419a75bc876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592739, "uuid": "3cfd6f0b-f058-4b1c-bbf6-61a31fd4e60e", "value": "T1BA54C55B13ECEA30E15DC37AA26EA62198A5207327EF0305BFC602DD4FA0A557437D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592739, "uuid": "9f63a24a-284d-4656-8f30-499e097171f1", "value": "42c33bd1a58284475b1c911a0256f875", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592739, "uuid": "2c768d10-6d0d-4df0-a46e-3dd3f3958036", "value": "3072:Z3+SWzM3wrqc306QxK7JylrH4omPLRGy/0hUK17jfTQBT+JXbtGaktN2cCej9OTv:Z3+SWzM36k6QxunBmwilBGR/9a+IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678592739, "uuid": "720b74f5-132b-4009-8b6e-75bd4118f421", "value": 279408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678592739, "uuid": "0e59dcd8-77aa-4492-9cbf-0774af34d1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678592739, "uuid": "8401d620-3758-4135-b598-0acff8c8aaa3", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0470622-c103-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678645710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645710, "uuid": "62ad928c-da1c-414a-b621-6ccf81fd7bea", "comment": "Malware payload (Mirai)", "value": "1645bb050d4d7d923c887ecc283ab2ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645710, "uuid": "acd6057a-8a40-4578-839a-be48f2ba4b7d", "comment": "Malware payload (Mirai)", "value": "7a515b99eefb9d990fb147b9e737c854f147bcb718d74a2132bfce10392acb72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645710, "uuid": "4084f037-e82c-4c60-9dc7-6606f79b3297", "comment": "Malware payload (Mirai)", "value": "206feeb734cb47791d05e76a53b91fca5e157a9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645710, "uuid": "cb9613f2-e3ac-4f02-89da-2d7c0fc688dd", "comment": "Malware payload (Mirai)", "value": "a8b018f62d7ecb34239c468dbef6d7318c5ffcf4f556839c742fd7a049e5c202ea3beaa1a199c54826bcbe409bc74b34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645710, "uuid": "523a4190-1e3c-414b-bb39-a7f64be0e672", "value": "T1CD630896B8818F16C5D413BAFA1E118D331727B8E2DF7213DD105F20778A92B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645710, "uuid": "5cc57dec-9b20-4be6-ace8-6f6e6431be55", "value": "1536:VRnhB6FduY0k4OWOwJDbgihRWa74EA3hMeitqrusFw:j6FcYJWfxnhRWahqrusFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678645710, "uuid": "3c02269f-d489-4ee2-8cd7-a6a8e61a466b", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678645710, "uuid": "aec029c2-15d9-4435-b076-a2c1413d5391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645710, "uuid": "7218569a-93ca-449d-b963-7e0d57116feb", "value": "1645bb050d4d7d923c887ecc283ab2ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cabee6-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678648731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648731, "uuid": "dde6c79c-182b-4f45-9cb6-df1a8bdd745a", "comment": "Malware payload (Rhadamanthys)", "value": "63d2ecdca4e9cb5e3e39747872ce69e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648731, "uuid": "39addb7f-833c-45cc-bbac-8150efd549f6", "comment": "Malware payload (Rhadamanthys)", "value": "7a78888d3616fa77722ef3e59d343db0d32e43d62b79d911ae06c9a26707da21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648731, "uuid": "f1ca3ef7-c608-495c-bb0f-d59e60941d00", "comment": "Malware payload (Rhadamanthys)", "value": "2052d1f95e706f94d68789eebc2d8f0eab95ee55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648731, "uuid": "9b9075b9-ea44-4b22-a7f2-1c9bef2ea3bb", "comment": "Malware payload (Rhadamanthys)", "value": "37c3e12af4970947c21b9ac1f8e62ee29bb2b5bdafad0d75b37b40d1b3825b451bde6c0eef95cf7531ae0f9e3d07d6a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648731, "uuid": "c3562960-588a-4817-8441-82d50bd7b207", "value": "T17444CF02B3B17860F5B3CB719F3FC6F43A2FB8214D69676E22445A5F0AB11E1E562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648731, "uuid": "45facab6-627b-4125-9f09-d7600cb9caff", "value": "498ce63ad5da17e4362994ba9a6fc26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648731, "uuid": "790fae4f-615a-42d9-b04b-a319d0cd62c8", "value": "6144:rLq44sMX3P/cUJzEQYDtzAHK5rfg9wEp:reFsW3xJYHtzAHaLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648731, "uuid": "a35258c1-f32e-4496-887b-cab31e607565", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648731, "uuid": "3f2542f0-d1a9-4273-b22f-330cd1441ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648731, "uuid": "d5bc6686-8fd8-4f99-a889-90eac134db6b", "value": "63d2ecdca4e9cb5e3e39747872ce69e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8c35ca-c0d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678625407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625407, "uuid": "6edd78d4-fff8-4bfa-bc39-2483b9173d0c", "comment": "Malware payload (Mirai)", "value": "68df7a277e43ba616e6eba436e808c4f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625407, "uuid": "71d21a5e-cafd-4041-85b9-0b5158ca1786", "comment": "Malware payload (Mirai)", "value": "7b14f4322219a57ca9da143f5bb126d732b05d9b034037d3aced8f2588b86ffb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625407, "uuid": "f141b046-e97f-434b-bd7e-c83b182677c0", "comment": "Malware payload (Mirai)", "value": "4a75f92e33f926c2c671271f6cea5654634212a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625407, "uuid": "4cdd2980-58f8-453f-8964-e8d5ffb7856d", "comment": "Malware payload (Mirai)", "value": "0954e575907c9eac0a0b0e9486d2d6c9c3695a8ba5927d84bb18ccaf1c13fd902fbf71a25408699b852626e0f642d544", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625407, "uuid": "037ab4d8-76f8-4d01-bf5c-4f6b1c1ee9c1", "value": "T157A2D11572632E55F3EC2C3CC96A8357B9A70BFC80F5327679455520C90924A3E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625407, "uuid": "abfc81f2-e0ba-46a1-96fb-1c7948dbf665", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjdthymdGUop5h+:vvQn4j+ZO5fKAlx7s3UozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625407, "uuid": "32ce9743-ad47-4880-a7e3-6cc73b65615e", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625407, "uuid": "a2f14d2a-1201-4123-bf21-f13b46f0a906", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625407, "uuid": "2d7b10e6-f83e-4178-8bb4-ca3d5ebe4f77", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c84adb-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678632799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632799, "uuid": "e961ea48-9c5d-4878-b5ed-e7b7ce00c78f", "comment": "Malware payload (Amadey)", "value": "375b8b3ce9bb7442a953215a9f5997f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632799, "uuid": "0df21cca-4c75-497d-92d6-6417dc61e55e", "comment": "Malware payload (Amadey)", "value": "7bec91dd6b35f49f13ecec074f252dac76517c2c3f0fbbee81380795cec227af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632799, "uuid": "23b8dc11-770b-4e9f-99bf-2e3b141a995a", "comment": "Malware payload (Amadey)", "value": "5b27c52c03f808261c98d59c2c698553ac3e7d86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632799, "uuid": "1e38fe43-42be-46ed-b82b-ec79293f9ce3", "comment": "Malware payload (Amadey)", "value": "b5b13072e768e67f6113032a6741592cb28bd00481b85022a2b789b0a6ba4fb040581858650f068f75c48d8a568763b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632799, "uuid": "d751cac6-7b42-403f-8d1c-16a10d8fc36a", "value": "T109F40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632799, "uuid": "a7474b87-5e48-4fb0-bff2-4e747e6b74a3", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632799, "uuid": "d378def0-38eb-44e0-8715-6931d89c4c6e", "value": "12288:GtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:GtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632799, "uuid": "0a6ac2d0-7002-4625-92c7-4ce2215477cc", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632799, "uuid": "311fbb2f-cbab-4f01-864a-4189405e2332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632799, "uuid": "e6f090c2-1340-4991-a33d-0ee1ed6b9512", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868b83ec-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678648646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648646, "uuid": "1a8b7469-d003-4743-97db-ad16b7fd81a6", "comment": "Malware payload (Rhadamanthys)", "value": "21062da5f063032657a316adb7a535d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648646, "uuid": "45bc6fb1-a8d9-4ccc-80e6-c666e120a3e9", "comment": "Malware payload (Rhadamanthys)", "value": "7bfaad45889d0cb9d2bde28ef578cbe57cad912dffb0498cadc6306ed4451df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648646, "uuid": "1e64b134-5b70-474d-8480-dac3c5215f0f", "comment": "Malware payload (Rhadamanthys)", "value": "2f6ffd7b32502763451e36fb37d0387e50dd277a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648646, "uuid": "d839d5f5-4f45-4a25-95e6-309621853b89", "comment": "Malware payload (Rhadamanthys)", "value": "4641e09139809ef895419b2af2d8ee3faba93c470cbc64253306d475bf6337f0823372b8be8261e395c0a029a994788c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648646, "uuid": "17865e65-a7f5-4414-a746-2fb60fbe66d0", "value": "T11885D0692394472EEF53847B843F23908E6479339E2591CA614CBB8EC75D488B53FB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648646, "uuid": "12582fd4-2be8-4274-a1bb-d690a04e0684", "value": "533c5409968cfac36437ac5835c4d83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648646, "uuid": "5285243e-aa54-4e20-bd44-a2cb21a9bffc", "value": "49152:9gSnSRcMT/lNSdrMXGFoy3bgYQ9qqgPgx:9ZOcMTidrMWFoyLgdqLPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648646, "uuid": "9b7191ba-d9ed-402e-a965-f964e902fe84", "value": 1763368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648646, "uuid": "574788cf-70c4-4d9d-864d-9fdacc58cc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648646, "uuid": "d681d617-367a-4b0a-a10e-365790e71b20", "value": "21062da5f063032657a316adb7a535d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d538c054-c06f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678582206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582206, "uuid": "d6b9005a-4b6e-4ae8-9416-d6c13aef9150", "comment": "Malware payload (Mirai)", "value": "0e7a1f4da72dc70a8ee92df9aa8ad17a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582206, "uuid": "2a930f13-ab77-4557-86ea-a787574c2527", "comment": "Malware payload (Mirai)", "value": "7ce29753a61c2c8560a52edd472e17113f76773ab0ff1ef1ad1b670bd860388a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582206, "uuid": "de1792a6-e221-46a6-a7cd-796c13ccc8e7", "comment": "Malware payload (Mirai)", "value": "554a9a75e8c2f583d59357d708285682bade2352", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582206, "uuid": "95b90080-544a-49ce-b90e-9fde8cee0ff7", "comment": "Malware payload (Mirai)", "value": "af2475b894fb9edc2df9f0d2e782088dfc6508b0fbb2b2399793e1a6021e77e7c4f60112d22757c246ff383f3ac20a9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582206, "uuid": "db0491b0-c92f-4bbc-b6d0-e14f3e06e725", "value": "T1C9633992BC819612CAC413B6FE5F519E371213D9E2EA7207AD15AF2037CBD1B0E77252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582206, "uuid": "03f1de88-e3a2-45a6-899c-6121e12b9dc1", "value": "1536:zSDWsMHjmC8XrdbrtP0HZIYbwqqaxgFDvyt0X4N70RXtvz:zSPKjm5X5JYEZ02vk0wIPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678582206, "uuid": "481435e5-e2c5-46cd-be3c-e79f8a67a51d", "value": 71988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678582206, "uuid": "82d97827-910d-4b0c-b954-70406e40c1fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582206, "uuid": "9bb11566-a363-4544-807c-633e519418ea", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec2ed36-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629038, "uuid": "4b6a020c-0063-4fe8-af46-645782be5670", "comment": "Malware payload (Mirai)", "value": "b6535cfd64833b0296a122c33cc95849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629038, "uuid": "56380421-1c91-4470-87bd-240b3e309eaf", "comment": "Malware payload (Mirai)", "value": "7e7e0454328cadded8363c3454568e41ab6740b817c7216583a18df68485c049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629038, "uuid": "19d3e8e4-31d3-45f5-88b6-0c0e10136bcc", "comment": "Malware payload (Mirai)", "value": "409f530acc87e4ab4ebee7be9ccf94e472547431", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629038, "uuid": "2b17f7bb-6efd-462c-895e-0456f0d9c52f", "comment": "Malware payload (Mirai)", "value": "31cc70715b6a20c7016ef45a0984410d612662af142c6f95bd4701377f6d97790a8285a721093accef4deea3541c829f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629038, "uuid": "599b1774-f421-476a-89f6-ae31aab1b02b", "value": "T1F303E18EDC905FD0CEBD6CBD838E0E76EC626041B01DA7082358B55294AAD53B6E44BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629038, "uuid": "2caa3ecc-686c-4f64-8244-7aae72c76860", "value": "768:YaRBc/7DClgXjejCbxiaJwtNy55zYlW/M/CVCfkeFai2HGzGEZsWMu:dyClgzeIxLA05lY2M/CVddGzGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629038, "uuid": "12c71082-fa61-45a2-aada-150e19a4cee3", "value": 38048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629038, "uuid": "690d6ea1-523d-4961-9d7f-7ee26f3d502b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629038, "uuid": "d9aa7f1d-012e-4791-ae9b-7e7359f7aa14", "value": "b6535cfd64833b0296a122c33cc95849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8406bd4-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678648810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648810, "uuid": "a0d0597a-baf2-498d-9f4e-7ae04a57fdb0", "comment": "Malware payload (RedLineStealer)", "value": "1f57d8ea925beb184c0bb0db235e8b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648810, "uuid": "8919bfed-b613-4e3a-aaf3-e9a539254949", "comment": "Malware payload (RedLineStealer)", "value": "7f2f841aecaccd32d49cce4b1ce1e62b9fe87458d67b644ff2b91f4aaa30a46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648810, "uuid": "dc3055f3-46d8-4e2d-9eb8-429a1340e6f0", "comment": "Malware payload (RedLineStealer)", "value": "f8ff3c64cdac1659d091d19059325fede0e9d628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648810, "uuid": "7e096b37-55a1-438b-b182-0852a82575b8", "comment": "Malware payload (RedLineStealer)", "value": "8ee7ade5e3b169b9c928a87df8092804726a5bcbc2314efbf0f07cda038052d8942a42f074511cf2ca40f0b51e5f33eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648810, "uuid": "f3cfd308-2136-41b8-9058-088b63619a86", "value": "T1F4A4F11277E06C61E977C7716F3FD2E87A1FF8229EA4676D32040A2B0B711D2E562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648810, "uuid": "1d3ab037-2df4-472b-a9a0-b62b7c63ec48", "value": "819f52a965a7f0cab7b5bf24d828c3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648810, "uuid": "c04b0402-ba80-4862-a6c8-699611045261", "value": "12288:SsNG3e1qJMls0/9F7wPChg56feRrMRg9sWY4:S9BJIs0lF7iR6WZMe9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648810, "uuid": "7a8d2fb1-5d57-409a-9725-1d925defabb7", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648810, "uuid": "e798cb5f-fdd8-4523-9b70-21db16a5e287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648810, "uuid": "c442fb66-d794-41e4-aa4d-fbb991d2c236", "value": "1f57d8ea925beb184c0bb0db235e8b47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91f1958-c09e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1678602399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602399, "uuid": "9148cc5c-ee48-41e2-b43d-47b2eb6bc26f", "comment": "Malware payload (Vidar)", "value": "91c5016ec4ce2ed71af17bd7dc205381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602399, "uuid": "31af9a22-df1b-46a7-b8c6-5b2d9331c514", "comment": "Malware payload (Vidar)", "value": "7f433bc61b1c10da40444002dd8521b7b2e8796d9d732180b76fec0973e273a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602399, "uuid": "7f36b1be-532d-4bd0-9453-2305fdaa46a8", "comment": "Malware payload (Vidar)", "value": "e65be1694b3076f1724616d0e5d23c8891a7e472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602399, "uuid": "a6cc6e0d-0193-4dc8-abd1-67f3738cd273", "comment": "Malware payload (Vidar)", "value": "6c2b66458560057c4c46060b10c5aba249128d5158c07ffcd8ba6d788ee8d676bea2c17b1abb269125f86943169dcd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602399, "uuid": "4141352f-8a2d-4610-af65-6b9c79fba8f2", "value": "T1250623B7A5658249C4D9C837C533BDE431F39F6B8E875C79628D3DC632218E9E202A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602399, "uuid": "2dffcb73-d17a-4c0d-8a89-a176630ab434", "value": "e3071a437e2c94918946a3d3059c5386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602399, "uuid": "66775f7b-9efc-400c-9492-31137fa81568", "value": "98304:1i5Xj7/qLrvPa4pAeH9MneRVcLXpUFqHCu/VQ:1i5T7SPPj/dMnEcLyqb/VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678602399, "uuid": "0842c094-55dc-4e2f-b009-9df07e6ff331", "value": 3718656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678602399, "uuid": "58f42daf-e4a6-480d-a4a1-ac2f0a11d666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602399, "uuid": "7cae4a73-2934-40cb-87be-92f8119315ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f6ca84-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588060, "uuid": "de0d594f-162a-43b0-825b-d4492c93e064", "comment": "Malware payload", "value": "a81f9bc9774ed6cf315574f707fb1340", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588060, "uuid": "53a1e75d-db05-4f93-8ffb-e59322f2a182", "comment": "Malware payload", "value": "7fea6e1fbc49a8938de8487023a39aba0c1df333653674ae3b337c8ae276c76d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588060, "uuid": "687b8a21-e016-424a-ab84-b926f2405419", "comment": "Malware payload", "value": "265c5b51a096fc3326e854b0b47feb6a0c5d7ecd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588060, "uuid": "8accf0bd-5667-4800-91d6-9c5c7a6e2e4c", "comment": "Malware payload", "value": "ec9e71cd1eee64f0a1403d7cb56d3692ae708aa83b46db8aa6052d807bb143646a689f5b5eef5d8170b2daba6196a59f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588060, "uuid": "1eae1038-786d-443c-b717-fcb31ccab959", "value": "T1B625F101BB61C872F80D77340663C3A14B28FD80DB954A577656F31E8EB02A19EF6BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588060, "uuid": "ecc097de-5381-4f4e-8b77-38e1200272d6", "value": "24576:ddIBcZnR8g2TrBeXZnZfEBDp48UbbFnzTDlk5MrfW:ddIBcZnGpTcH4Dq8UbbFzTGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588060, "uuid": "99703c53-7b31-4719-8572-6a9a17cf0d92", "value": 975660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588060, "uuid": "f75fb445-a2bd-4d40-9511-585007fbaa8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588060, "uuid": "7765e3dc-a5aa-484c-8a77-7814c510ee65", "value": "SecuriteInfo.com.Sig_RemoteAdmin_1.31383.31758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaf2fba-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642350, "uuid": "de8f722f-c723-496c-bf20-724dc396c99f", "comment": "Malware payload (SnakeKeylogger)", "value": "016a6f1404dbfe92912d7c8546c5fbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642350, "uuid": "e0439c16-cd38-42f4-80d0-dc7c96f4cc54", "comment": "Malware payload (SnakeKeylogger)", "value": "830f47013c72aa00109bdc7aa0a60e03fb70f7cbd3926e7f86edefccafcb3f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642350, "uuid": "95a19c8d-832c-45ad-b9d2-9055ad9caa43", "comment": "Malware payload (SnakeKeylogger)", "value": "962ecc73fd9e3d9c4ac23c2af3d39e424bcfe73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642350, "uuid": "665ecf07-e3ff-4230-9134-934330c3f1f9", "comment": "Malware payload (SnakeKeylogger)", "value": "2f6f196410b60522ebc56d6f0ed9de6774f4e2fe79ba491034c4bbabcc0e3f1bf0c24e0ad07954fca0afe932e2c29d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642350, "uuid": "f1789415-77f0-47a8-bf75-608a9c9b6dce", "value": "T185357C411351E5E8CB6EA2BFA052589412F82A3DB97CCE461885309B34EFBF05D8DED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642350, "uuid": "5f31d84b-049d-4b9a-be7e-cab102f13aa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642350, "uuid": "9cc04b6b-4120-43b4-bcc2-60022deffdf4", "value": "24576:OLKmIiMbHfNeMMj0QuS56TUv7wcwchhEUD5PAwJ:OumIPjfNeB6Ta7D/PEUDGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642350, "uuid": "b7371a03-1fc3-490c-ad62-f10e822da512", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642350, "uuid": "8cd5852c-4164-4243-8357-503c6a6493fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642350, "uuid": "38311465-8b2d-4472-9273-e62e47841316", "value": "PO 23579563.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4512f9f1-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678632645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632645, "uuid": "7566ab47-2ece-4168-96aa-e821c033ca69", "comment": "Malware payload (Amadey)", "value": "715d68b0cba34c8cbb8136950e81a9d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632645, "uuid": "a15c17db-ed80-4aa8-a4bb-73ce052165b4", "comment": "Malware payload (Amadey)", "value": "846c5a2c73ab7968cb77d1b5232fce09c5523024a84320817e416524d70c639e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632645, "uuid": "6cea37e4-ac30-4cae-8720-1696c0fafec5", "comment": "Malware payload (Amadey)", "value": "bd2824b6b58d27f2714d40be3f7eca9b014385c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632645, "uuid": "32496361-6c10-4a7e-b6af-5231026668ae", "comment": "Malware payload (Amadey)", "value": "9c0884d87d2de28daa8614ea59ee63f2e14c135765581f01f59e568302779f75c1d37af66c4390eb75f131cc45afac7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632645, "uuid": "6fc10b4a-3a4b-4ca4-b436-19f921b2ac11", "value": "T120F40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632645, "uuid": "4d60e0b6-c57a-4c6c-add9-fd42073e3ad4", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632645, "uuid": "b259c34c-98dc-4f82-8e18-2969c6015e25", "value": "12288:ctvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:ctFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632645, "uuid": "4234f3f9-0272-43f9-9363-1bd00ad9c029", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632645, "uuid": "befb6cf8-496d-42cb-adc7-0d7cf03bf8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632645, "uuid": "6cc891d3-252c-4092-948a-5e1aa99e5e30", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee5fd19-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Autorun)", "timestamp": 1678621334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621334, "uuid": "ed042891-33b3-4b4a-a108-eb91cec3ef80", "comment": "Malware payload (Autorun)", "value": "5ca6939891914d20798ac518d4c8b47b", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621334, "uuid": "178dfc1a-1e2e-4a61-ac65-d972997e1fc4", "comment": "Malware payload (Autorun)", "value": "84a53d7814d96cb2b1e403368bebaa080bed6dffbff280d0561b9c9a7a96258a", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621334, "uuid": "fb886a63-a94f-4fa4-a998-f5729f854231", "comment": "Malware payload (Autorun)", "value": "5f8151782ac9a1db67c5292669183930d8ff9aa2", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621334, "uuid": "e5e1c696-69bc-4403-b3ce-888a912342aa", "comment": "Malware payload (Autorun)", "value": "a77c1a7f36985ae723afcbc6ca580218bf57c08ae3aefebed2422865887b3d4aa2a3f3275cf0d1e23a3722ce7ef68a27", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621334, "uuid": "0ec3cee3-a1a6-4dec-b885-41b878188382", "value": "T147C55C64E610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621334, "uuid": "462d6da6-153d-4ffc-8073-40c319650b42", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621334, "uuid": "626a3303-1072-43c2-b42f-9dceb2efcd29", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MC4:eEtl9mRda12sX7hKB8NIyXbacAfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621334, "uuid": "e345a398-6d0e-4611-b09f-822023f9d82a", "value": 2554915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621334, "uuid": "dcf2211e-0d42-4189-9379-f849d9b64a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621334, "uuid": "bf988511-e53d-444f-94d7-2a3aa985edaf", "value": "2023-03-11_5ca6939891914d20798ac518d4c8b47b_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa341f1a-c128-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1678661725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661725, "uuid": "76485677-3d1f-4453-9d0e-3b746780225c", "comment": "Malware payload (AveMariaRAT)", "value": "3f1fac9d90df99cbec78080a7f68d984", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661725, "uuid": "41059a66-af8f-4157-8816-3acb1d6d38d5", "comment": "Malware payload (AveMariaRAT)", "value": "84b8fe9bed215e7b3503b1bdd5a73bd2d8aa226f39b5d24734b0b812e4895c1a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661725, "uuid": "782227d9-a29a-4b95-b244-2673c14ba5bf", "comment": "Malware payload (AveMariaRAT)", "value": "54e93aa75ecd2ca74a2325cf69fe98efe20ad7a3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661725, "uuid": "a7447dc9-3a94-4e96-b9ac-3936ecd0720f", "comment": "Malware payload (AveMariaRAT)", "value": "acde71cb32369ca45f1b1b30ff5acf43c895c28d20e85737788c06ade6fa54210e9772a4058125b919b96f6bb57dd002", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661725, "uuid": "f33dd031-0c6a-4350-a751-64fccabe0e17", "value": "T19215CF99F2314923EC9F85750927C1CF2D44FB8BB611E237533B7A82E65A1BF7948212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661725, "uuid": "4df22b3f-45e6-487a-81d9-6030344df441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661725, "uuid": "18b7cbe3-3bfe-4b33-90ee-3114c502ac9b", "value": "24576:UEP78/1ipu9qTzrzjFzeCWuGrOdMpIRgVg9DMm1P:sMI9qPrzj8CW6KpNu9DME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678661725, "uuid": "b76e726e-1f15-485f-8634-56c47edceba0", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678661725, "uuid": "eb745f87-4723-462a-ab03-d14152e40024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661725, "uuid": "ba57c98d-4ed6-4282-8c55-789055edfa74", "value": "3f1fac9d90df99cbec78080a7f68d984.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45308f3-c117-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678654387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654387, "uuid": "6181a78d-ccac-470b-8811-d947217a641f", "comment": "Malware payload (RedLineStealer)", "value": "8f4b1bb9f9665d0af2c15a49d3e4f150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654387, "uuid": "26d3c46f-eea3-452a-8041-eae3f4f0cdeb", "comment": "Malware payload (RedLineStealer)", "value": "85ea81d0b6a9fcb081afc1a658e4da0e5c7b6e52d0ee74d05b34b32ea860105d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654387, "uuid": "fd655681-4d8b-4c40-9691-84b0b7b7d2c6", "comment": "Malware payload (RedLineStealer)", "value": "deee853a17c19aace73983ad4f6a0235aff7a485", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678654387, "uuid": "7653607e-acbe-4c8e-9f28-8f00cc567c1a", "comment": "Malware payload (RedLineStealer)", "value": "c84c6029678faae3f39cbe351b5a30c3cc988a098f6d8365b6512daeba891512043663d4a85a592501266a9719daafcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654387, "uuid": "7a931884-6e99-487e-bedf-56b40c1274ac", "value": "T14735123351B03851F92B8E359A3F82E86B2FB9509E1697DF22143E1F15B01ED81E2B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654387, "uuid": "9fa5c863-e5a1-4f66-aecf-7c8277e3971e", "value": "f9d4073ad2ed2d29ea4ed70de1da0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654387, "uuid": "e1976846-2387-45e2-980c-b4cf10593057", "value": "24576:gbzo1ZOsP++qJMbldOPARzQuTVQjg2iXxUTjc0Q189V+g:gm/2+qodlPTogu069V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678654387, "uuid": "13c52240-95f1-4425-8a58-aa031e574480", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678654387, "uuid": "9c007a31-1515-4982-a00e-4d56dbce8559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678654387, "uuid": "b15d288a-6f7a-46da-98f7-65d1cc8e5909", "value": "8f4b1bb9f9665d0af2c15a49d3e4f150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc088297-c095-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1678598485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598485, "uuid": "abaaaed1-9473-4042-902b-6f23e267b940", "comment": "Malware payload (Phobos)", "value": "ce35af5edb5d81a7db601afa189e0e37", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598485, "uuid": "062aee17-37cd-4f91-bb85-7926bde59062", "comment": "Malware payload (Phobos)", "value": "8642770995c3663ff3b46a3f8c946d38d475c0a2373c281aca3fae221c430ed5", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598485, "uuid": "f6c14d56-3a16-4e92-a820-10ca783a9851", "comment": "Malware payload (Phobos)", "value": "d383e987ffdb83892a66ca94c0bbb851ee1260bc", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598485, "uuid": "f0666dc4-be5e-4a55-805f-187298b57429", "comment": "Malware payload (Phobos)", "value": "ce630f41832265f7f22d230c70cba7b327900f501c4296fa8810fac596eee8bac8f10b3b4b1c42bcb23a79f3f78ba39f", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598485, "uuid": "0149c8ef-ca15-4731-9bd1-28c650e19b19", "value": "T1C143BF06705980B2CE714670293B6F0F9FBB910540A488978F795D963FE6136E73B3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598485, "uuid": "52aae235-a8ce-447d-a3b6-29af13ebe5ed", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598485, "uuid": "09f81eba-747a-407b-89d4-097595d9fe4e", "value": "1536:6NeRBl5PT/rx1mzwRMSTdLpJYFW7KAtGVpJVFH:6QRrmzwR5JyW2A8fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678598485, "uuid": "4a481a74-1ed8-4dee-bd9d-d13b65bcf0d0", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678598485, "uuid": "0dac0cd1-184d-470f-a0f1-8d10222fe46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598485, "uuid": "fbb2d87b-495d-4d6c-aea8-dd1383c727ff", "value": "FastOP.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e175e1-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678647996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647996, "uuid": "a543dd88-0d25-453d-89cb-939ddd709153", "comment": "Malware payload (LaplasClipper)", "value": "8a3f2df15406aea58260c7655d8ef4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647996, "uuid": "ad485990-4f0c-4eb5-b029-6e90abec2df7", "comment": "Malware payload (LaplasClipper)", "value": "893aead9cf7850b50e03a131a31b0258328cbebf854f81c5fd79725ae63ac523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647996, "uuid": "fce23a9b-a77b-43ad-8060-9963ee42d4ae", "comment": "Malware payload (LaplasClipper)", "value": "df62c2729de07b897b522318c4b7685a63fc3725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647996, "uuid": "5617f912-8cfc-47fa-a255-3154eb549ef5", "comment": "Malware payload (LaplasClipper)", "value": "d2475046da7f1cd213f25ac99080e31444b6d6bebd104b3a09c2c04e643400c27b792342eec0304526467e83e615ca1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647996, "uuid": "c514ccb7-f754-4220-8a6a-a5c24a85fc42", "value": "T12044BF1273F17861E6A3CB31AF3FD2F82A2EB5614E68A75E23049B2F0A711D1D562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647996, "uuid": "71f6b659-0915-4601-9baa-fda8aa6e7206", "value": "3d4c16eb468ed7fad4115f689c8d6af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647996, "uuid": "9d1044c6-0128-4b0f-a6ee-a577799dc244", "value": "3072:P9jDqgNy17T9ax9IevULQQJgVeAUf9qtNKLxtqRH5Ei62W2uCM49H/YIdgX65+p1:VqCy17UIeMLQH4ngtNKSo12tMNIdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647996, "uuid": "5c48bc0b-0714-44c0-a298-3aac7962d580", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647996, "uuid": "f1b76132-45dc-42b7-8c00-7c48a7d30a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647996, "uuid": "eeec078b-c27e-4ba1-b723-1a22d30dcd6d", "value": "8a3f2df15406aea58260c7655d8ef4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2f1973-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629065, "uuid": "99760f81-5891-4af6-9826-577de85bf8db", "comment": "Malware payload (Mirai)", "value": "12af1ce9acb42be15429bdcf46b7d7f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629065, "uuid": "27850092-dc67-4099-8430-0b0427764815", "comment": "Malware payload (Mirai)", "value": "897bd1facb0afd02332d194ae8ff99c719ccf05d99c7f98932aef4a443c61cae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629065, "uuid": "8993f1c2-dc59-47a0-b0c1-3d1d33b2027d", "comment": "Malware payload (Mirai)", "value": "a8b58967e023de7d3767c35c954f8f0ff4416c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629065, "uuid": "0ae84e32-7e5c-40a0-a581-e9f62438c1e8", "comment": "Malware payload (Mirai)", "value": "e88513466f84fc576c2da0306b2c92232f2b1fde6c3c82fea1f21d85630d2994a8c26176603571e7e3860d705485ce90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629065, "uuid": "91fd0189-1382-4d64-b289-7b94ba04ae57", "value": "T192E2F118E0004ED7DE777A736569459283D44DBF7AF8EBA8C30C7AC08A1C4531E95CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629065, "uuid": "8ada8165-c830-4b56-857a-40ff6552ee00", "value": "768:RcHDjNZV7kmL2v3g1P8G19qj/tImTjS4nrMUwrtjQpQzAbKUa4uVcqgw0RKWXW:CHDjVN6P0PzqLtNjdnIbkQzAbFa4u+qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629065, "uuid": "75f5b7a9-1c1c-4233-ae7a-40855bb977c2", "value": 33684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629065, "uuid": "788de964-acaf-4da8-b177-0d72a95e0670", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629065, "uuid": "2e779544-6d21-469f-af2a-c3800465b889", "value": "12af1ce9acb42be15429bdcf46b7d7f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc1f8ab-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Autorun)", "timestamp": 1678621335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621335, "uuid": "c4b322f8-be1b-4c4c-a975-89de674ef2b2", "comment": "Malware payload (Autorun)", "value": "8abbf4b5f7611939bd4a68d7a12ddc86", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621335, "uuid": "1c8d9446-ee32-471e-ad00-2c09d2cd01a8", "comment": "Malware payload (Autorun)", "value": "89c2aa52d9ff04c942b3fa2eec399fde7b1f9372408f9a3e04a133c3f30dbe0c", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621335, "uuid": "4acc9e0a-a7fd-4dab-9964-faaac6f533c1", "comment": "Malware payload (Autorun)", "value": "83738186e3361d90109076b4328e623d5dd596a8", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621335, "uuid": "ac59a0f0-3f17-45af-8fad-83adb6606bbc", "comment": "Malware payload (Autorun)", "value": "fcd42980c821c7cfba092da97a5e31acd13716d1f7f69811c80b1c33f917d4211006fefe64279910c9888daaa2bfa4d6", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621335, "uuid": "0cf8c80e-811e-4c4f-bf4b-15b959be91cf", "value": "T14AD57D64E650D87AF3D6E978540E7F290CE57D210BC22D4EA48DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621335, "uuid": "c6087cd6-5368-4e93-9697-777297bb0fc6", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621335, "uuid": "13617f8d-2727-4a09-8b28-d3a1793ab2b7", "value": "24576:eEtl9mRda12sX7hKB8NIyXbacAf7QSPLCFCBL5GJ2:9Es1RMB8NIMIz/LJL5W2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621335, "uuid": "71662e75-0329-4648-b2c4-af22f783eacb", "value": 2790785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621335, "uuid": "58f32e9c-65e1-4289-ab73-ede95d879832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621335, "uuid": "3e318a88-e65e-4fa4-be16-304341604510", "value": "2023-03-11_8abbf4b5f7611939bd4a68d7a12ddc86_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eea377e-c112-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1678652123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652123, "uuid": "2d15997e-2639-4e2a-9208-9878a5e0be56", "comment": "Malware payload (Pony)", "value": "3919da5162a89a79bee46dc901fcf2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652123, "uuid": "ef6c596d-6514-40c0-838d-0db1e87d12d6", "comment": "Malware payload (Pony)", "value": "8ae03b110ace89c3237aae4dc7028b594fe0f2fb4d9464c992829f6cfadb6b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652123, "uuid": "b15bed1d-49c8-46a6-a72b-e3145d43a73e", "comment": "Malware payload (Pony)", "value": "87da3002a3b1b0463676402818804a732397d084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678652123, "uuid": "fc7cf1e6-af61-43c6-a95e-9aeb7220907f", "comment": "Malware payload (Pony)", "value": "c999b9a1fa9db8201e459676ee6551ab1024b435bfdca9d161117732652dd065ef45be13cdbec4259480e7aefc3b916a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652123, "uuid": "f2591ba3-c21b-4c65-90d2-3d5305d0b305", "value": "T155E48D22B2A04437D2A72B789C5F93649B35BE302F2995466FEC2C085FF93513A39197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652123, "uuid": "2445bb4b-67fc-42bb-b713-18008a35a96e", "value": "5a0b8def8005b086f77ca60dc9037333", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652123, "uuid": "3237f343-8896-4a50-979e-db45392d3f94", "value": "12288:T2/AVuOj6WH9/WhXXFBYG2zjyT9ZDmLkDJ/z6hedNF/3qSZk:TMfOjLWhnFKGKjOF4O68HVqSZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678652123, "uuid": "b3b022a0-d8f0-4a47-b4a7-dc64653448ae", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678652123, "uuid": "ec64320e-24e1-4a18-b063-eea53c1b9f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678652123, "uuid": "d4432b0a-038f-4859-81ab-f3fc4e1b5eb7", "value": "8AE03B110ACE89C3237AAE4DC7028B594FE0F2FB4D946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd797d63-c10f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1678650993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650993, "uuid": "af57aef9-4ac2-42a0-bd92-7f3a5840221d", "comment": "Malware payload (Phorpiex)", "value": "22f2666659ba947c9974fb70ffba0efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650993, "uuid": "2623b233-196e-4988-8a46-a8cdd9c49ab5", "comment": "Malware payload (Phorpiex)", "value": "90e109884750afed408867ab5d697d56b53620027d91a466a338a90f53ebbe02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650993, "uuid": "f336eb41-8b47-46f8-82fe-24b21c69df2b", "comment": "Malware payload (Phorpiex)", "value": "1a8ce0516638a9b64129f5de3a5169aea958495d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650993, "uuid": "e26a6b4b-330f-43f4-8d40-10b13caf8672", "comment": "Malware payload (Phorpiex)", "value": "d0479968e973eb9ddb521b91920650d9262d4596740cd7812232ff6a08a166511a93f8fa55483b476152abb334589eb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650993, "uuid": "61699743-4146-4d50-a22a-1ebd9849c6c7", "value": "T1DA72F6039565939BE672247467732E25B038BD35532E9DDFBB8009782264EE0FB33396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650993, "uuid": "b3c37492-af3e-47eb-8b59-5a9b0b01c7c0", "value": "e4c87b7c96eb71ee3a5e91bc3f06c1e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650993, "uuid": "0dbaad1b-267c-44fd-ab4d-a53828b125de", "value": "192:QEwSSz9XfaKuwfJfShwzGL3xF6BeT/tX1Y+8J4pfVBcF7Y2+SP1oynrSIHPn:QZpiPhYGL3eAtlYxJ4JVB0061VS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678650993, "uuid": "b6f66014-66a4-4124-a6ae-6655a4973723", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678650993, "uuid": "6bc18679-cb88-4a67-a081-03ec28a095cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650993, "uuid": "b5ae3843-271f-4d60-b5cb-0e73c3830f72", "value": "22f2666659ba947c9974fb70ffba0efa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91232fa-c11e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678657294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657294, "uuid": "70ecd837-5f2f-4b59-a0a6-cae9b7377f15", "comment": "Malware payload", "value": "906c8babacef46e908062dcfea2bd2a5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657294, "uuid": "f033e365-3bdd-4add-bc50-c8d84f3c0b88", "comment": "Malware payload", "value": "912e6b552e12482c8140f972d9e39d8d98b21a6cc15994fa781ce53e3ec0dad3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657294, "uuid": "c19053f7-b789-4adb-8140-08f4a6b2b368", "comment": "Malware payload", "value": "55df75dddcc3724b9ad0b55989470f72a390fc68", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657294, "uuid": "aa317a73-71be-437e-b3b0-12c251f070f5", "comment": "Malware payload", "value": "26ad2f265437fac185f6c311d979dd343322cc4902b641bbcdb0a4cbdf6b684c2bc77560b3346a1d36e784e40fbe2b2c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-123", "colour": "#2ACF29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657294, "uuid": "3f795fcf-4926-4fa1-9bb7-d4b42c738ccb", "value": "T1C1F322476FA9D0ACD4A8D9A6CE73C48A1F00BD3945819CCC672C790AD03D06E5F9A36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657294, "uuid": "e742f37b-0ad6-4745-a276-5b6709359c28", "value": "3072:ypLcjXUzG7kHnFwHAX2Cwo5IOHN7TwBpXs0zUtJ:MLK+OkHn+HE95IyE7zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678657294, "uuid": "75912ab6-93e6-4cd6-9817-113faa663522", "value": 162473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678657294, "uuid": "b846b84b-0b56-4a6b-86c1-953a7631b5a9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657294, "uuid": "b13c1eb3-7b40-4e97-bf1b-c79b8b84a596", "value": "1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e14fcbf-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678648928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648928, "uuid": "86ff32c8-141a-4711-9daa-c3cd7b19e08c", "comment": "Malware payload (Smoke Loader)", "value": "3c4b8308858688e08b88c675c5643bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648928, "uuid": "1c998e45-8d5b-4779-8695-1efa84c7b561", "comment": "Malware payload (Smoke Loader)", "value": "9248f3e9c4a8713ebdd58566b0f537b25f6b37dc19cdbe35ec9c3185887791a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648928, "uuid": "a4d9c47f-1475-4d14-8f59-608b68f9cb01", "comment": "Malware payload (Smoke Loader)", "value": "cdd0011b7dc41b9fc809bb436126b87b34efc102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648928, "uuid": "068bc77a-730d-4343-ac3a-71ebb501f366", "comment": "Malware payload (Smoke Loader)", "value": "308cfc390c540e1f44fa6d37d30aa48210e32621d6f1fa6ce0cb3ee853cbfbbdb7f58f642cf586a1bc0c7a65c9f6feea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648928, "uuid": "e30e7a0c-6766-41ec-a952-512ee33c6453", "value": "T173149F1297E1E825E663DA71AF39C2E4372FB4E18E69775F22049A3F0CB11E1C563352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648928, "uuid": "817b03d9-52b8-4855-b23b-efa67b79704e", "value": "dde0a94910719185220da717fd3e8c43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648928, "uuid": "c2e7e0f6-b2eb-4160-a114-678bd5dca67a", "value": "3072:GHxFmZkcuN+mneei8WkRozvL6LgD8BmcglCg1y2m:UFAkcf7eSuLgQIzCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648928, "uuid": "20de2cc9-2b74-42ba-b0c4-c3304b1e14af", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648928, "uuid": "f47d7d9d-6a2e-4789-a2fb-46fa2834e6dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648928, "uuid": "688d0e58-e8b1-4617-aeb7-7305bf138e0a", "value": "3c4b8308858688e08b88c675c5643bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15152267-c125-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678660053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660053, "uuid": "7e3e66e2-259e-4431-9888-86e1d1648726", "comment": "Malware payload (Mirai)", "value": "33936f8fb177858449ea8e462fc8f16f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660053, "uuid": "38408cd3-417c-4689-982d-dcb641b15ec5", "comment": "Malware payload (Mirai)", "value": "927146a19ea6090d5927ec710dc3336a16da5118887243654eb879a159bcda55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660053, "uuid": "53935ec4-ee85-4179-9149-2cbf5b0be38f", "comment": "Malware payload (Mirai)", "value": "b6d42419d927b5c258eba58184c3a1e341e83d73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660053, "uuid": "4f3baee7-97c0-4d51-b8b5-5ea86038030d", "comment": "Malware payload (Mirai)", "value": "75a2611d38bc795644949088d2f746dd171cb064bbddf79191420c722915e43a260f7537e3c50d6ec412f5e7551958b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660053, "uuid": "650cab72-44bd-4205-929b-76460034cd35", "value": "T10A33F1B5F27638E0C6A01C3FEE9D80CA1E2F0F75E419B47562696EBC279285297750C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660053, "uuid": "14ee3180-f6fd-473b-b517-0a102bae9b38", "value": "1536:cWa8ZqK2kfJInCFjG16QeHgXJLYwKeokllDis:cWHqK2kfvjG16vYLj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678660053, "uuid": "f9908109-d66c-40c3-ac58-2d5113732a5d", "value": 51976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678660053, "uuid": "7cd4914e-0cea-48bc-9687-c2522601d007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660053, "uuid": "c5671a43-93ae-4e9b-a59a-2cf91886b8f4", "value": "33936f8fb177858449ea8e462fc8f16f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed389024-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642806, "uuid": "fc086f9d-fc46-4bd8-84ab-d290852d5ace", "comment": "Malware payload (Mirai)", "value": "820e01a046a0398f3f65650d97354dfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642806, "uuid": "7ab0846e-433e-451c-a35d-bd7c00884cdd", "comment": "Malware payload (Mirai)", "value": "92b81b2f9ad09f81e063c84ddd3b974f8b49ff25cae7de075cfdd4af019704de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642806, "uuid": "90566b38-4516-4ca1-b9a3-49add3f825d5", "comment": "Malware payload (Mirai)", "value": "a350eca3df66faa249686ed81b327440ef4263db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642806, "uuid": "829420b8-78cd-4b19-a60b-4cc2f782efbd", "comment": "Malware payload (Mirai)", "value": "578b6ef1e6ff4f3b960b87088983608c65ff6784fa5101e00bb88177e714ce2f6a596c6986c1bb1bbe173287b752c0d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642806, "uuid": "b35d09db-d089-4927-8e55-822198d3e143", "value": "T18923F1483872C295DC93F5B767BCE99933586D75713EDA263D683E8E3E1B0638530061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642806, "uuid": "e8a9a2f3-4c3c-4280-b1d8-e4787c860d78", "value": "768:ct3mvvW7ND5mCCQ+zQap+v6JtQZIxxTXGKN5LRBgBZ6QUUq04KJ:ct2mjmCCQ+zjp+wt/HjG018Z6Q9ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642806, "uuid": "4a6fc05b-8a8f-4f0d-87d0-c0d01937eb66", "value": 45948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642806, "uuid": "4bf62d1f-896d-4d82-afc4-08bc0e60c1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642806, "uuid": "b072f6d0-118b-408e-9e25-50b8adf7b0fb", "value": "820e01a046a0398f3f65650d97354dfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5061095-c0a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678606258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606258, "uuid": "1640b338-1f01-4278-b9dd-6050d0e77535", "comment": "Malware payload (Smoke Loader)", "value": "8a502994ac4ec347b7cf8e31bab314dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606258, "uuid": "919421b8-0454-41f0-a174-1b846e0405d9", "comment": "Malware payload (Smoke Loader)", "value": "94e6d80eeb6dd8fbdbc3328102c6a4a979026cede236e48ac734a2c824286e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606258, "uuid": "544c06d9-ce8f-42f1-ad5d-a0590bc4044f", "comment": "Malware payload (Smoke Loader)", "value": "65bb95c877572ff7f8e32b4860f44c34e85c0e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678606258, "uuid": "62838aec-d9f3-4fd3-953c-4a48fdd161e5", "comment": "Malware payload (Smoke Loader)", "value": "5cc937b6c8eb1af917cec3011053d0945c8f336557d1a6a1ef86bd1f2aa07d3262c6a82b15cf20ec8e0ea01c067822d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606258, "uuid": "ef39732e-9952-4bda-8d36-7a88adae9521", "value": "T14F149E1273E16C21F6BBC6315F3FC2E43A2FB4614E69676E23045A2B0AB11E1E563716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606258, "uuid": "c80adda0-bcb6-4267-82b9-f008ac5651f8", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606258, "uuid": "652e5cf6-01b5-492a-bfc0-d78265aa779d", "value": "3072:2UHGqpPwJ8kBqqsNzlrMkJ+sN0x4onVE6g6nHNmiesNb/g0BlzUdX6R2+T+YI:HmqlwJ8XPzQs6xQ6gWtc8b/gcedC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678606258, "uuid": "d9ed83e0-7323-40c5-a764-b7703835cb19", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678606258, "uuid": "94b8806e-8582-4497-b6c1-f35ce8c6c093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678606258, "uuid": "3de99230-c439-4581-994e-ce2a650713ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dd49f4-c0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678638440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638440, "uuid": "c7e49525-b2e7-4834-9f7d-dd0be2b85cb9", "comment": "Malware payload (Mirai)", "value": "e8171e28f2cc0ddf1d5ee69847bfbb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638440, "uuid": "8e5bd98b-b291-459c-a462-0e43abbf35a9", "comment": "Malware payload (Mirai)", "value": "95640e9d2acd0fcea68a492e77b440f132f5223f95bb181cf23f461e8b834c74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638440, "uuid": "38b3d103-20ba-4a5d-9ac6-d22a56946980", "comment": "Malware payload (Mirai)", "value": "2d173a79d22df122f40caba8dccf11528284b334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638440, "uuid": "a302434b-589f-4eac-b161-2b0a00c0eb02", "comment": "Malware payload (Mirai)", "value": "009192288dcb029b9ea6c3460cec92f6e8a37d7f88a5b22e07b09ef590f628fd8ef222cd4ebabee5c32da4081f96ac07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638440, "uuid": "8e6af423-abdf-47b2-a6ad-350f801358d2", "value": "T18603F17D66080CDBCB09E438D70517415F994FB2F1498E4F68A2EEE3A940DAA34DF8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638440, "uuid": "3b928fcd-05bb-4dec-b619-1be69e396a52", "value": "768:pLFiOZ+phMrso3VabT/pU7CqOHHtwpQ//+/gnH9tNs/HfRJgGlzDpbuR1Ji:phi5YsoUT/OGqOHNlPH3NOH7VJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678638440, "uuid": "855eb491-f4e6-4a3d-a562-8fc2d23413d3", "value": 40216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678638440, "uuid": "48c0a556-0adf-4607-a666-daea3557bb05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638440, "uuid": "ccb74aa9-d975-4384-bd5c-1e4ef661c96c", "value": "SecuriteInfo.com.Linux.Siggen.9999.9869.17189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4149be88-c071-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678582817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582817, "uuid": "de6cc8d1-7ae8-4858-9260-95858963c2ec", "comment": "Malware payload (DCRat)", "value": "c81c568e4fe159223cb43c33e0d8318a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582817, "uuid": "8e43d19b-d060-4bb4-9787-dce61fb0bab2", "comment": "Malware payload (DCRat)", "value": "9891fbbd4317025fcba26070a676878892a2943ee23cfff28efe66a51fa7d510", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582817, "uuid": "5ea0af47-b6cf-4c43-94e7-dfa216b279e8", "comment": "Malware payload (DCRat)", "value": "7445b2813ed3a4d918c2c45681da827acc447492", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582817, "uuid": "5af2304d-2ecb-4c65-a348-5df058d855d4", "comment": "Malware payload (DCRat)", "value": "8126f41784c562f26ea8d3a10b28a8c2b1438859fd3ed5a8554025012432bd5e6efa8ffc0bf4249626fffdabd0373ab1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582817, "uuid": "e323e0be-2f62-4d60-b1a1-9fddd445f18b", "value": "T14F354A017E45CA51F0191633C2FF894847B4A8602AA6E72B7FB93B7D59123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582817, "uuid": "b0503d1b-a744-42d2-a705-90d74be88955", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582817, "uuid": "754b68e5-6000-46f7-8ff5-3d42ceea1791", "value": "12288:pRZ+IoG/n9IQxW3OBsemwSbSZ2kBYlZ0ZiFKyIsX7SOBaku3/l7Hi51o+9o5QF:h2G/nvxW3Wnk/r0ZiFK+7S5W5++9WQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678582817, "uuid": "e8ee5cac-85c6-4774-bc3c-1b10e1b09c99", "value": 1127627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678582817, "uuid": "69e0ce01-d6a2-4bae-ab3a-73e25cc196f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582817, "uuid": "f6c5d54c-9c3c-41f1-934f-1bdf9446a503", "value": "C81C568E4FE159223CB43C33E0D8318A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163ef8fa-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678647170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647170, "uuid": "c779b238-b826-4f6c-93c9-c52623dd0c9c", "comment": "Malware payload (RedLineStealer)", "value": "cdb91d68891826775281fc396a3e86e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647170, "uuid": "8501188e-6487-42ee-ba3c-bf8a8bb49c08", "comment": "Malware payload (RedLineStealer)", "value": "99e9b7b6e9a87362faf21f9b50a34ea195c7c00961d9f12984c9822062f3df65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647170, "uuid": "96a41d78-a0fb-41f9-b2bb-c7da639f908d", "comment": "Malware payload (RedLineStealer)", "value": "039f5641e517aacda00cf463583e4baae47ff809", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647170, "uuid": "152d8764-dd17-4f7b-afd1-8225558ca082", "comment": "Malware payload (RedLineStealer)", "value": "61db101da38ce69246f2600b619314682f704376fba9d912defe9398a5422a89749a2ff5d5077b52cdea193a5fba77ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647170, "uuid": "dff26f2c-3676-4bd1-a211-182f6bf1fa9e", "value": "T17464D11292E1E821EE63D671AE3EC2E47F2FF8A15D69775B13049A3F4DB01D1D922312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647170, "uuid": "bfd81259-e6cc-4aa8-abfd-b5d93d6a6823", "value": "858e6430e3652e12355faa06f640c4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647170, "uuid": "a5427152-dcec-40f7-b4c4-2d1b722986e8", "value": "6144:Z2FeXtsgbTtG2513jqf1VrMQoNeOkR3YsSwRspztV:ZQotsgbBfj0jceOkR3xRsfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647170, "uuid": "ccb13e68-669d-44ca-b228-09a3d5e02f33", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647170, "uuid": "beae1865-7736-45fa-87b4-d9a0a0f4c4c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647170, "uuid": "6b44a6bb-f70d-4872-82b5-ed8a0ebd3e8b", "value": "cdb91d68891826775281fc396a3e86e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715870bb-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642598, "uuid": "1e4a9b71-a1be-4970-a135-c5407afb7258", "comment": "Malware payload (SnakeKeylogger)", "value": "ac13c75de25a6aa303bc900cceee69d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642598, "uuid": "448c06b3-e24e-4cd6-8ff6-257446b43cae", "comment": "Malware payload (SnakeKeylogger)", "value": "99f1d0fa298d82818a7b27c95107659cff6af87ec374545cbea203e8129b9c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642598, "uuid": "b30d9446-e578-47d7-bb98-71e7ba7f8b4c", "comment": "Malware payload (SnakeKeylogger)", "value": "362a6e7c3a397dfeae5ed14002b6cd7de7b71ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642598, "uuid": "16ec075e-ec6f-445b-b1bf-97a4068da7b9", "comment": "Malware payload (SnakeKeylogger)", "value": "99cc6790cc793ec918e6b4a5611e5fd9773d2864ffe5456264783e26976862bf8e5d0a5c0f7bcb7a5b5c27c5369e8934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642598, "uuid": "ba525fd5-eb7d-4bbb-afbd-c750de57461c", "value": "T113356D91B494889FE9678AB26D27643831A26D5C616CDCCC1599F79B36F3303209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642598, "uuid": "cc2b8887-491a-4145-a76f-08520507b6fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642598, "uuid": "68a847a9-13e0-4169-8e30-991f432421f6", "value": "24576:tuOZ6wGkB+e9uf8BRmnud71HXo+Sl7fzM9XMn8vO:rAnuJ1H4+SFo9XS8vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642598, "uuid": "c7fa40be-4e9d-4ed0-a50f-58660141544c", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642598, "uuid": "497c3756-8746-4d77-b758-f0b3c3011870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642598, "uuid": "4356e807-b1c8-407f-8f59-db35e61d5504", "value": "ac13c75de25a6aa303bc900cceee69d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf5504b-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678648924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648924, "uuid": "8caecace-03aa-48ad-9b46-080f44148f4f", "comment": "Malware payload (Rhadamanthys)", "value": "e5cf0898fe928a715845d67e214decbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648924, "uuid": "e912d830-a3ef-4713-a1c4-cfd67673a28e", "comment": "Malware payload (Rhadamanthys)", "value": "9ac6dffa29248e05119bbd11cac51f2fe1c2fe91320fe1bbe814c2a0f70fac00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648924, "uuid": "d7eb23d9-99ff-4483-947f-3807e784593a", "comment": "Malware payload (Rhadamanthys)", "value": "c724ad9868bb06d5c4ac6d74ade988aaf3820cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648924, "uuid": "ed68410b-a350-449c-aee0-70c12d791708", "comment": "Malware payload (Rhadamanthys)", "value": "6c197b24906ab0f47a0e2eee1e9530758bafa261000e6482cdebe470f524fa2967091ae52aaa55f62eb6a6eea05b90c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648924, "uuid": "ca9ebb02-a399-49d6-9657-6f51c43acab0", "value": "T1B744C01393E1F825F723DA71BE2AC1F87B2EB8B14D69775A22045A3F08B11D1D963352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648924, "uuid": "09cdc14f-112a-4bea-a197-1917549885ea", "value": "dde0a94910719185220da717fd3e8c43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648924, "uuid": "d8d3e23d-7fda-4c43-a9fc-31e080d566fe", "value": "3072:7C9F4fe7YNR5M0q+3xqiX5Yak6FoPkemwArDj2QR7CfBD5lUaOgfg1VmcglBGzQq:0Fse785MpUc+DZFX7wAJ4BDfUfEzczh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648924, "uuid": "c8be5412-3475-4bf8-9df3-39dc3cf675b4", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648924, "uuid": "75d10943-d017-41c2-b752-c2ee94fa0176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648924, "uuid": "fe23369e-428c-4ae6-8dfc-2f9a14b9a250", "value": "e5cf0898fe928a715845d67e214decbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efaf1348-c0ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678608021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608021, "uuid": "d5f1786d-1e71-480b-8c03-d3cb9cf323a1", "comment": "Malware payload (Rhadamanthys)", "value": "f85caa687d63f3da9b6743fdb22b2504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608021, "uuid": "b8c67149-9c21-4d99-8ae9-deab47d5a677", "comment": "Malware payload (Rhadamanthys)", "value": "9c1aee3d73db1da0f2276adf063bcaab3f013fec2ee2364a5853ccc216a280ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608021, "uuid": "f9e33230-79dc-4f3f-82a4-9f9f87337819", "comment": "Malware payload (Rhadamanthys)", "value": "f295c515ed261e3c170ba8294387e51df57b71e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608021, "uuid": "b1f4ca38-41b4-44a6-be57-e45dcf645df5", "comment": "Malware payload (Rhadamanthys)", "value": "4afeebeb8444032f30549ca6e7473fed14db6a2ecca52a9b60c2a90f37851169e7f709ff2fd7dac68ba0b4875afe4a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608021, "uuid": "f84aebdb-b0fe-4f80-897a-2b4c02b3e7eb", "value": "T17C149E1273E0AC21E573C7719F3FE2E43A2FB9614EA9676E22045B1F0AB11E1E572711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608021, "uuid": "94982955-bcbd-43df-98ee-8798c8a584c2", "value": "498ce63ad5da17e4362994ba9a6fc26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608021, "uuid": "874a1a14-4991-4cd8-b162-b6ef8d0868be", "value": "3072:OR/R4q4hvx+4yQzmfR0lUveej05LiU4AtnO5cQ9zb0fQJgEkox6kX6u+TJ:OgqKvx+/D66vebLiLAtno9/0YWFdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678608021, "uuid": "06cd1b92-51d6-4647-a196-dd1f018983ee", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678608021, "uuid": "79a4402e-ac1b-4d2e-a6e9-1c8facf51029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608021, "uuid": "b134902f-6abf-478c-ab44-dfe067477696", "value": "f85caa687d63f3da9b6743fdb22b2504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e4ec4b-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1678642149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642149, "uuid": "9b62b6bd-a2fa-4ba7-81db-7a95f2eed6c4", "comment": "Malware payload (ModiLoader)", "value": "8da3b607defa90b5500db1ee274f68c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642149, "uuid": "fbb736ee-f755-4416-9c6e-199a84090e99", "comment": "Malware payload (ModiLoader)", "value": "9f8afb109c9b23b3b9645ecf1d44dd25d866472242239c766cac33a31d66a98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642149, "uuid": "7cbda388-ed3c-4ff1-b12d-29a05a9a4ebe", "comment": "Malware payload (ModiLoader)", "value": "cf853ceb8feffb9d3a2ce76cfc9b9e324c7fc9ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642149, "uuid": "dfe545d5-9659-4493-8dbc-ec210c0c00b1", "comment": "Malware payload (ModiLoader)", "value": "ba887373de164185c2116c96366f2550751cd66a96cb9e0cfeb1117acc11ddfc1fbf9dfa44c05123649db43a8b47d373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642149, "uuid": "11878deb-12a2-4d00-9465-8f62dc7c0f5a", "value": "T160158D13F2A1C437E1362AB4CC5746E89819BD102E24BCB67BF53F8C6F7A14275391A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642149, "uuid": "17284646-d37b-4e83-beda-f0ef7463eac1", "value": "fd2cb5163b134ee99b6a51556e83c8b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642149, "uuid": "948f9bf5-43e1-4de8-b4a1-51813fd3f485", "value": "24576:5U5BEEVl6gwiCYi6Wq+VHcvf9eGqRSZqPLX3UHA2I:5U5G6lNxk0ZqPLX3UHA2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642149, "uuid": "486a2370-86e4-48a3-96d0-d86174eae8dc", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642149, "uuid": "960568b5-84da-4181-a36a-af9ffc6f1009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642149, "uuid": "8c8ca991-c4b3-429b-ab64-75375229c4e5", "value": "8da3b607defa90b5500db1ee274f68c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83419e3-c0f2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678638449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638449, "uuid": "a888231e-6d21-4cc6-af8f-376f7a2fec4d", "comment": "Malware payload", "value": "c16d4c8a2ed51c21d174a17b3ed60d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638449, "uuid": "6c6a6b5d-3e97-4afb-a28d-5ed4a03e6ff9", "comment": "Malware payload", "value": "a0d4b49617ee9205cac16ab6a841fc9fb4c243f631d247b0cd24042bd7f2a7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638449, "uuid": "68755066-ea12-4cf9-b5f4-f328938b7d2a", "comment": "Malware payload", "value": "6d714bc46ba3ca131bfc3376b2e257953e9a35c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678638449, "uuid": "4222f7b7-84cf-4682-8e90-dc41e272618d", "comment": "Malware payload", "value": "352a7ae2978f58652414666d9c42e1d0b476b75b5585d91dd93a8975713a9bc9a9ecea0dde21ba88c8e700b2f98bd5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638449, "uuid": "f6080480-9ff5-415e-89d2-e69ae3fafa80", "value": "T1B5F533D12E1213B1F86042B56557C8AFE629071B9FE49F8C9B6D0F272B0B531EA37C91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638449, "uuid": "59729c41-c6ea-486f-99b9-b3f357e94793", "value": "c8bae08c035a9c3e7f06d8ee51ab3fab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638449, "uuid": "d85b799e-fb60-49b5-8d2d-e2b88a544472", "value": "49152:VA+RwWZv25nh0lkObTO9jDK5t0Qr0DDTNaazu0UQSyxTR4HYfAm2uBJS695:Vw0vyuTHN2VZZbSyx94HMv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678638449, "uuid": "3b389551-8610-4b69-bbf6-5cc585999b78", "value": 3524096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678638449, "uuid": "62085f5e-fcfa-47d7-bcc3-f88b8571897d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678638449, "uuid": "e3be0d8e-a5bc-4ffc-9dd1-4b8b3c2ae712", "value": "SecuriteInfo.com.Variant.Razy.668800.6595.14210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047e8a0b-c0dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629101, "uuid": "a33bd6cd-bdbf-4bda-a844-1836e06e0855", "comment": "Malware payload (Mirai)", "value": "d579b5ce2b036519293fe2beffc748a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629101, "uuid": "dbe20e5b-5110-4639-a787-d4f7e7f2feaa", "comment": "Malware payload (Mirai)", "value": "a11dad825e58febc6ad71b68c16af8606c7f6f9279386e07a4defbb2ca4809a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629101, "uuid": "9f49735c-07c8-4d43-882a-61238566fe01", "comment": "Malware payload (Mirai)", "value": "3d4febd54b626bec0a2ac33f93cbaec3cec5b7a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629101, "uuid": "22d44e67-877b-4382-bd9f-110b1dfed812", "comment": "Malware payload (Mirai)", "value": "f13de2b3d12c9e63567cea82416dd3aed35efc52075d7733a165e35f02727d038ead9d62607d6ff2eeebdc47394e9be6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629101, "uuid": "eb643496-377a-49ac-baee-d810003adcb4", "value": "T10E33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629101, "uuid": "f170f621-ff51-4165-9892-372b7f9dfe26", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGZ:r/hqaJMcjeqK806MHdMfQXoHuCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629101, "uuid": "11430e22-33eb-4dab-96ec-eac95a0cc0c5", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629101, "uuid": "7d054daa-43f2-4023-8b58-636fb9fe7fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629101, "uuid": "5c4fff3f-c9fa-4945-901e-ef1f8e499570", "value": "d579b5ce2b036519293fe2beffc748a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b84ec2a-c128-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678661405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661405, "uuid": "6699c172-b518-4c24-b732-9a4271be1a62", "comment": "Malware payload (Mirai)", "value": "9d4c5d531699f8d9fcc8005c2604fc1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661405, "uuid": "ffd0ae20-4297-4d31-b1a8-d03f1fca07bb", "comment": "Malware payload (Mirai)", "value": "a14ab02f80add034ce14f4c8faf64751e573cb501afacd8b27bc7ec32bebd6fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661405, "uuid": "0ebfd00a-f5fd-4bdf-a20d-9d4013187c0a", "comment": "Malware payload (Mirai)", "value": "85f135d846e226b78d7a8bc6c226462d2508ba96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661405, "uuid": "660783a7-7dfd-4043-8fbb-449769dabf3d", "comment": "Malware payload (Mirai)", "value": "d6b941be5828b4c6be27083b785bd3a02709a31022ba6c394ec26fe99dcd99cf9ec22271080b5514ac437fd1d1c72f32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661405, "uuid": "3878e2d6-f39e-4ca3-bc21-f80815049650", "value": "T18C330293B09B1CB25B79D8B1DD7C2807AEA12764D29CD73B4329475EB6C700F28B5847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661405, "uuid": "a2e47247-6565-4e8d-a47a-0a8e410d878f", "value": "1536:XmcdYv4VT8n/LX0XLMdkaOLf3Y6RccrRqwec:XpNaYXLNLRcawE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678661405, "uuid": "74e672da-6b7c-490f-9cc2-24e04c6e28d7", "value": 52044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678661405, "uuid": "bf0f0877-9863-41c6-9922-276edd4f8610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661405, "uuid": "f1861ca4-178d-4bf0-bec7-a2c17ca4de67", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43048594-c12f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678664425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678664425, "uuid": "963637ab-077d-4e7e-b69e-3a29071caa43", "comment": "Malware payload (RedLineStealer)", "value": "1845a85e4e3e55494437d73306363b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678664425, "uuid": "de0c31e1-d967-4976-b134-c917d115258a", "comment": "Malware payload (RedLineStealer)", "value": "a1bad58555a56fb5bb2702fce83739a9e32b164f2321fd3eb9b7d8ae26e6d536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678664425, "uuid": "8dba3885-9f9b-48a6-add0-af4f12f5cc99", "comment": "Malware payload (RedLineStealer)", "value": "18939578f0195599b86c01696f788186b51cac5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678664425, "uuid": "71b079f4-ecea-40a6-b425-f34cc1cfed7d", "comment": "Malware payload (RedLineStealer)", "value": "977fde4a4687cbfd07ba97f14dda1bf10b3140bc96f7586438fb22d9a574f409530d1d40271f87f83c5c8d97a8c8ada3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678664425, "uuid": "a680c5bc-55db-4cbc-9249-b2e426125ab9", "value": "T14455AFA8F865C382EA76F3B9051FD0FADC15903BEDF04812B93187BA36D99D3D0116A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678664425, "uuid": "8dd49222-6bca-4e53-bfa1-19e500921476", "value": "db00bc6cb1460fee2c49d106d7b852bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678664425, "uuid": "4294b4d3-cf98-450a-9747-04b1ddd068ac", "value": "24576:ncq4uHP95wifz5+FSbWp1EACAXVn/rrtN1d5OZwAoZSvv6XqXUDDc0Q5+:cSJb5+VWVKVnDrJrOOLIvv66EPc0Q5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678664425, "uuid": "06d982d8-e250-45fd-86c3-825ebb0d1ced", "value": 1390504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678664425, "uuid": "29ca807c-dbb2-4f96-9fe1-6c39905136f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678664425, "uuid": "7c0cd85c-d13a-4b70-b997-5ecf3093a88d", "value": "1845a85e4e3e55494437d73306363b6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1de288-c0fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678643609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643609, "uuid": "a2a9e2d7-9503-4e89-ad0a-a5ed33760de1", "comment": "Malware payload (Mirai)", "value": "b3b6d0bd8cba8adfd54e1a29e62b58ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643609, "uuid": "eb5ba410-66c3-4cd3-8883-753472fdb53a", "comment": "Malware payload (Mirai)", "value": "a395a1a0a4bfb8f73f2d9bf52924a857dede4f6e1accc7d4e7a538a74cd83251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643609, "uuid": "d563fc50-456c-4409-8b59-165135477ae8", "comment": "Malware payload (Mirai)", "value": "8be0cae1a4a8893a22f5f754f2e0aaafb6e2a994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678643609, "uuid": "1b6e172d-4fce-4b65-9017-58c9431d60a0", "comment": "Malware payload (Mirai)", "value": "99d9b63afa80b6cfd2a6759a994199d3b99d0529304e752c24d1150509cedaa35198587a118116e88b209f160168c806", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643609, "uuid": "cb15235d-8f16-40c7-b975-185d3349ca86", "value": "T14F13F1972459186BCF522131F242D8FBA285902261077FF1ADC9677FABBE2130A391C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643609, "uuid": "36f7b065-9cd1-4115-a45a-54ee27071c63", "value": "768:2PSEH2YA6amcInTv1N4YJ/92xOD2RZTInzEbHmGTaThvhlt0Qno9kFzUCJyXK1/:M8YmmZ9Nd1BmlnshvCkFzUL+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678643609, "uuid": "b516de7c-32bb-4b94-9268-510b04ef6199", "value": 45516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678643609, "uuid": "138cc5c7-2866-49f5-9414-4d5ad2ef1cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678643609, "uuid": "ea990fe8-480f-4d2e-83af-9ce9429478f9", "value": "b3b6d0bd8cba8adfd54e1a29e62b58ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ebd053-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678647525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647525, "uuid": "8b0751b0-02ca-4b0c-8a6f-03a511c12391", "comment": "Malware payload (DCRat)", "value": "27c159608252527e6b979422a3156dd1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647525, "uuid": "5116e033-21ee-416a-9417-4e9a6740e397", "comment": "Malware payload (DCRat)", "value": "a436d81ed1ad9b0b463982b6edd29a27dc53474dfdfbfa4c01815a1e12735a28", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647525, "uuid": "7a9b1373-68b5-4547-9974-dc3e0bd17b85", "comment": "Malware payload (DCRat)", "value": "b80e97a9b53485499aca92539e5c6fb492755964", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647525, "uuid": "decb2d03-23ae-4b9a-83a3-4dcd276bcb57", "comment": "Malware payload (DCRat)", "value": "a3e8e047577dd99232ae0adaa1b12c8511e58fe6c13779adc46fd758c13ce77a95ad293043d9d95196a076701e694ce1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647525, "uuid": "663b1a50-04b4-4ad6-a773-5f1de6ac91b8", "value": "T14EA58D227681907BD6733D31D28DA378F2BAA9304E78468367901E3D3E64592953CE7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647525, "uuid": "ea3e1719-b102-4066-b5a6-eee23e63f011", "value": "9023017cf685edc5c5ac756e90730768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647525, "uuid": "03c03f1d-712a-47a4-b243-db18c33f5347", "value": "49152:PSoufUUb6shb5THU1KJjn1CtFHx/yqEZEvc6qzKwJ9RKrbH+XSULSO:EfUUb6shblUAd1kOqEZEvc6qzK0K/H+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647525, "uuid": "a7e697e4-a8b2-4847-a563-c626e7adf801", "value": 2115584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647525, "uuid": "bf945bd9-cba3-4e1d-97b7-657273602422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647525, "uuid": "1a07d4e0-71ae-4350-9a02-925b302b0c47", "value": "27c159608252527e6b979422a3156dd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51493ad1-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678642115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642115, "uuid": "741f3ea5-b331-4cfc-b4c5-7dced8149702", "comment": "Malware payload", "value": "e7e2851352fd6ece9ea3ccd20d3ecd09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642115, "uuid": "19891c12-a695-42a5-9050-646d6e0630ea", "comment": "Malware payload", "value": "a43a37a0493f989bf248183223fcccf2e1654b34ae0f93daa20a9b8c3f0d6740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642115, "uuid": "fe492065-a42e-420f-a02f-afa64d961c72", "comment": "Malware payload", "value": "4533eb7397eaf7a2ea5bd2abbefa7b4218d91b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642115, "uuid": "483fa018-ef99-4dd9-81f0-d7b0aa65b1ca", "comment": "Malware payload", "value": "8f82e8b71de9b655656b8ba7d46cda23574be7b8165d56bb955a55afceb37e50cae8a41f18253d3c9f78442c2ce7123e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642115, "uuid": "e7f501b7-8d98-4832-86e6-46784c0e8a90", "value": "T1ECD59DB2FB049132E5D211F1890D2B6F8D48953403B940D7E2D63AD969E0FE36B36B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642115, "uuid": "c3ce136b-9ed3-4ec8-8ce8-8357c3c92553", "value": "476e0d8710d77d835e610a586e499b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642115, "uuid": "f140fd5b-51e2-40f7-9682-6848d7b8ebb7", "value": "49152:N9ua62HpoHBb7irEIvOEczjmDHp2a0AQS25yl6CveSnH7zJWN:nu4EmZbp2a0AQS25yqSH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642115, "uuid": "db807e4d-2ccd-4af2-9f2c-3ddeb6af2890", "value": 2821632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642115, "uuid": "88d1f2f1-d142-4537-8471-52a334624503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642115, "uuid": "3f162f9d-3dc7-402c-bc18-aa43177f7e55", "value": "e7e2851352fd6ece9ea3ccd20d3ecd09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49466a34-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1678648973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648973, "uuid": "6794b6f5-9f88-434a-83d1-9c6d5cbd8458", "comment": "Malware payload (Nitol)", "value": "3f22ba649937b1440ef35aec83db9314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648973, "uuid": "9cc2e02e-ff85-470a-8963-5290d4d95e94", "comment": "Malware payload (Nitol)", "value": "a4629614abd27eaee77205250ea502d111659f1432efc188a41220d16a4f12ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648973, "uuid": "cf369757-b8f6-4443-a5a4-245656d3bf4d", "comment": "Malware payload (Nitol)", "value": "0ebbaae645e25b106f316e2f402b9f2a497e7ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648973, "uuid": "d5ae5da8-1b39-4028-ba69-4663cb775279", "comment": "Malware payload (Nitol)", "value": "1d1afa3b7dbbd6d81a40cfd21fb0e2b6b1236b75c988554c28b6f0cb1957844a71656dfbbe46e3a8d5471b6ceb514c56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648973, "uuid": "da00e7a5-5669-4df8-9834-497f97d8867f", "value": "T157F423443B5E5979C8DA55B2983BE84CE4E9CF0E9B0E871B95AC730B58764C31F3D0A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648973, "uuid": "d16c6427-d24b-47e0-8d27-426390f61e6d", "value": "ae2aa33ada22a914fe7fe1848029cae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648973, "uuid": "625fff54-4c42-4992-a4d6-927a26724ac4", "value": "12288:kKYtqnz+8SKjXM4ynm610d31e+Wcwq3teeLOSRy/0Ccc+Xqn7bTtfcuA8:kptqlSwsmW0dU9cfHOaycS+6nTFdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648973, "uuid": "8c0e91c1-4bd8-4730-9337-9a66623fd88e", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648973, "uuid": "aaa93ead-4fd5-4586-a470-03cf7a2bae98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648973, "uuid": "efb00910-a26a-464e-a970-988a411196fd", "value": "3f22ba649937b1440ef35aec83db9314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fe11eb-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593529, "uuid": "d89e4443-ec62-4481-86f0-9ac80b619daf", "comment": "Malware payload (Mirai)", "value": "0d1c8b8b7ab41d08c0deceb0bfae917e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593529, "uuid": "b9e4806e-ae7a-478e-824c-5cef897a9da4", "comment": "Malware payload (Mirai)", "value": "a4a08f0f4735943cd1ee127b17ddc18c641aae7f028c27f99ca6515124abf89c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593529, "uuid": "cc1fb161-5a74-434b-8811-e15f264c1922", "comment": "Malware payload (Mirai)", "value": "07c7883a316f51f5bdc9b0ac4ed92b537cac545a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593529, "uuid": "335696c1-73ad-442e-adcb-1aada438b45a", "comment": "Malware payload (Mirai)", "value": "23d8a706aabe8d8ae6d9bbdf2737790ecffacd22b020b439fc13b5567da0ee6d7553c9670a0a1900d756f73b32e57c92", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593529, "uuid": "c354ee79-92f5-4a8d-891c-5d389291f4c2", "value": "T1F2F2E1FD160014B6D96FC17967D44F2007B98A7250138A09F6DBB9EBCA9E0A8ACC9CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593529, "uuid": "7b788644-d7ff-4c8c-9c6d-756b7f887eae", "value": "768:rJBlEgtAQytIIHsDhVr3XbyZE3Fq0dPbHXodblJgGlzDpbuR1JP:DlF2QyNHsDfyyI0dPb3odTVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593529, "uuid": "440dd42f-af4e-4312-8fa8-fa344de13ef1", "value": 36588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593529, "uuid": "59b1330c-a7d5-400d-b20c-11cfd669c0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593529, "uuid": "ae4af39a-80e9-40fc-952e-690b0711cc79", "value": "bok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38abb563-c0e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678632195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632195, "uuid": "ca4c480d-28f6-4a9c-8056-b1e3e24483fe", "comment": "Malware payload (Amadey)", "value": "edd76380416d2aaa3fac5da4e30cf289", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632195, "uuid": "9204566e-cc2e-477f-8f12-8a592bf72ba6", "comment": "Malware payload (Amadey)", "value": "a71a823c808dd29f41341efd3db5b163723d1ae4a38a547306ee5a68d603885e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632195, "uuid": "230b02f4-6e47-45f0-b74e-fd3b614f902e", "comment": "Malware payload (Amadey)", "value": "eecf66faeb8821fdbce696969f044c90daa9b496", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632195, "uuid": "cae168ad-8fdb-4896-b197-5c18a293cad5", "comment": "Malware payload (Amadey)", "value": "d2bded913a0777e28088b20fa6ad577d7f45e71d7ef615110e152bb3bf36a11ba307969fdb2516e82fa4fa2bb03c09f8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632195, "uuid": "d620719c-4581-43e6-909e-bdbc3af42c1b", "value": "T163146E3297E07814E5634A315E3BC2E4262EBC619F2977DB32186A1F19B11EDD1F270E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632195, "uuid": "51f85a5d-3a41-4069-9dbb-36f0db34aed4", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632195, "uuid": "1ec0fbc1-2849-41ad-89fe-be8e57ea5554", "value": "3072:F0yGjCXS7QWdXpvDmAiZVosimzmHgpK+SsjdnQEX6FhNvj:WTjH7QWnShgsVzmrNsjdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632195, "uuid": "b3dfe11e-6a8b-4cb9-8ab4-e23b31d06516", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632195, "uuid": "fb102467-c6c8-4e74-a026-2cc66ddc98a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632195, "uuid": "4b06ee80-e9b7-40d4-bf57-8c32571acd11", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bdade3-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588063, "uuid": "18028fba-4875-4067-9e77-d84b88f36327", "comment": "Malware payload", "value": "a1e44f18fda1eb549011026efca16466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588063, "uuid": "14553843-964a-4a44-8802-cd9765b2fa32", "comment": "Malware payload", "value": "a775cab112221f613cdfdb3a562bad819fa988bbde8d1b664d8410d2ee64d826", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588063, "uuid": "326e5524-d211-444d-816b-1eb8e2d3d43b", "comment": "Malware payload", "value": "184f1deef15be8eec6da78c51223a6bb793eafb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588063, "uuid": "7e876d13-7882-4d24-b7fc-1520602aec9c", "comment": "Malware payload", "value": "d20e95cb84108b1318989f84b606782d7e839df7330800c9957e142ea6226ebb98ffd9c0125f4983a31179fc4d96c474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588063, "uuid": "dc73c84e-1b98-4193-b8c5-fa0855236518", "value": "T13A44139BF4C8D35FC9C6853B11AB062AB22FD0EF51A29AF710E1D49931B1C969047DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588063, "uuid": "643716a2-dcc4-499a-b610-5e5de21f38fd", "value": "6144:qTM8rBDXd2TyhZqJj6Qc6kizIUmHYQJipAkPj:KdDIbJj6v6kiioykPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588063, "uuid": "c22ba40f-65ac-48ad-ba06-5469c9dd358b", "value": 278065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588063, "uuid": "e2b993b9-9d92-4378-a6cc-a3fc14a304d7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588063, "uuid": "2e31d1dc-54fa-46fe-9ebe-aa4e85f2c812", "value": "SecuriteInfo.com.HEUR.Trojan-Spy.AndroidOS.Idiqut.e.13208.5381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e7a78b-c0d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678626263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678626263, "uuid": "fbadd302-242a-48eb-8159-e62acb343157", "comment": "Malware payload (DCRat)", "value": "6d5e43bfbadfb6fcc40083f8f4dc9203", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678626263, "uuid": "2f6fa6e6-8818-4c7b-814f-4657dbdf5beb", "comment": "Malware payload (DCRat)", "value": "a8c8d34b7db3654cf98611b1e8a95de266128b4583e798c3f38358a9db7f405a", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678626263, "uuid": "02e6e170-f068-45e9-b7ad-ea2cee0c64a0", "comment": "Malware payload (DCRat)", "value": "08578bd0ee5cde3cfbb19bc4e1142b5571f2f26a", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678626263, "uuid": "c0182ac7-b28b-4248-a02e-de0c8f8d9d41", "comment": "Malware payload (DCRat)", "value": "3b53feac6b4850d6fa5ce9cec94caf5d5459e7e233acf14c5ab7f82be9c0738d5ab9f240d1b0dc68cc719f680dccb6fe", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678626263, "uuid": "c42edb18-6a2a-4fd1-81bb-c94fad0ca526", "value": "T17AA51250B5C28072E572103349F4EAB8597DB92107798DEB27E90FBE0F253D1E77268A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678626263, "uuid": "5d60ce48-2b25-4687-b241-d0a6e4edcd07", "value": "8adccb91a2610fd2c6a565ba42ad5201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678626263, "uuid": "11c22879-541a-460d-9548-0bf0024ba1a3", "value": "24576:lyL9+FpRrXk+553pREC+Vm4xbvDdNnXENz23:o9+F7XkyPJebbdNnk23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678626263, "uuid": "0f87202c-43ba-45bc-85f4-cdf6be35afec", "value": 2125312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678626263, "uuid": "97eef38c-db80-45d9-949f-e25f4d0a08c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678626263, "uuid": "8c2c3d71-c6f7-498f-883f-06afb0026d41", "value": "6d5e43bfbadfb6fcc40083f8f4dc9203.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c77b91-c0d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678625404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625404, "uuid": "8afe80de-beb2-4286-bf97-96ce8abe84af", "comment": "Malware payload (Mirai)", "value": "fc68f3e9ca0620578b3305837e12746f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625404, "uuid": "a5e8cf4b-7885-47b0-b7b7-c50638c44f5b", "comment": "Malware payload (Mirai)", "value": "a963d418607993727816ec3f8fc642c98c95ab0152152ebd3795ff07f2f002a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625404, "uuid": "692ae5f3-d8d9-46db-8cbc-26c8eb5989d3", "comment": "Malware payload (Mirai)", "value": "a05ecd7c8bf8571f86b9fb5114bd6b63be5e032a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625404, "uuid": "3a204675-a89e-4c23-9ad9-f77df0492de8", "comment": "Malware payload (Mirai)", "value": "bdd86943632dff535d03d9b4306195b5c39e6bd4552b5c85f55638f8962176a7d7b28e4fcb8c4ae1e4cdfbfa25fb4bfb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625404, "uuid": "bd0ad1bd-f5ea-437f-87cf-8f2864d4ecb2", "value": "T10AA2E119BF1C868BC832697555EAEAD21352FC71F2DCDC482A40C16FF4A33A95474F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625404, "uuid": "c3a4313e-9165-451c-8ea9-8eceb7385f9b", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKi:k98o08kxofBE+ZkXaqGbp2F2TWul0c53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625404, "uuid": "48e476fa-cbe9-4f69-900e-674d6f555f83", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625404, "uuid": "37a75d92-9369-4a9a-adae-d1834d6e86eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625404, "uuid": "20104034-6938-496d-bf75-ff2595774937", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4de5ff-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642346, "uuid": "c923d626-131a-4a66-aa38-732408d1fcfd", "comment": "Malware payload (SnakeKeylogger)", "value": "35314f05e5b569ed7b5a5a6028ea7014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642346, "uuid": "36038de3-6993-457f-b39d-6faf9fe820de", "comment": "Malware payload (SnakeKeylogger)", "value": "aa8539591c2d7917346df8dd343e4f1cbe98f2eba1753f3975a20b99c1d43868", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642346, "uuid": "0aa26d18-2d3b-49d3-8f30-1c03284d61e4", "comment": "Malware payload (SnakeKeylogger)", "value": "049db5940cba822a2560c0251f698db24080c07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642346, "uuid": "bfe3925d-c2a4-4ccf-8cfa-8a073c031a45", "comment": "Malware payload (SnakeKeylogger)", "value": "fc82ab6a4220efeb1774d269b94897602f7cfef041a5ba85ed7ec24e6ab733f7a2abd23f6ce396db5f802f2b37458f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642346, "uuid": "cddd6d21-a810-4274-83c1-0aa2deb68444", "value": "T15E15AD445361AA39CB77A7FFB5612D242378685DEEBCD6480C4930CB09ADFB14881BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642346, "uuid": "0d6d69b6-a4db-47d9-bdd2-5d86a733e9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642346, "uuid": "9d628345-1f37-4117-b071-e0aaa64a9e84", "value": "12288:gZb4FlLKHFjcsRKKm1O5iMaVRs+RFrXag2Jf3UozI7DrBtXRHsD3oMLWyvWoZ9pk:ksKmIiy42Jfnz2DaMKT7rajWLxS4Z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642346, "uuid": "1a4579cd-6d84-431e-b9dc-b7c91b66aa94", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642346, "uuid": "8b70dae7-676d-4051-9729-1be89accf568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642346, "uuid": "2fafbcab-cecd-48fc-99db-76813975f948", "value": "V.2035E HBL& MBL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57bbbc9-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647115, "uuid": "a0338716-7dbb-4f2e-9dea-41d3bab71b5b", "comment": "Malware payload", "value": "c9306b079d9b5164edbf3b9c99cd036a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647115, "uuid": "3b33a872-7acc-408d-85c4-e73c29553fc9", "comment": "Malware payload", "value": "ac705e1ed3a5e8d51a9cc447d3a58fe5c308bccaa303052f8badab9d39cdcb5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647115, "uuid": "1b5dc9dc-f81f-46fe-b7f4-014c96a7540d", "comment": "Malware payload", "value": "2db898fc6c16c57f53f553b61123c7dd3c25327a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647115, "uuid": "83bdd3b2-406d-4340-a47f-d712c258171f", "comment": "Malware payload", "value": "455e5da03d08c256922838fd313cfed22cd8debf68c2b941be48679d3eb996d2de2a14df31d9e90363685a4094e8c9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647115, "uuid": "5220cd7f-2d4e-4a52-9413-683a885a7b64", "value": "T10F26CD9333049AECE82C4B77E07D215966196DC1B2B6F1E54E1BBEEFA9F05908274F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647115, "uuid": "60f0d728-d41e-4bad-a092-e687d087c2cf", "value": "f5bb3bf3856cb08782d3dbaa36a5825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647115, "uuid": "325be428-1255-482a-b0b9-a86d3edc717f", "value": "98304:jdQFRP61hlce+gu3O+UHKZc+sRZvojwn6MTSrZ:6FRPQzceZHOc3RxAwZGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647115, "uuid": "4b3b65bd-89ac-4034-9653-ad582a447a85", "value": 4861296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647115, "uuid": "930438b9-ff1a-4da5-ac65-6a75bbcbccd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647115, "uuid": "d1b3c7ac-a3e9-4f02-9d61-a664013c5da7", "value": "c9306b079d9b5164edbf3b9c99cd036a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e693b2-c128-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678661423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661423, "uuid": "1796fa88-cacb-4de9-8508-053fc7b886e2", "comment": "Malware payload (DCRat)", "value": "2ee39ece99fdc77a0490c21393799df2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661423, "uuid": "c661017d-1e12-4642-bc4e-3b4441e4dfbd", "comment": "Malware payload (DCRat)", "value": "acb3694eed3ff5d171c272be0e30fb9efe6454b83ee523a33a8e64b89e0e2177", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661423, "uuid": "21c4d87d-0f13-410e-94fd-356158b4dce4", "comment": "Malware payload (DCRat)", "value": "3291e761530b5d004ed3a96b7cf317e2e5270dfa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678661423, "uuid": "29948137-143c-4728-89c3-1538c9e40943", "comment": "Malware payload (DCRat)", "value": "7af0b61a3c4e070aabbb6a92d8c748b0a2b56cbead838a492e1c081c246ed82d37a391ef5b186f55126e11a0d2ab0851", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661423, "uuid": "66850c4a-2526-4830-a047-31f633f2bb33", "value": "T156B45CEC19FC22E6C5F0EFB15ED54517B2D3912EB301EDDD6AD20B680242A49F98742E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661423, "uuid": "cc041e95-3025-4142-bbaf-d777dfdb26e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661423, "uuid": "61808e41-abce-4de8-85c8-5ff49a8eadd8", "value": "12288:18SYsZ11pdkRAXUBwMyo4WKQmqPZZ8Ozr7:17bZTpIAXAJKQmZOzr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678661423, "uuid": "8b0f7940-5814-43a2-8aad-7dd84378a98e", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678661423, "uuid": "2554c557-ec64-478c-9149-153307745987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678661423, "uuid": "43b8eb4c-bc1e-4f38-83d9-b99085f8719b", "value": "2ee39ece99fdc77a0490c21393799df2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3b8d91-c103-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1678645728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645728, "uuid": "6e3a34d7-04ad-4695-9326-9edb3101597e", "comment": "Malware payload (Formbook)", "value": "eb86a131d28521c31b5657a236514082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645728, "uuid": "7f8965a4-07d1-4c9f-b0d4-198793d0241f", "comment": "Malware payload (Formbook)", "value": "adb24e3f246fd2e4d38866e9273f7f511af700a1601399bc695b01c5ccdbd43c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645728, "uuid": "a868aab2-49c3-4958-a95b-0b6f144e81f7", "comment": "Malware payload (Formbook)", "value": "4aa2ae36980b36b3172a9ea4a2a40e6c3eadc24d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678645728, "uuid": "8d113a47-ea0a-45e4-a068-3177ee5fe34a", "comment": "Malware payload (Formbook)", "value": "cfbb34a587a76e565e7c7f0684163005cccf886c52d36d1591a92dec23dd8b36174d12f4046067c33d6cb34bbd4fd1a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645728, "uuid": "19f7aa69-69a6-4565-9fd0-e1fc6c84bcac", "value": "T1A2356A92E9991D5FE913CB3A5333580D21671D25F23DACE62C78F1A62AF26831721C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645728, "uuid": "61c86054-be5e-4076-95cf-e5de9482a2d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645728, "uuid": "b57410e2-2c5a-4a14-acad-0962df14956c", "value": "24576:fuOZ6wGkB+e9uf8mSBO4KcDzdgVlRPRHIwayLOMTXfBZiiCaH:6CORcDzehRoiOMTX6iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678645728, "uuid": "affcf306-4c2f-4115-8bb5-1b2c98c99f0c", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678645728, "uuid": "b0530937-5953-40fd-abe0-0d9e483e72e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678645728, "uuid": "7ebc57c8-59e4-48aa-8acf-39e07920cf4c", "value": "eb86a131d28521c31b5657a236514082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a3497-c0ab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1678607802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607802, "uuid": "f11369bb-9095-4242-9e22-6b4c265732cf", "comment": "Malware payload (Tofsee)", "value": "4784d7934eff171a3f0222b6068d6c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607802, "uuid": "7f984895-9241-4330-981e-701984c4c2f5", "comment": "Malware payload (Tofsee)", "value": "adfb07f6f0a466bfa3ec21c93e946566fd52885319c318e7327cb10b20ba7cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607802, "uuid": "3268a186-22e4-40dd-a04b-9785f109eeeb", "comment": "Malware payload (Tofsee)", "value": "c5eb7a17e94b6cacfa79559fdb3722b0ae42385f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607802, "uuid": "b91a4ca3-572e-498b-bf93-8e6f3a337093", "comment": "Malware payload (Tofsee)", "value": "320d7d7d2c2298e523de963e2dca9a555af843881e291971050932c0db8f59dca2c7d2fc0f517f22ea9820603f56ce89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607802, "uuid": "bd99ddbe-3a83-4fee-bc93-9b10d493772c", "value": "T117149E02F3F17C61F673C7719F3FC2E46A2FB5619E68676E22084A1B0AB11D1E562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607802, "uuid": "22519459-8793-4fe3-9bfc-1bfae0ab9c6b", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607802, "uuid": "68155f8e-1906-4e37-80bc-e8024c25a47c", "value": "3072:UEWqR7+49wlqJ66JQbnDnByxraT0cbScEzQMQ7X6i+T+YI:yqh+49PQnByU/bVAnQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678607802, "uuid": "fe523e9f-2fc4-4e9c-8520-fbd41bd52809", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678607802, "uuid": "3fcc9a83-6c2f-4b25-9a6c-758eb6102e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607802, "uuid": "2ea40625-5bc0-4b0f-97b1-6a43b689898a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f307f59-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678628287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628287, "uuid": "5e3b5663-fa89-44d9-9ff2-af3b48ea22ee", "comment": "Malware payload (Mirai)", "value": "0c944ed815cc715d6f3ce4c5c1233080", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628287, "uuid": "50c87871-29a3-4ef8-8446-0a05f8e80ca4", "comment": "Malware payload (Mirai)", "value": "b07c7a0766470f3ec88df752e93f30d803491adc03e84352b23937a5299025ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628287, "uuid": "d6ddf6fa-6f2b-4f87-8a23-e60dd11d77c9", "comment": "Malware payload (Mirai)", "value": "ebbf765d9d729c0c759e65de3be6af98337e419d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628287, "uuid": "dfec9326-4037-460c-a851-f505e1b8c132", "comment": "Malware payload (Mirai)", "value": "7e57e1a134dea7f462d5653cba432be96201cc6d7c29d8dced1bbe99d2ca92f5506b30b5627d8a79ecfdc6741eb9bec3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628287, "uuid": "5f6cd9a7-cdbf-45cd-851c-9c9cdb964e20", "value": "T1BE336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628287, "uuid": "82e9ad0d-181e-4a44-a71d-206dd8279e71", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628287, "uuid": "59aa9f53-783e-4e9c-b921-9fe3731acf62", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628287, "uuid": "fee35beb-594d-4b94-83be-5692cbece9dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628287, "uuid": "57e37a23-609c-4b39-a3e8-1161ca4131cc", "value": "0c944ed815cc715d6f3ce4c5c1233080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b72891a-c0e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678632119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632119, "uuid": "87de244b-3b6f-4d0c-a154-91532aeccdec", "comment": "Malware payload (Amadey)", "value": "d94373deda3b7c334194d072b85895fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632119, "uuid": "ab4e14db-6566-4f6c-b95b-6561a3b0a259", "comment": "Malware payload (Amadey)", "value": "b11c8bc2c9e85a6130d6b58ad7f6c175911e3c2bbbfc317e75f63d86c270c06d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632119, "uuid": "5c2ca235-0e0f-45b5-b45b-f7a002713a9c", "comment": "Malware payload (Amadey)", "value": "6e209c00c14c8310a96e71321f62f231fcec659d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632119, "uuid": "62ab6980-91b7-476b-b201-e3917240188d", "comment": "Malware payload (Amadey)", "value": "46a4db23499082b33225e894f3fb71d0f72932fa078af58621a638303dd576c886ec0d58106ab562368e9519174813a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632119, "uuid": "1687b5f1-6298-4853-b54c-690140ff397b", "value": "T1EEA4E13296A17824F5628E329D3FC2A4261FF8A15F6957D732046A1F0A711ECC5F3B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632119, "uuid": "e20a52bf-edcb-4a74-bb8d-10a9f1dd482e", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632119, "uuid": "a5bdb966-8f4b-4e89-bf4a-b2cc9395fdad", "value": "12288:RpRYQp8r2yS44YOfXqfTsAQvNKooICHciGxa7pA:Rv58r8YOfXAsHQooIQciGOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632119, "uuid": "aca45138-3efa-4aa4-8aee-14856d9c9fdb", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632119, "uuid": "de49a9de-6b04-4236-979d-5419d6b1c300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632119, "uuid": "8e1b1908-0815-4b5b-9d0b-9e96d732e6b1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd14ee8d-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648738, "uuid": "848cf954-b019-4134-8abe-d7bd9991c0ad", "comment": "Malware payload", "value": "46b241f63384e8e943b1c0ae780eddd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648738, "uuid": "a3ad29a6-14ac-4684-9b17-b061d7d1576a", "comment": "Malware payload", "value": "b14c6093ebf544c55a6f3945db86881c61bf06c5b7cb2017c10ce1ef9480460e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648738, "uuid": "c02be7cf-cf8f-4799-9c7d-5b45316bf9c5", "comment": "Malware payload", "value": "710dcabb5da1647d5c8ffcbf0d83122be53361b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648738, "uuid": "0f10c56b-ec62-4359-8144-e48dc92b062a", "comment": "Malware payload", "value": "d0c0b1a3bc7a5b6cdc5ffd8ee93fabbefd43c70c060194d105531299652b15f2d260a9108e63d654b3fd234efb49fe0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648738, "uuid": "c29805d7-1b50-4a01-80f2-8723058d99b2", "value": "T151848D15F7A404F8E0B7D138C8625646E7B27C5E03709B7F27A4466B2F632609E3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648738, "uuid": "2352c0a7-c148-46d3-a25f-877837c75c5d", "value": "57b146c278fb2ac0214007b236451fbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648738, "uuid": "8350023f-c1b0-41ed-a775-8a30b17fc1ce", "value": "6144:AqlASMp5H5Dh6MQFFU+dGAwuFSAfqI7HohOTHC:dlASo5H5D0MkU1oSC7Hoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648738, "uuid": "c51069db-6c06-41e6-9430-82f1efd12417", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648738, "uuid": "838f4bbe-e381-44a5-b4cb-302f48b488d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648738, "uuid": "ef2ecfba-f0e7-46f6-87e0-c0e586d4bb6d", "value": "46b241f63384e8e943b1c0ae780eddd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd5790-c104-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1678646122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646122, "uuid": "33de99cd-8429-4aca-8471-3e7c358249e6", "comment": "Malware payload (NanoCore)", "value": "387757df8d881707f05aa77299174224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646122, "uuid": "2f8c57c5-b635-409d-8465-c50c4a162efd", "comment": "Malware payload (NanoCore)", "value": "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646122, "uuid": "666db196-fa85-491a-a179-5a9ab917348e", "comment": "Malware payload (NanoCore)", "value": "1d92729f9dc8bde0bbcb198ddeefa7263d469395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678646122, "uuid": "6ea8db63-b052-4b76-913d-c88d23882bb2", "comment": "Malware payload (NanoCore)", "value": "9878602d3a99c33cab781065b30b726a059853ad7ec408dc2399223458aa6e69071fc12ec299de14abce1a583120cd05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646122, "uuid": "6287b395-e976-45c6-a975-21e64bc1ba6c", "value": "T17D15167D39B656D6C238FA3346E7E520B6BD80923303D959C9D61AC0CF81582BDCEA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646122, "uuid": "c94795e6-b8e1-4842-a2b6-2623f7e3cab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646122, "uuid": "471f625d-55b0-44b4-8442-419bdd1c9cff", "value": "24576:J3PXVv7nj4Ui1C8Ko2bkTU/a5KR5OyW1Cw+85Zgb2ALTsIBMNjnNNOhAe/S0:J/XVvLjQlF2H1cyI+kZ22A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678646122, "uuid": "e1cbf276-c577-4d30-a868-25d8fcbd08a2", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678646122, "uuid": "b0d138bd-106c-481c-9b52-c947fe35c95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678646122, "uuid": "0b50d6ee-582e-4076-aa90-3215d5c483d3", "value": "387757df8d881707f05aa77299174224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2533b4-c0a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678603639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603639, "uuid": "8b7e9bab-909b-44c8-bba3-1c36e02e3697", "comment": "Malware payload (Smoke Loader)", "value": "1879c486c2caeb9c045e5e69c416d386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603639, "uuid": "222311dc-ded2-4498-bf07-970d900327bd", "comment": "Malware payload (Smoke Loader)", "value": "b591ace9bcbe41bae92cb85f16dcc0b6e6edcb93a5676ba68d7f0d370da0ce58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603639, "uuid": "9d8cfab2-a7c2-4343-b3b9-eab1e14781f2", "comment": "Malware payload (Smoke Loader)", "value": "cec53d4a69160da6ee09b072a511b7eaf66bb8f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678603639, "uuid": "f05d2b9e-e806-4ff2-9361-70fa9c373923", "comment": "Malware payload (Smoke Loader)", "value": "fe354d694609ba25003ebe3d16b336bcdc3400a2472ab14d85f57ff5c05ebddffd450fdc756fdfd32a622a22a317d2a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603639, "uuid": "ff577373-9c4b-4a62-bdd0-5d48222ed5bc", "value": "T1C9149D02B3E17821E6B3CB719F3FCAE46A3FB4614E69636F23045B1B0AB11D1D562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603639, "uuid": "a0f8e303-7789-43cc-baf7-23f6db87f2d2", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603639, "uuid": "ecdc0035-d45d-4100-bf84-df681c3d3281", "value": "3072:N2Wqhru39dfqqZM47EbHQjjOgI0ge+Z7nb3rED7X6wL+TIYI:lqBu390TLQvOnr7wfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678603639, "uuid": "a35f83d5-7064-43b6-9257-2dd0e827770b", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678603639, "uuid": "a7ecbf7e-24b5-441d-86d3-d42374377e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678603639, "uuid": "07a55fd5-63c6-4bb6-a636-9073cdcc71ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761c621d-c076-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585053, "uuid": "455bcdbd-91e3-45a0-976a-ce93887c4722", "comment": "Malware payload (Mirai)", "value": "57ab4c084fd7037199d58394d4d06f81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585053, "uuid": "4392ff46-9c12-43ef-9e90-c1a10f0cb213", "comment": "Malware payload (Mirai)", "value": "b783c9ec1ca4d1442161450852b14658722b9867b2caa0654de38c89ee2afd55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585053, "uuid": "77320e05-eee3-4852-884d-9733b15435a6", "comment": "Malware payload (Mirai)", "value": "4a57b79c65f12255774b8a3b206cf2040995c8d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585053, "uuid": "21bd5e42-fc9f-4054-91dc-7de59f9b0a1c", "comment": "Malware payload (Mirai)", "value": "2ddea343dfa5bad82c59a28c89f825c087740d8f5afe72de7534d568aa2a149da68d9dd85f4237bc6c95027e2f508524", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585053, "uuid": "ab55ec19-52d1-4f6f-9b86-f70df78e1bb1", "value": "T1F1232A96BC91DA0AC6D023B6BD6F64EE330163DAC2DE3247DC145F147ACA90F0DA7645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585053, "uuid": "94e11b3c-70f9-4d2c-bcae-5a62dbef0eb5", "value": "768:NbWwllagxc3POLzfSSTEuV617qZgFmErnoLlauGdcSpwpYQw5OAsp1Quu9ub2BN:DUg+3+TSSssZ0rnamHpwqnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585053, "uuid": "cf66b73e-7c94-4122-9b03-b8ba1e001bb6", "value": 48252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585053, "uuid": "512ed0dd-b47b-48fa-8fc2-3689a0e79bb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585053, "uuid": "e12cbf50-f6ee-4d32-9a3d-16e70d131765", "value": "57ab4c084fd7037199d58394d4d06f81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07b5cc9-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Autorun)", "timestamp": 1678621336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621336, "uuid": "0615ec51-7f29-473e-b060-2cf0818b3db3", "comment": "Malware payload (Autorun)", "value": "b8d68bddc357ca0b481224c454cecffa", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621336, "uuid": "18972a73-a251-416f-90c4-727d94891e9e", "comment": "Malware payload (Autorun)", "value": "b8bd4da89b316085332aa6f343a9eea16295708091330214dcbbfb17a16e47c4", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621336, "uuid": "147ced37-9562-49f4-9e44-f43378a6d411", "comment": "Malware payload (Autorun)", "value": "30b811c56badb98739cea27628d9801708dde673", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621336, "uuid": "ea207827-f793-46ea-a8a4-9d84f0c4ece6", "comment": "Malware payload (Autorun)", "value": "947b3a4464fdab177520a5f830ad1f86986a2002feaf3e3de114b96de6064db9e1dc038df7131356dbecf22fdb024535", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621336, "uuid": "a1b4640b-b8d3-41ec-8c3b-f973f49783db", "value": "T131C55C64E610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621336, "uuid": "8289b217-44fe-4fb8-a0d7-aeee02ac7426", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621336, "uuid": "947ca2c2-23b1-4566-9a34-6198959b0285", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCm:eEtl9mRda12sX7hKB8NIyXbacAf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621336, "uuid": "7112b65d-be14-44de-82d3-0da4b8a5c19f", "value": 2554882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621336, "uuid": "77b74a81-be02-4498-be0c-78123f75b840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621336, "uuid": "a18a6626-823b-4df4-b4ed-c8aceca47c3f", "value": "2023-03-11_b8d68bddc357ca0b481224c454cecffa_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d99786-c0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678607115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607115, "uuid": "764fe24d-ab39-4796-b696-8cdbc90e6d15", "comment": "Malware payload (Amadey)", "value": "15ec6cdecc5272031a5cabdf34444c44", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607115, "uuid": "bd354a1a-6f0c-45c3-a00a-3457bd790946", "comment": "Malware payload (Amadey)", "value": "ba58643fbc4440fb30864503e633cb2003812bcf44a718825e42079e85763f8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607115, "uuid": "5e23c1d0-c7ef-4126-8573-bc46168aca3e", "comment": "Malware payload (Amadey)", "value": "b4932ced0e9f1ce117a5f1d2e1b2e9652990ee14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607115, "uuid": "fc81b0b5-6c45-486f-8ba6-191eba359d6b", "comment": "Malware payload (Amadey)", "value": "bbcea6f4876a2450e35234d628aa9ce96776b706bf1b62ba3a8fc50113e000b7b97097f8b7d302c29916f1fc6bb1b5eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607115, "uuid": "023c50da-d16f-4b65-bbbd-11a4e4176dee", "value": "T13D449E0273E17861F563CB315F3FC6F43A6EB9214F69676E23049A2F0AB11E1E562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607115, "uuid": "c9e5f633-c68d-4db9-ba24-1e9911d8a786", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607115, "uuid": "2f955613-d83b-4d49-b79e-b4f4a6dd4f9b", "value": "6144:Mq8vfVPe3BSapVhXAaxTqbqk7nDqSzSpRS5:1KfBapVBRq+k7DqSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678607115, "uuid": "dde28349-17d8-4e32-b415-c483b2f4861c", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678607115, "uuid": "6e7e1b99-0023-49e8-bfd4-fe6879c1a69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607115, "uuid": "cc142485-344c-47c6-83f5-fbba52a3b0be", "value": "15ec6cdecc5272031a5cabdf34444c44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcc56c8-c0ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678608236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608236, "uuid": "3253e283-440c-41ee-be24-09eff312a7bb", "comment": "Malware payload (LaplasClipper)", "value": "4d324ef574252a353198a42a3c7de65c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608236, "uuid": "2d4d9c56-4392-4c51-b24b-50b6a13d086d", "comment": "Malware payload (LaplasClipper)", "value": "baa173558f33a0b098d838922e0953f0e8ad9a663842b36ec6d72f239770046b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608236, "uuid": "9c4583bc-4364-4de5-a505-f6ed45d0c5e8", "comment": "Malware payload (LaplasClipper)", "value": "aaa0897b10ce9e4687f8aedc4560d27b56bbba7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678608236, "uuid": "4a1e3c3d-4da7-4211-b35d-9029071311db", "comment": "Malware payload (LaplasClipper)", "value": "998fa9677b7dbdf964d9315ae4cd99102605d56d221addf1e85810df8c4348e70302a59315e0eeb49df647de84c9fe81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608236, "uuid": "7e9671a2-1fa3-4716-8582-d2b865cc6bc4", "value": "T14844CF1273E1BA35F6B3C7715F3FC2E82A2FB8614E68675E22045A1B0EB11E1D562712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608236, "uuid": "2699eef8-9c51-41d3-9da0-614aed24e657", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608236, "uuid": "95ab90f7-0332-44ea-828a-3f14cdc169c1", "value": "6144:TqQoQEGS/AoMjVodrtd0iws/rcZBdhJRSc3Q4:m5Qq4E/Ms/Av1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678608236, "uuid": "fdebdedf-a21c-41a9-a697-8286e0928411", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678608236, "uuid": "3ccc003c-60ff-4493-ac49-3e327bbeb0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678608236, "uuid": "3d678e31-3364-47a2-ad60-6043cb9a004e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8421114f-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678648213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648213, "uuid": "a05c19b6-0aa2-46cf-98b0-a5f361be3e18", "comment": "Malware payload (RedLineStealer)", "value": "7a383a034b20ae3a651c462fa5a495e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648213, "uuid": "b40fe10a-3fac-4260-adbb-7adf64ad5e46", "comment": "Malware payload (RedLineStealer)", "value": "bc984ea331fe6f273d72b1332e0e65ef78b5f4a49469a79e8c98f18e97bece22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648213, "uuid": "a88e1caf-6bf1-4264-a4a8-baae55b095ac", "comment": "Malware payload (RedLineStealer)", "value": "92f8db508fd9b29fef0b254d165d6bf8063d63b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648213, "uuid": "887e7aa6-f656-4eb5-9c9d-4d06989efca0", "comment": "Malware payload (RedLineStealer)", "value": "6e3f02ce34d210c3b269cdabfed65d77584afb445d66c0101efb77ee008015b15683452388fb1f408e63ba7f9328a2b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648213, "uuid": "f54f1ed0-ce36-4ba9-8b3d-bf1b2f4f8d80", "value": "T19154C03353E0B824E2674B369A3BC2B4272EF9524E6957EB21186A0F08711FDC5F171E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648213, "uuid": "4e0d6095-b7b9-462f-b0ad-535273db9026", "value": "f9d4073ad2ed2d29ea4ed70de1da0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648213, "uuid": "79bfbbba-6d00-4625-b957-5d38a81da6f0", "value": "6144:f4sjflqs7J73h6h3utHxsKmhYiiBN3kSp7Z:frjflqs7J16h3uVxsuiLet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648213, "uuid": "ae25d50b-47ff-44b9-ac9e-defd23e71a95", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648213, "uuid": "6399725a-548d-4534-9d0d-2a3dc19a933e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648213, "uuid": "e4d50e66-dde4-46b4-acba-2aa472c98bfb", "value": "7a383a034b20ae3a651c462fa5a495e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbd147b-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1678642162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642162, "uuid": "acc67442-1e8b-4023-badb-44e6965e7ef5", "comment": "Malware payload (AgentTesla)", "value": "2ae3f03e02368a6c5c4c91a136655643", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642162, "uuid": "f10dfe3c-b655-4e06-a5c4-e2e8e4fc3712", "comment": "Malware payload (AgentTesla)", "value": "bd0504b26a954d75e87afcceeabc7726770a9420af18c280c0fbd193ec3b6618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642162, "uuid": "210130a5-f112-41a4-ba44-49f42f706b42", "comment": "Malware payload (AgentTesla)", "value": "aa6291e0d92ab16014ee70c8c2d143fdc1bf5290", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642162, "uuid": "e113931c-4ab5-4d47-8091-8dda0252d3b9", "comment": "Malware payload (AgentTesla)", "value": "fcdc3aab76dfcf3524322e2da2a0a462e3d33ed933525aaf843dd80747c250c5c7136c57031c43816ca6b679be474c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642162, "uuid": "90531783-10d7-4558-bf3b-b6cefabef24e", "value": "T1FD05BE446312A87FCB6666BFF0521E68137CA81EEEFCD6885845709B08DDFB444C29DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642162, "uuid": "b0d7f3e4-9b07-4d95-a373-3f0ac381dcb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642162, "uuid": "57a86ab9-44e9-4b01-999c-b73183e44550", "value": "12288:X4XkFlLKHFjcsaUW9GRJ7yrNyXYKBbFiYCAxQoM2B/UTYoNxaYgbHDpNTqBAOih8:9im4YuCAxtwBiRbjpNOBAVDsvx2rKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642162, "uuid": "ec87ea67-6cee-4039-9f2e-500bde9e2cc2", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642162, "uuid": "fd12e2fa-b1fb-44c5-ac88-6783ab0ffb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642162, "uuid": "efae7cfa-ef0e-44e4-ad9a-bf215322c3ce", "value": "2ae3f03e02368a6c5c4c91a136655643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf94a12-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1678634162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634162, "uuid": "0830d9d0-b9a0-4847-bb51-26ed58265805", "comment": "Malware payload (Stop)", "value": "3244be7d8e87184099e01ace7efbcd81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634162, "uuid": "46d44dad-43a8-44a5-86fd-37d872b2025b", "comment": "Malware payload (Stop)", "value": "bd8bc033e614a185c60aaf729184df7deb8cdce251a99774e5a7eb4ce8824c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634162, "uuid": "4c00a98f-e02c-454b-a1ff-5ba97cfc634e", "comment": "Malware payload (Stop)", "value": "23dcea7a3d8b526087b3362fdd5211ab3e0d4836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634162, "uuid": "d345ddaf-a1a0-4c85-9e24-b152236090db", "comment": "Malware payload (Stop)", "value": "410a67a86b0e63e4bae5985cd3c0cd58b26febadf7c6a9148dc3812a8cbf09a7113e6754dd6ec1f793cc5d1aea9e413a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634162, "uuid": "b3020e70-5eaa-4258-afda-3486ebf7ab2d", "value": "T1C7E4021173A16825F9A3CB328F3F96F4672FF5218FA9A75F33144A1B0A720E2C565352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634162, "uuid": "6af8d3b2-a705-4137-a394-da5f9838e79c", "value": "3d4c16eb468ed7fad4115f689c8d6af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634162, "uuid": "6de2feac-f48b-4788-b514-0da9d18aa8c5", "value": "12288:AncXAPlf19mNt81x2+Hc7SlQuB8MjVP4o48KWgHQmVlh9ZKYGOtvWGpM8:AUQlt4Nt8B2hzdSKWgwmvZbG8Oi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678634162, "uuid": "899afc13-d638-4ebe-8a64-e755a02c4e6c", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678634162, "uuid": "f67827bc-5809-4c30-ab6e-63911ed5b461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634162, "uuid": "18f2f402-d800-4277-88ec-5bb4b36dad84", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd8da7c-c0a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678605652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605652, "uuid": "fb880cf1-49dc-4d8b-9e3e-312005bb7f36", "comment": "Malware payload (Amadey)", "value": "16cf28ebb6d37dbaba93f18320c6086e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605652, "uuid": "5e85253f-1c17-4afb-9cc0-acae85470254", "comment": "Malware payload (Amadey)", "value": "c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605652, "uuid": "a2578a83-aeb2-4804-b331-59bde944b689", "comment": "Malware payload (Amadey)", "value": "eae7d4b7a9636329065877aabe8d4f721a26ab25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678605652, "uuid": "174bd8ad-86d5-4cf2-ae15-1607b857fda8", "comment": "Malware payload (Amadey)", "value": "6ebe2f8b53ce16aa60375d5b0a076d473696281b44763273dd307074b24c5a6b6c1ad3f09e7abd70cecf8482f4f220e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605652, "uuid": "2743576d-c482-4629-93e4-cdfefb092285", "value": "T120936B1030E2C071D57E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605652, "uuid": "159071fd-4315-4e27-bc82-64675e3d2b5e", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605652, "uuid": "094f9b9f-185a-41e8-ac2a-084f67c692b8", "value": "1536:io4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUL+aB89p:ioUCWbBNpplToUs1uNhj25LJUCaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678605652, "uuid": "67d57b57-09c3-4e69-b06c-bf5027fe2c21", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678605652, "uuid": "4ae5dd83-3da9-4f5f-9e54-36014615ac0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678605652, "uuid": "95bd6800-a588-4dfb-ae2b-5f86342c3725", "value": "16cf28ebb6d37dbaba93f18320c6086e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cad41c9-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678632577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632577, "uuid": "ec4439a5-6e9c-4c58-8099-d2bd911646cd", "comment": "Malware payload (RedLineStealer)", "value": "15ce9671998ba0d09e18b69543eb04fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632577, "uuid": "50fb4bb7-2af4-46b9-a339-0139581ac9d6", "comment": "Malware payload (RedLineStealer)", "value": "c0fb39fded82aea25b9ae33fd8eefb778d4b69a7d903ed22123aedb76e313164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632577, "uuid": "561b3b04-7925-450e-8361-c1324cc7a774", "comment": "Malware payload (RedLineStealer)", "value": "f47ca57a3ec0fe85c6c884e7ce14afd2d4e06887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632577, "uuid": "7381323f-07ca-4a5b-b81c-b5dcf6ce0297", "comment": "Malware payload (RedLineStealer)", "value": "1a58b71084adbb7527dc56ba028607f4e8ca1b63184cecb822d4c73d7b287c99479398256ad89f3a6f51bc74f0151f09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632577, "uuid": "e9d0b364-a4fe-4c0d-a760-55bfdb7baa35", "value": "T1A9F40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632577, "uuid": "1da383a8-0d6d-426b-9019-f7ca5242ea60", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632577, "uuid": "3024c1f5-0248-4bc0-86f2-358af9fab700", "value": "12288:CtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:CtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632577, "uuid": "416ca722-4a36-4914-8a1b-20dc7f752502", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632577, "uuid": "95a7efc8-ab12-4ae5-aa55-7472820cd771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632577, "uuid": "e10202d0-c038-4360-b6fb-fa49ff73b70c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0c2c3f-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678632607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632607, "uuid": "fc4e5a0c-77b0-41f5-aa6b-5eba3eaa3f20", "comment": "Malware payload (Mirai)", "value": "0ab9f80ea25fe5898b2d7352fbada2f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632607, "uuid": "06ee274b-ffff-457f-967b-b0073d2834cd", "comment": "Malware payload (Mirai)", "value": "c181c01ac898d2465d0cd2cefc478ceff635a26b0b9fcee54020d894168e654f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632607, "uuid": "c06d4d79-3c48-47ed-bfd0-9955499fda54", "comment": "Malware payload (Mirai)", "value": "51833545dbaee26ced6d5145f7ab30bc30afde5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632607, "uuid": "15a68c10-7771-4748-8f15-1fd1abcf2065", "comment": "Malware payload (Mirai)", "value": "a7fa292174da1cc19f9b18265e3815b07818da4abcfa5207d081bd758fb28cb6d51315562d8205e8da6c5ecbbe24259c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632607, "uuid": "583088d0-248f-44ef-998c-8f34408df02c", "value": "T1FE53012432107556CE626936C5FCCF60391C9A38E6D930E6EB48C3ED3AC356275363E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632607, "uuid": "72b770ac-cc6f-45e1-84dd-0844fa14ec02", "value": "1536:bI7hy2C9YKCyi3LUu3NizZhIrHlHEDTg2LZZRwDpLTKz:ohy2C9Y13LT3IzZgFHEDT3LZ3oTKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632607, "uuid": "b151dc38-3f61-43d7-b59d-bf7fc0f2aacd", "value": 62980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632607, "uuid": "0e6e72ed-c079-47ba-aaaf-b4e6b77c2d06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632607, "uuid": "25db4b13-d860-470e-acc4-1a31e5548228", "value": "bbx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51951ce-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1678642819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642819, "uuid": "eddb1886-1c68-4ac8-bcb9-0b8814fc146f", "comment": "Malware payload (Phorpiex)", "value": "5429aac8e9440a958c37ea66ea83a461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642819, "uuid": "06838c01-2e67-427c-a896-27775b989612", "comment": "Malware payload (Phorpiex)", "value": "c1a6b3ae4be356a4953260388a0724f991abdb7eb28da6ab0ec4a7f57200a586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642819, "uuid": "0116a5f0-164d-4aad-b6a7-7b48b5599e6a", "comment": "Malware payload (Phorpiex)", "value": "c13e9b9045485e43770435b6cb7f0df91becaec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642819, "uuid": "0e1f1bf7-c1fa-4aaf-bdcc-6e50039c1548", "comment": "Malware payload (Phorpiex)", "value": "d031c7b8fd8cc109c1a1f0e45815a342ce323af947090724525c7c6492e6c03ab664a645404b46be3186daf4e2db3e7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642819, "uuid": "44034cf6-a2d5-400d-b30c-508029ac6f92", "value": "T17072E6039665539BEA32247467732E257078BD35532E9DDFAB800A7C1264EE0FB33396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642819, "uuid": "1809f9a7-74f1-4d51-832e-daa1751b179f", "value": "e4c87b7c96eb71ee3a5e91bc3f06c1e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642819, "uuid": "dc4abf4d-b652-4d7d-8095-b8c6057097a7", "value": "192:wEwSSz9XfaKuwfZfSheakh6BeT/tX1Y+8J4pfVBcF7Y2DP1oynrSIHPn9:wZpiPB3kQAtlYxJ4JVB00O1VS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642819, "uuid": "f2eb15f4-c028-497a-988b-747d38ceb2e6", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642819, "uuid": "9e9cc0dc-dd40-4fca-bd1c-b1645d9ddd6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642819, "uuid": "883a0aeb-05aa-4001-85c6-4d65447154cf", "value": "5429aac8e9440a958c37ea66ea83a461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb1e2d2-c10f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678650938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650938, "uuid": "70fa7ef4-29ae-48b1-ab3c-e57ab3f1022b", "comment": "Malware payload (Amadey)", "value": "975e0854b7caf1c700a02e355132390b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650938, "uuid": "f8543883-0c9f-4ed8-bc00-835e30b33e68", "comment": "Malware payload (Amadey)", "value": "c1ede55045cab2fb4bd5795107bdd7b4676b2e6fb84beb96ed9f7f19087ea16e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650938, "uuid": "daa0ba2d-3d14-4837-a5f8-260cf6355c28", "comment": "Malware payload (Amadey)", "value": "6b9ca471d40f77e7682a6581fa94bab6240d75de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678650938, "uuid": "edbf2c90-4762-481c-82cc-52e23af7cf63", "comment": "Malware payload (Amadey)", "value": "78dd5be9dea2384dd32d94f0f1a5f781722d871949ba219e008c2b5e2400ada42899f669286b6ce4d02e8df092bb9675", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650938, "uuid": "fb82cb3b-79d4-4602-b025-d3f3f3dc90d2", "value": "T12D35123351B03851F92B8E359A3F82E86B2FB9509E1697DF22143E1F15B01ED81E2B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650938, "uuid": "41c9be7b-46eb-42ee-a417-72fcdc0a799c", "value": "f9d4073ad2ed2d29ea4ed70de1da0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650938, "uuid": "f2972498-69f1-4452-8631-ba2ab20b1661", "value": "24576:sbzo1ZOsP++qJMbldOPARzQuTVQjg2iXxUTjc0Q189V+g:sm/2+qodlPTogu069V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678650938, "uuid": "abbf0262-1950-44a7-b893-20dc30ee0c43", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678650938, "uuid": "7d0e1855-adf6-4f35-ac08-817123ce5063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678650938, "uuid": "5cd4ae2a-2b28-453b-9cde-eeef8c2011cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae2612b-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678647177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647177, "uuid": "5e3a2243-44db-4ab9-8b8a-54f2f095749a", "comment": "Malware payload (LaplasClipper)", "value": "345815c7880d6f744c41e833981d75d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647177, "uuid": "fbc0e2ce-d25e-402d-8c76-d7c363dfddde", "comment": "Malware payload (LaplasClipper)", "value": "c29646017a3c519d4271fddf3f85b7b3c4505eed771ae68de9353ca23e35f9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647177, "uuid": "6a0ef58b-b0ff-4f1b-bd29-a34be39571b8", "comment": "Malware payload (LaplasClipper)", "value": "898b107f87f50a44a4e25c0a12849dcb45d0d257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647177, "uuid": "957837d2-b3ce-4e52-bac9-80ae8b0ad8cf", "comment": "Malware payload (LaplasClipper)", "value": "8074b9d820eb4defdc83e071859b2a016b85bbb750d792ccdfb1ced6fb133db2dff5e2314c4ddc00358883ae9dfa2d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647177, "uuid": "d02c4272-250b-46fa-af09-d1b60a2752f3", "value": "T1A644C01293A1A825F623EB71AE39C5F4272FF4B14E69B76B12144B3F0CB11E2C563725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647177, "uuid": "90477afe-1439-4e9d-befd-a7564a3ffb85", "value": "17bd8fce82b7f0d943934857d6d93a2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647177, "uuid": "1533ded7-50b8-47a7-a853-5911b15ad33f", "value": "3072:Uh1dEmMrYq4tz6kr5hiVR/eXgaOpq3VfBJFoyHZOJK0F4oZtidZ5auAd33mcglub:WtM8q4Tzif/NfpAlBJHiztqPAZWzjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647177, "uuid": "c51308ba-7350-44d4-b18b-f8c87da54b93", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647177, "uuid": "afc9ddf8-721e-45b8-9454-cc03fcb14cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647177, "uuid": "5b2fe8ce-e4de-4240-a384-3fe632fdfbf9", "value": "345815c7880d6f744c41e833981d75d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae64a73-c098-11ed-88f6-42010a9c006e", "comment": "Malware payload (REntS)", "timestamp": 1678599503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599503, "uuid": "0a51ce1b-3663-4a02-a6e1-13a24cec7ca2", "comment": "Malware payload (REntS)", "value": "cab5fc7334d83e72802bfb4150b77190", "object_relation": "md5", "Tag": [ { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599503, "uuid": "34d80a7f-2625-4198-b428-16be91bfa426", "comment": "Malware payload (REntS)", "value": "c2a9988fce8ebc0fddb0335df67f16dce0ed7b0cdfb9219ba7a0eb982beb06ed", "object_relation": "sha256", "Tag": [ { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599503, "uuid": "997f86a1-b1b2-439a-b2f2-b34a33736d8c", "comment": "Malware payload (REntS)", "value": "cad8ec659310a3284e5875ff58f1a33ce9755a0e", "object_relation": "sha1", "Tag": [ { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678599503, "uuid": "86b570d5-57b8-4ffb-8138-9612ed0d0562", "comment": "Malware payload (REntS)", "value": "b7ce9060e58dff488003f0e6e42ef37ce476878e8fb8ffbdf204d273f3dfb7cc1cd2ac2202c0e40523750fc4a1b56786", "object_relation": "sha3-384", "Tag": [ { "name": "REntS", "colour": "#98146E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599503, "uuid": "98574c3b-d27c-41ec-9df8-f4f8c8da2d65", "value": "T104521903FB460A21CFF201B025B3ADBADABBB5301F45EB936FC0541519769D0E4299AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599503, "uuid": "23268e16-3e85-48c6-8b9b-10f12e9cbd09", "value": "0ca1155cd5ba5d6cdc02d894939971f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599503, "uuid": "47dacf39-4292-48cc-b55b-983e1f6da879", "value": "192:kui32jEkL5QgZHwl8j7Mlmiocon/DjO7Rsqeirv0l4ydSaJ0vbE5pz68JoZZLW3H:TE+5VHwa7CFocs/DjZqPcNSaJ0vbrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678599503, "uuid": "62b40f01-0856-4dc3-a181-20693056c324", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678599503, "uuid": "15c2f153-9c4f-4eee-9a59-9888b420f685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678599503, "uuid": "3b911662-eccc-4fe3-8e36-04dce4a27e1b", "value": "c2a9988fce8ebc0fddb0335df67f16dce0ed7b0cdfb9219ba7a0eb982beb06ed.bin.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2258cba1-c0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678641606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678641606, "uuid": "612ec630-5268-4194-9b60-04e3cc6e529f", "comment": "Malware payload (RedLineStealer)", "value": "b5f8569499b26a02d51bb3a5b341ca6c", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678641606, "uuid": "f642806b-c307-42c6-8b1b-a691f4616a50", "comment": "Malware payload (RedLineStealer)", "value": "c2c7aa9c4e43f92f909b60f5bf65a26c91a91f023ae2e1de5ef74565f31bc34b", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678641606, "uuid": "66c85fea-5eb2-4c07-a456-c251827abc93", "comment": "Malware payload (RedLineStealer)", "value": "17aaf4f756d5eaf715039b40803512f2f1fa20cd", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678641606, "uuid": "e66d719f-c47d-46f7-82fe-359826d24d9b", "comment": "Malware payload (RedLineStealer)", "value": "582e78ced4988bf6705a147241eeefb7f1cf3376148b98d0c3e3281970bc2d2f22932d8b65b39b05e39f00ca8e151101", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678641606, "uuid": "51e35b4e-e5a8-4e10-bd80-d81c66da8728", "value": "T109262D9C726076DFC857C476DAA81C68FB6174BB931F4203A02716ADAE0D997DF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678641606, "uuid": "48873f6b-43ab-457e-b11a-2eab08871ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678641606, "uuid": "75aa791a-08a9-48e0-bbe6-e5981e9236b4", "value": "49152:V7khv8kCxr8z5HmAkmpmJ0RUAOy+ybJeYUeqNpdRPGa30:V71XTmpO0ZdbJoe8dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678641606, "uuid": "19021513-d9ef-45d7-a802-d0e3a8689c3b", "value": 4617216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678641606, "uuid": "6d33a920-1cf1-43d6-b3e1-45d0f769c023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678641606, "uuid": "d13f5cca-dba7-4249-980e-8ae354b79d7c", "value": "b5f8569499b26a02d51bb3a5b341ca6c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd27bc36-c0a9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678607184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607184, "uuid": "51de0987-f321-4e3e-8216-7cf4c74c5825", "comment": "Malware payload (Smoke Loader)", "value": "a644e6245054bcfbe531f497c728bbe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607184, "uuid": "5e3c3d43-8981-494e-94d9-0eb07149fc1f", "comment": "Malware payload (Smoke Loader)", "value": "c43ff268bb330d7bfc7729647234465bd08883a199866a3709d551725021aa72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607184, "uuid": "bfbe162f-940d-4185-b692-fe99fb2defdf", "comment": "Malware payload (Smoke Loader)", "value": "b2b810c051b7f1913e29308acaa86eca87068d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678607184, "uuid": "91087c93-f70d-4bd2-ae43-142577222f42", "comment": "Malware payload (Smoke Loader)", "value": "fd72f1ea3e782c2f9c8ddf9da83d3f8ed7c98d8b48cdff988a7fbafeadc60dc1da7da415a1c858b67cb7714311603e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607184, "uuid": "cd013b4b-a7dd-4859-872e-5f1e9c3e0643", "value": "T15C249E1373F16866F562CB715F3FC2F43A3FB8614D68A75E22145A2F0AB11E1E562312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607184, "uuid": "1bdca0a7-883a-4ebb-a3a0-068e12948a24", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607184, "uuid": "9f639938-d804-4e38-9c3a-7c43996f1a58", "value": "3072:5v9C/qKw0J4BDbqCvJHwjC8QTWqtpQy3KErdSLpX6G7+T+YI:Cq1S4BLJHuC8i7fQqKErd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678607184, "uuid": "3695cbe3-dd93-4b7b-a0db-0e8508543bcf", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678607184, "uuid": "94aedabe-209c-47df-9aed-c8576de046b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678607184, "uuid": "4379e2a2-73ee-4540-bff6-282a98ef6b87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea13e148-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629057, "uuid": "aa626b76-faad-4aaf-b392-d635bad9ff12", "comment": "Malware payload (Mirai)", "value": "f14445ff1b0d93ae333a265ab00b54f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629057, "uuid": "956b441c-f1e0-4573-b123-95711fb0c740", "comment": "Malware payload (Mirai)", "value": "c490f30aebf81badc2212ed875373e0a500703c16e70884b1bf2ed9409c7258c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629057, "uuid": "e0f2bbeb-55a6-4586-bf97-3d2f1850a8c8", "comment": "Malware payload (Mirai)", "value": "a58ede6a8df387235a3ad69cfbca7e7a4f7e2f0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629057, "uuid": "3c5f0008-f113-4c39-99f0-2cfa47d9c244", "comment": "Malware payload (Mirai)", "value": "26e2a98c4c33e08f9f9fac66bd580c5d85a17a9a53ff85137e31313c9bd465218612559b0eba3d09bf26e99d58f8f950", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629057, "uuid": "f0b51fb0-3360-4ec2-bafb-ac3877f39d57", "value": "T142E2E190D361D4D1EAD24435E72943E26624DAAFADCE31AB2C0C437E4A8A493A47D35A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629057, "uuid": "4530c667-463e-47be-b167-fb4ed5d6272f", "value": "768:KkrZj08oxqKc8SX1RwK5qDC7DGvhA5EDTB3Uof:KqToxq1X1RwKyC7XEDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629057, "uuid": "225d2cdf-17ba-4291-ac06-88b4f1db4ab4", "value": 31292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629057, "uuid": "d30bdb07-bec2-41f1-9350-690a4b382343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629057, "uuid": "09c0ce82-1b8a-402c-b92d-5f7cc36e7c7e", "value": "f14445ff1b0d93ae333a265ab00b54f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b1bee0-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647120, "uuid": "e8612eb6-9b0e-49fa-82ae-79cd6eddcc90", "comment": "Malware payload", "value": "60494980f66242d3c1b11b0477c4fa8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647120, "uuid": "9d0d10a3-6be3-4f97-ad48-ab474878ff44", "comment": "Malware payload", "value": "c4cbf62a71ead3837c2f1e83256e5e2d4e5b135c13c5e2fbf116dcfd6a4be53a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647120, "uuid": "d2e6157e-314f-437d-8016-fcf3e8722d31", "comment": "Malware payload", "value": "74e657ee4d98150696dcbb9465e0a6b244ba01cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647120, "uuid": "e124354b-3f4a-4fda-8781-d4260949dafa", "comment": "Malware payload", "value": "d33a49cb15c17f3aa4e35b0c07c83cd19b933a537e025e14c68bad9aa2d9db7d4ef7a56da7f60584bfcf24799a90ffbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647120, "uuid": "a54644e3-4d6b-423a-8d62-31e48892aca8", "value": "T142F4236D25359FFDC029C870AE9A5BC731B2F44AB8CC068DF9CF20691A46556D7EB380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647120, "uuid": "3a21d772-c9ef-4317-8319-2eea6ec9e0e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647120, "uuid": "1aa2f3dc-7c5a-45fe-a638-8537e049ec17", "value": "12288:+6dLYWqvv13doNRTlLJBJ0PDTikmpuO3wDWhnHOVue3S6sNOkMrCv99FVAiT:ZdW1OLBJ0PDTikcsWlHOVui9bRyXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647120, "uuid": "b11cbf1a-83d4-47bf-b8ac-45d4e3152267", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647120, "uuid": "7544c8d9-1120-402e-8a20-2da5d10a684b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647120, "uuid": "4f96bd12-0646-4a7a-b3ab-152e01e9f4a4", "value": "60494980f66242d3c1b11b0477c4fa8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96040f26-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648672, "uuid": "05507586-84de-425e-b191-ddad117d6633", "comment": "Malware payload", "value": "e2d0d5251464f64b0529864e747e8da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648672, "uuid": "04695990-923d-472c-a961-36ae0df4cfa9", "comment": "Malware payload", "value": "c4d55d2d887c06d8b7fa024387df5a6abcf77ca44165a23238b041161c468fd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648672, "uuid": "2a0a1a52-0004-4d58-b725-65d79832e755", "comment": "Malware payload", "value": "7ae178a1909be1b52f3a08988003abed521eae11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648672, "uuid": "89f9de51-a5c9-4829-af68-ceed5ef1d7d2", "comment": "Malware payload", "value": "2bb32f1e914d67a625177b61246cb8280006a1b2be8a356f41b0559a9d0ae9b930dc42d7177fd818b18fb17ee029bad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648672, "uuid": "a0f08338-e96a-4a79-b474-d2cf0653dca1", "value": "T1BB55D683BC9480F480FEE524CA66A213BD6134D9073467D77FA186E11B66FF86ABD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648672, "uuid": "f5d2afb2-e8d7-4085-a92a-5283bbfcb4bc", "value": "12288:lvAHiN3XmaL5058rviluXce/ODi4wOhy3di1XwTRsXLimkcmeJf9z7t50:WW3Xm/58TiluXH/OGLOhEdwXwCXO9ehO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648672, "uuid": "ba3ba0cd-ef98-4860-9bc0-8e3c7e2624f7", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648672, "uuid": "bcdc3ac1-64db-4ede-a7d6-132d1e061002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648672, "uuid": "8c46e111-dc31-4d96-a162-09d94fe3d343", "value": "e2d0d5251464f64b0529864e747e8da5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d336a671-c06f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678582203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582203, "uuid": "fab0bad7-97fe-4749-ab86-660d79a85860", "comment": "Malware payload (Mirai)", "value": "a4248fb82ab117d713189ea6a3b30916", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582203, "uuid": "0440d576-0fb5-4d9d-9427-3db3b587c331", "comment": "Malware payload (Mirai)", "value": "c68e5f350777b8307761c3744da214dc1637f00d28ad25baa9f689a67fe49e50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582203, "uuid": "79a7c0e0-5ce9-4368-8b0b-6ff18d7247ea", "comment": "Malware payload (Mirai)", "value": "6a61ef37338dbda3f058c1ded9bb923a05d18bcb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582203, "uuid": "ef524a19-77d6-4d71-96a7-7f226ec0700b", "comment": "Malware payload (Mirai)", "value": "bf12857d09c12f4907061cd2ab29a56b7231be901550b71d6225a1ae5e396d4205ad4793c8d595fd7bed40bae5ba71e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582203, "uuid": "4f7e8581-f655-43ea-b7be-ff2fab273211", "value": "T1C7E35C46EA808E03C0D61776BAAF424A33239754D3DB73069D28AFB43F87B5E4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582203, "uuid": "54e237f1-5351-4771-bfe7-e90677eca0ee", "value": "3072:axVkUp132KLa1Ug2uIOflkD//jts/EE38xGM/911of:kV/p9/La1Ug2u5kDRAEE38sM/91Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678582203, "uuid": "04d4c19b-c537-477f-a407-8b751a449c9c", "value": 151771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678582203, "uuid": "7a90c5f1-1758-4dc7-8ee4-f40bebf1b126", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582203, "uuid": "83fa70fb-9efd-4925-9a5c-cea95a8f10b6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ef63c1-c071-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1678582825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582825, "uuid": "fe3211e8-d31c-4f4a-970a-f3f1206c3c8f", "comment": "Malware payload (AZORult)", "value": "c09de1c6cc204f239312a31aa81d7a98", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582825, "uuid": "4790a14a-ff72-4b87-82f1-f0711f7f7129", "comment": "Malware payload (AZORult)", "value": "c7930d104f9f1e522835dcbd6aecd707b6bdc27ec4f34149d32b90978e4a6878", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582825, "uuid": "e6a61839-30a4-4fc9-8c37-700e8e407c7d", "comment": "Malware payload (AZORult)", "value": "218907e3e3453902cae6ef266d80f802a3e78907", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678582825, "uuid": "3d295d86-3bc2-473a-ada2-a48f40d94be3", "comment": "Malware payload (AZORult)", "value": "5b9f6bdb38e583e031b9f2517cadcaa7546f52d861b8084ee64b393962d1f1d94092a4e3bc7d02b99a40baa613869b3f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582825, "uuid": "08b72a6b-a6ea-47ec-acea-735f558d73d8", "value": "T10D140245B2E4C4F3FCF38A32197C6B676BB9A90006891A0753207F69BD62255DE0E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582825, "uuid": "b30ed217-e80f-4376-9636-69539db06292", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582825, "uuid": "8fe0f12b-5b97-43de-b435-e283bc094db1", "value": "3072:tfY/TU9fE9PEtuysbYwD/uaoCXvmSlLDNf39RwFimTz9Gxs7rWaN47cj+5GT5csD:RYa6fd1HNfzwFimH37ysz+Yd9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678582825, "uuid": "bde19b97-422a-4654-9b79-53a7e372cf44", "value": 194998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678582825, "uuid": "48f02e60-254a-45c4-868b-83769c035608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678582825, "uuid": "bf14ae8d-9bb8-4260-be0d-51a65b96d186", "value": "c09de1c6cc204f239312a31aa81d7a98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26569207-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678628299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628299, "uuid": "47588ed7-4e15-49fc-9c80-7ae76740dbf5", "comment": "Malware payload (Mirai)", "value": "1dd3d4222ed374c1e3c58c2bab2d5796", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628299, "uuid": "0ecb63ba-d9d5-4643-a090-58a0deebe03b", "comment": "Malware payload (Mirai)", "value": "c79ae417afbe989ef8bf3bf53f29a3ce6401337cd0ba96f9c82e605a01cbbdc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628299, "uuid": "b96bd807-96a6-46e8-9ad2-a0235a3fc6f4", "comment": "Malware payload (Mirai)", "value": "98fd2ed6f4d910f40ca0e745c612405ca2195fd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628299, "uuid": "b71e20dc-706a-4dda-afbe-5b1f47bdf87b", "comment": "Malware payload (Mirai)", "value": "e4c6b9c8ca7979c44734d625cd7191dd86894f69f0c68ada839aaeaeb3da79ff271d2381c1dcd4f5ee95fcc4eda1419e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628299, "uuid": "81aae122-707d-4e19-b805-4219aab03f94", "value": "T14582DF3051AB74F4DBE14435EEEECEC6A71A0BF8D0FC369316586B78994150261F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628299, "uuid": "0242cdda-7246-4710-9f9e-6414599947cb", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMadYhymdGUop5h5l3:6GV0P6+kom0tVAoNvm+to1dYs3Uoznl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628299, "uuid": "ff9107b6-acfa-4055-84bf-b715676541d9", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628299, "uuid": "33029207-4b19-4ac2-9347-e2909ba73ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628299, "uuid": "e49602a4-5890-4d14-a8b5-eb29e5a83222", "value": "1dd3d4222ed374c1e3c58c2bab2d5796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da10214e-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647069, "uuid": "b7bfdd48-8e08-4d92-b65a-b7b7b2147938", "comment": "Malware payload", "value": "f9b6aa6b0694cc878ed1cc0f7f4c9e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647069, "uuid": "2c55e913-e642-4d40-b3b4-626e59479683", "comment": "Malware payload", "value": "ca779ac00194060275a5594252378d9f9eabc015f39fc1e5d4aa54e782a587a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647069, "uuid": "281a4265-f5f3-4b84-9ef7-b46c8a739638", "comment": "Malware payload", "value": "4d1bc9799fc2307752d630ac4bff769bfe67e448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647069, "uuid": "31b06c7e-370f-43a6-81a5-4878d2629852", "comment": "Malware payload", "value": "c63e7e5c40e1d80a436d77690fc15620a6eec7850c60dd2c98cea5e2be1abec67039e5300bdd66e8620359c86f6c523e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647069, "uuid": "b43db5df-416e-4239-93a4-03fc42428028", "value": "T177F21B66DE0318F4F1761EF8065EA193E6ADE9733293806513B0E5C80953DF2E23967B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647069, "uuid": "8ef3794b-9f25-49cc-b9f4-aab739e308ad", "value": "768:hbOs+EjBO4cl767rI2jUzxoHEQLfp+Zc+wRrl6eUzyjbFCHy5b7I2lSVRR9wggRo:1Os+EDVLf9VRo7gRemy8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647069, "uuid": "dc2b99be-5540-4929-927a-88f0f14c9300", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647069, "uuid": "7ffac2ff-3332-44d6-9833-355d5441b644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647069, "uuid": "9e98ca8a-fb2f-4469-9abf-f423b14e2624", "value": "f9b6aa6b0694cc878ed1cc0f7f4c9e63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1a8f72-c119-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678655125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678655125, "uuid": "8002252b-100c-4ce3-af43-034c118675a7", "comment": "Malware payload (DCRat)", "value": "1273da64dc656db522fcaffb819502f2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678655125, "uuid": "40a2a605-1489-4471-9a6f-5df299f5d960", "comment": "Malware payload (DCRat)", "value": "ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678655125, "uuid": "7a8e4b6b-8f0e-4615-97dd-62c178ea6bfd", "comment": "Malware payload (DCRat)", "value": "16163234aeeddc9cc66abe4a142d83f8710373de", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678655125, "uuid": "de616a8a-a016-44b1-9951-81e686cdcddc", "comment": "Malware payload (DCRat)", "value": "e519c0c5f33aabf419a9c63749dfe40b9158c455e988b79057ba6ec2ee05e4e1d255ef858be6262aa36daa75bf73ce45", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678655125, "uuid": "9e03f1bb-bba4-4cc5-ad22-5be3b42c62fa", "value": "T1D5B501769D0925B6FD10BA23F9F15F4DE357080AB4F8D286DE24A77928F5AC538204F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678655125, "uuid": "e2fb0dc4-e2df-4e4f-94ca-26868f85e489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678655125, "uuid": "5d364abd-4e9f-49b3-aeab-db02ed1cef91", "value": "49152:uLF6XruXkTRNbxhv5azk9Yg7HURNz3YC095D0+bs0VQQynYIYG7GFNSsYCWqO:Q8u0TRN0RhxQst7nsFNSsYCWqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678655125, "uuid": "ffa340eb-59be-4e57-af56-4bfeedd38742", "value": 2426368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678655125, "uuid": "33f18d22-f70f-4f00-9fef-be2eb409c71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678655125, "uuid": "11af0386-c631-4c38-a554-0b3095310c75", "value": "1273da64dc656db522fcaffb819502f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d27700-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678648942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648942, "uuid": "3aaff565-d815-44f8-936f-478fd6e07651", "comment": "Malware payload (LaplasClipper)", "value": "4c4e17e243c74f62100f504abb59ba69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648942, "uuid": "db3881b6-dafd-49b1-b2d4-15b094919ae4", "comment": "Malware payload (LaplasClipper)", "value": "cb7a3b0e7d9f5be1d6a3b94db752ca363b363c1be12c3cf8a4cdab9832730225", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648942, "uuid": "e128ae54-e33d-415c-af9e-1a01149dd962", "comment": "Malware payload (LaplasClipper)", "value": "42253301cbd8324b3d10d3410453cbba73342ab0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648942, "uuid": "385bc67c-64bc-404e-af65-09e9409ea03f", "comment": "Malware payload (LaplasClipper)", "value": "5790b281f02b4b5950270369224741a08da60c7935ebb34642f20665c1c3b0125f452adaed9f4137a7441837396a73ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648942, "uuid": "c8e42296-b87c-4375-a6d3-52c6fbf96518", "value": "T14075CF844A4E2BD5C95C1D7C883428CEEAD66F528F60AAD3E9B63E0B0C71155B4D9CF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648942, "uuid": "709dbc10-71f1-4e4c-a07a-d433581cb528", "value": "5774734b3f34bc8eabac3f454f2a6852", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648942, "uuid": "6bbbb056-9c09-4974-afb8-b7b8e663602f", "value": "24576:VGKIeNtiQV0fi03jO1ekBNoiDSkIwKLdr8LUKj2Tq4CgD5fA6016x:VGKIqtDV0qKcf3rglKQq4PRA6016x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648942, "uuid": "4dea8d7a-3b66-4acb-9f88-a4596d594e75", "value": 1650088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648942, "uuid": "bfd09ab3-4b09-41e2-a39d-d6e807a4c251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648942, "uuid": "dd883ade-f5c4-46c9-a5b5-8e11092da0e7", "value": "4c4e17e243c74f62100f504abb59ba69.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4196563d-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1678648960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648960, "uuid": "68708e51-194b-4e39-8d3b-afbbfa715474", "comment": "Malware payload (PureCrypter)", "value": "b41bf59497f6d5356ffcfe9bb600b0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648960, "uuid": "4de5ef07-66f5-4d36-b968-f763f3c6be06", "comment": "Malware payload (PureCrypter)", "value": "cb866ba7cdf14c1a800c38b0c2c2670dd85d04d8f03bdec46b6cc692bd45634b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648960, "uuid": "369fb85d-804b-4234-bc79-c75eac18b8a8", "comment": "Malware payload (PureCrypter)", "value": "3279a99108871666f8353269009fe712ebe46f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648960, "uuid": "96089e60-ea1f-4ec3-8dea-d270b21ffa68", "comment": "Malware payload (PureCrypter)", "value": "2d0b6925a29a5d685d2734aa79be1c035e7a431a0e2d07d2f83c464ab3db95da9ed106b72e8981f81aa506196cdafca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648960, "uuid": "ba0f1246-2d45-40d0-9889-da050b60f68c", "value": "T10B560225239C91C9D17A9039CA864AABE7B57C429374C7CB05A0BDA93F336F55E3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648960, "uuid": "6f00f471-d615-42e5-863d-bfdef8f94e72", "value": "73f4f6b0816ebeb37e57311ea1622caa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648960, "uuid": "be47e794-0b9d-43cc-b22b-8331eb838d49", "value": "98304:teO4I/xy3Ks6JD+oule6tLnMK/ZUGrMXDzG5c0HXN3SKhC:tV44xgrwo5tLMKRUGrMTC5H3SK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648960, "uuid": "41923f78-ca33-4d17-b3bc-cd5b73dab687", "value": 6372393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648960, "uuid": "d841a940-cca2-46e4-b87e-f9ffcb212079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648960, "uuid": "971c5d33-7d54-41d6-bdef-77f9ad6d1051", "value": "b41bf59497f6d5356ffcfe9bb600b0c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea3f65b-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642379, "uuid": "5e244fb9-e205-428a-89bb-50eb2522203a", "comment": "Malware payload (SnakeKeylogger)", "value": "95500919b3ce72708c339df91f35c994", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642379, "uuid": "da6215c4-1ff0-4e4c-a542-8740264cad5c", "comment": "Malware payload (SnakeKeylogger)", "value": "cc252929bc3564bcf17ef0df09801dfff3f8d6b8e71d00b449a920ac2380596a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642379, "uuid": "37613e37-5da8-44c0-ac06-13659cab4687", "comment": "Malware payload (SnakeKeylogger)", "value": "152247a1a900cf93cb1bb202fb33634f8ac82c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642379, "uuid": "d27a8dc3-d5fc-4327-b7f8-b8331987f452", "comment": "Malware payload (SnakeKeylogger)", "value": "5102dc84b43a860f19ae6ad3457da60682702c0a4ecfc9e18fc728f83e83052823380ee326e4640b49a604144dbff589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642379, "uuid": "36e0d745-5a9a-4772-becc-59dc303c6764", "value": "T15C15AD445361AA29CBB7ABBFF5612D241378785DEEBCD6484C4930CB099DFB04881BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642379, "uuid": "433b16c3-41c2-4349-a984-1714fb005308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642379, "uuid": "0f856e29-e2fb-4c67-88b6-2bdd8a84172f", "value": "24576:KjKmIiJr0w4c3yF+TIR7uXS6HmTTn0TMzbwv:KWmIe8+UR7uXS6i0TMzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642379, "uuid": "48296f67-9797-4fde-8bac-5206ee611c19", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642379, "uuid": "cd350148-f9b4-4985-bad5-26d90d63c86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642379, "uuid": "0a9f3aff-7c61-47dc-82b1-a830ed82dbd7", "value": "Shipment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c829a8d5-c11e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678657346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657346, "uuid": "80ba3c4d-48a3-4b95-8428-312e2d6ee5d4", "comment": "Malware payload (Amadey)", "value": "dd388bbb1e887f2fc29b061ca29816cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657346, "uuid": "d2ab3472-3345-4454-86cc-e19e9aeca322", "comment": "Malware payload (Amadey)", "value": "ccafa2b7567178b3ae1e92d5fd072564ee9010530f8b6cd321f9b0378a74105e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657346, "uuid": "62fe829d-fc70-4b5d-aa68-cbe9934d83f0", "comment": "Malware payload (Amadey)", "value": "373b91421192c91a44867345657097282cb92883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678657346, "uuid": "2867451f-409b-4c2e-b145-9ba2d70baaa3", "comment": "Malware payload (Amadey)", "value": "447e80a43ba6f71d5e8b9017eed4514259c1e51ab0ce67a656a7d281a0b383694e9d53afedce1ff19b94935feb8a5c1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657346, "uuid": "c8955419-cf4b-413a-bae3-532ae31492f3", "value": "T17735123351B03851F92B8E359A3F82E86B2FB9509E1697DF22143E1F15B01ED81E2B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657346, "uuid": "48bb30ae-61f4-4d37-b2b7-161e6007e796", "value": "f9d4073ad2ed2d29ea4ed70de1da0d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657346, "uuid": "bea35cf2-9ef4-44bc-88ba-9924c3ddacb7", "value": "24576:Ebzo1ZOsP++qJMbldOPARzQuTVQjg2iXxUTjc0Q189V+g:Em/2+qodlPTogu069V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678657346, "uuid": "47589a12-4a28-4d76-918c-d8e478f6e241", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678657346, "uuid": "a7f2d529-ed39-4c1e-b1ac-4ba47b5e5de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678657346, "uuid": "59326c88-f010-4647-b51e-f908ce825f09", "value": "dd388bbb1e887f2fc29b061ca29816cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2ed861-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Autorun)", "timestamp": 1678621333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621333, "uuid": "c16eccbc-ffcc-4962-813b-7f6d7e7e531a", "comment": "Malware payload (Autorun)", "value": "456f470b47658e843b64c734bcee1fee", "object_relation": "md5", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621333, "uuid": "60f3215f-47b1-48b3-a5c4-bb9825a74420", "comment": "Malware payload (Autorun)", "value": "cd0602c372eb6278c9931f4eda0b2b5b0d3b8b12d65805e75387ab2e14c54a5f", "object_relation": "sha256", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621333, "uuid": "4a4d4b54-5c8d-43e5-81ae-d03deaf1e19a", "comment": "Malware payload (Autorun)", "value": "26bbed3b02741707005c1cf4be3f6b64925c1830", "object_relation": "sha1", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621333, "uuid": "d07cd965-0838-4743-818f-6b6a1c009a10", "comment": "Malware payload (Autorun)", "value": "a4fe7886a39893ad62ad42a8218976e22cfe26cf4d9f0d80c735d33e5d97b579f2580c3952d58b4c1cdc5986c12c7262", "object_relation": "sha3-384", "Tag": [ { "name": "autorun", "colour": "#301521", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621333, "uuid": "48ce93f8-0394-468e-8361-46d9497014f5", "value": "T100F58D50F640D8BAF3D69974541ABF290CE17D120B822E4E609DBB181FF0FF1E9B2695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621333, "uuid": "ed67bb24-e431-47a0-bf3a-b74417a11958", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621333, "uuid": "d4aec349-3926-408e-b077-b112199508e5", "value": "98304:9E2R1IMGkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJs:9nzI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621333, "uuid": "53271364-776a-4568-9317-462f5751dd60", "value": 3377289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621333, "uuid": "daa49a54-7954-446f-86a3-2ef2eea591a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621333, "uuid": "1646a241-47a3-442a-9096-b6c895a14a03", "value": "2023-03-11_456f470b47658e843b64c734bcee1fee_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022ae320-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1678648854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648854, "uuid": "9c9a564f-4997-4834-99e3-b7f4ad62ac3c", "comment": "Malware payload (Phorpiex)", "value": "3560792f6c31f4a356405ab3823e73db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648854, "uuid": "63e78310-24a7-49dc-bc3b-9f83f9a1b419", "comment": "Malware payload (Phorpiex)", "value": "ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648854, "uuid": "9ceebe4b-fc37-45ee-a43a-39e8cf8e8499", "comment": "Malware payload (Phorpiex)", "value": "e18e31539269df2c0fc338858a752084a94d53f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648854, "uuid": "921f1f0e-48c7-4488-8024-e1937d42f451", "comment": "Malware payload (Phorpiex)", "value": "57623a1d37d23930057e9f51aef1ab6d15c6a00c939ba9c68b0a023e2d03f60fab8b6f71b78d92e50864a655be5afc62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648854, "uuid": "329303e1-a903-49a2-8aa5-e8ae23fde3a3", "value": "T19F731950F2C0803BF0F681FFEAFF52A91A1C9FB4530594D7A2E1649F5A246C5BA36453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648854, "uuid": "4c8a10eb-7f65-4477-8e00-a5d792aa3ac0", "value": "dac8ae7c837e7fe3a3ea62e0b6800155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648854, "uuid": "d3d4d863-fb19-4f07-95a8-5303ad8a5b87", "value": "1536:gd3Mz8GTuBVLcC9Vv2oK+52KdqlfFdIueeeeeeeeWeeeee:9wGcVLHDv/xTqlfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648854, "uuid": "9e31dd4f-656c-42c8-94b6-13cd2ae80cc3", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648854, "uuid": "362e54ef-a866-499f-8958-783d3a90e474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648854, "uuid": "e78eb71d-572f-4f68-b861-b3c6067d3995", "value": "3560792f6c31f4a356405ab3823e73db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86d5fb5-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642288, "uuid": "e5f9078f-db78-4e54-a783-276fd9e6bfed", "comment": "Malware payload (SnakeKeylogger)", "value": "42e2360fa56ddfa0742c3fc040c86482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642288, "uuid": "e389eb58-13b2-43d7-8679-ab38818a16d8", "comment": "Malware payload (SnakeKeylogger)", "value": "cf7e2f6b89de3813f871454be055df84225f3547e63db09cce014493e919d786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642288, "uuid": "3978d95f-b6e4-48f0-9caf-05bc28fd6462", "comment": "Malware payload (SnakeKeylogger)", "value": "3d551662d34f1a930100022aca7a691945c7032c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642288, "uuid": "4868f59f-eb06-49a8-a886-852425a89689", "comment": "Malware payload (SnakeKeylogger)", "value": "7d8192f1e0fa4daf9d3abebae5cb001886c8875e825556eaa291cb5df52907777f43bfb41ccfbdb1540ec21158d8af4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642288, "uuid": "615b137d-dfa4-425c-bef4-ee20b702a5b3", "value": "T11E755C302AEA501AF173AF795AE875A6D96FFEB33707641E105133460A33A82DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642288, "uuid": "4d5a0c5d-3a91-4e79-acfa-8bac6eb2fc10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642288, "uuid": "6fee0ab3-356d-4eeb-babc-d2d308a0b533", "value": "12288:DP0wjgL3tjrBhRcG5u/8/gBM8riiWbjZcillbUsbUZI+gD8g2E33sNHRPS5LjgfC:wZxbcZcLsbxbcZcLspH6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642288, "uuid": "bd9ceb5e-8111-4ebe-ab34-247dfea54bfd", "value": 1614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642288, "uuid": "93a57890-f5f7-4ad6-9b20-0a1899508c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642288, "uuid": "e8df97b5-022b-4e03-ac19-44a67f856f95", "value": "42e2360fa56ddfa0742c3fc040c86482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5edaf9f-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642283, "uuid": "9eda718f-aa42-4888-9d1a-3a95e49cb401", "comment": "Malware payload (SnakeKeylogger)", "value": "046df19971d8e042fe9c24b65500f127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642283, "uuid": "99f8a156-fbcf-4cb5-b4dc-a8c5ce997d65", "comment": "Malware payload (SnakeKeylogger)", "value": "d06c234f275c8711a0fd97626d24880f2cf898fbe994d26aa1e0a80c7b0c29be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642283, "uuid": "2c6b9b57-0aec-43c5-a24d-a7382c45680e", "comment": "Malware payload (SnakeKeylogger)", "value": "291298ba63fd26e86c1a1032f83e6d5d40b38d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642283, "uuid": "acc4324f-7358-4dc0-99fd-5e7c1c4dfff4", "comment": "Malware payload (SnakeKeylogger)", "value": "47cbb21ea4d477c4be777748b08fa287cf18cf6cfbb2509b7a163826d0ff153a86850ab40926fb44107a1f81c7aabbbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642283, "uuid": "e75d78af-574b-4910-bc16-c0a40480de0d", "value": "T19AD3391D67F8D800E5FF99B705B15212C779BC42092BCE0D06D2F5592A7DAA08E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642283, "uuid": "fa5fedd1-2a3c-4b31-8666-14e0c9200e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642283, "uuid": "962f588d-ceb8-4838-bd8b-59c60ed5dd05", "value": "1536:MYbc2vhEOE9uJPLfQpc+vBUFrlYYGTk9ojZX9FvOE8MFIYsNrb/U0XsLviCpiOWt:MYbcQrKUfQOGTmrb877ikwBBUjFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642283, "uuid": "d642b51b-03b8-4a9a-91b5-eba0edbd73de", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642283, "uuid": "5690723d-e06e-46e7-bdee-fb4e1a32cfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642283, "uuid": "d55dcd92-3f12-4f72-b222-60f51916a3aa", "value": "046df19971d8e042fe9c24b65500f127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44d0461-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629074, "uuid": "e55473d1-a589-4188-a007-1e320879456f", "comment": "Malware payload (Mirai)", "value": "d778410461ffccbb8331b65153f770c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629074, "uuid": "df325a48-fc10-433b-b2c0-e287f1a7abc1", "comment": "Malware payload (Mirai)", "value": "d0be07db47b10c15a24c47d193920e6d592b4f4cec924c4e37e96b61480ce795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629074, "uuid": "927fa040-83b5-4c6c-b44f-c06796a566cb", "comment": "Malware payload (Mirai)", "value": "91ab7ac51d8a4d183c5583fb2d1749da4d67abb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629074, "uuid": "d67d9850-d153-47f7-a7ba-fc43de00837f", "comment": "Malware payload (Mirai)", "value": "73730749abfb648f08eadd48a22c6b844c69aac0701702991760a9cee99983e60fb21c8696208c152d1a31bfda27f979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629074, "uuid": "dc8f16a4-7781-47b9-a101-4ce2898eca18", "value": "T11EF2E1D156E987E1F9BD9173082FB54A1858BF2D415D3E7AEE883D6E2C07F0D28B8441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629074, "uuid": "92f018db-d248-46f9-9903-d452a77c5157", "value": "768:TAqA+P4XpOvFbvUVHgg4BR5xZNE/l7kgo9VYnbcuyD7UfyqA:TAl+P45iYVHgTR5xZc5kSnouy8qqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629074, "uuid": "3916f655-f1e9-4842-8123-b5081cc0538b", "value": 36476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629074, "uuid": "41fcbb1d-f79c-4647-b789-b9017de09aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629074, "uuid": "35fbbefd-4082-4988-9f55-c13e1e6e7b8b", "value": "d778410461ffccbb8331b65153f770c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ad08da-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678633957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633957, "uuid": "a50c2a3c-a9ea-4faa-8758-2581fe14324b", "comment": "Malware payload (RedLineStealer)", "value": "b8ceb3fe3ac35c5806625e6f449f0c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633957, "uuid": "00d39849-f852-453c-9e8a-c4b9e4a10944", "comment": "Malware payload (RedLineStealer)", "value": "d20139374ce899b5b858babf70c993c6d97ef8cbed7b8fa9e98355e97bb34e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633957, "uuid": "634e460b-fd4e-46e5-b934-c38aa6f85a91", "comment": "Malware payload (RedLineStealer)", "value": "10b0707baa5c20af4ef873f244bd254819b7906d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633957, "uuid": "89567d22-9e4d-4576-b687-a53923cde3ae", "comment": "Malware payload (RedLineStealer)", "value": "61e426542e81a0bbe57503bdf9cb1dba6f40e59c8102fa3d1f8e4fa6c04e84d82a0ec55cd723a8efd40310417d328d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633957, "uuid": "4c2c7fe3-c0ff-4abb-8074-97d30ef19164", "value": "T126A4F11273F0A821F577C7325F3FC2A4666EF6614E68636D33485A6F0BB10E1E562722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633957, "uuid": "08b5be6e-85e7-4363-ba0a-c12df281e1eb", "value": "3d4c16eb468ed7fad4115f689c8d6af3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633957, "uuid": "fb166c29-5bbc-45f1-bc78-d2a84aa74c56", "value": "6144:HpqCfjcHwMbLU3dw4QHVa8GcVCZMh9jbMxCC7Nx9ipAEzmq4JerYh0K:HkAkBbQ3EHkpZ+9jbMMC7diiEZ4ArGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633957, "uuid": "f5f04d9e-5932-4e65-af19-c3d25e38d61f", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633957, "uuid": "8b388c85-e700-452c-b539-aed9c106fcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633957, "uuid": "c387ee49-2606-44bd-88ff-426ac95326c6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38b49a8-c079-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678586418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678586418, "uuid": "3b38170f-3758-4ef5-93ef-f010dc52e374", "comment": "Malware payload", "value": "08dbafa61a2dea9a0aa57d4cb8b70a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678586418, "uuid": "0d09d25d-4b4b-4dd4-bf0d-5fdebf8e8f98", "comment": "Malware payload", "value": "d2a06c261eb6864cbda29fdf43d89a167de67b1c585affa83e9852f91275ab28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678586418, "uuid": "59957c2c-1c2c-4084-8272-cbba8b1614b6", "comment": "Malware payload", "value": "5a6b6cd33f76dbdce912fca1199b297ef919417b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678586418, "uuid": "82079373-f0a6-4802-ad03-133f5bc6d68b", "comment": "Malware payload", "value": "30fe5f24f6b2ea1617722ae7e3aed24519ac60a05d0e901a8966dca2805d010ffbd1ed66f08ab2b2d11ad92431cf9690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678586418, "uuid": "bf1ef5ce-672a-4905-92f1-c8249f3083c4", "value": "T149373943F7844A9EC65485798AAA53923371FC651F27E3C36B01BA3D2CB27D4AEB4740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678586418, "uuid": "2d7a62ac-bd38-4a7e-9ebb-57dae5e62cd7", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678586418, "uuid": "07655b3a-5ca6-4e73-969f-07ac98c077ae", "value": "196608:yOhz62YJgijbqmAxRmIydWzGBNo2P1S3j7OjH:9qCihSRodWePP8T7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678586418, "uuid": "42949834-f1ce-4cdb-bb24-288c7ef88ee5", "value": 23343918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678586418, "uuid": "7bfea21b-f1d6-4c56-ada5-38a4de28bb2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678586418, "uuid": "fded55f2-12ba-4482-93d0-f945063d2a13", "value": "Nisha Adhikari video leaks_190000100000319135414_9131CamerahotelBig5000000000000190010000912159453157777414991111965512366948974867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7821976b-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648622, "uuid": "738a2496-5ae9-4931-bac5-1d183cdb7880", "comment": "Malware payload", "value": "d4a8c86cf5ce87c41b6b3a729cfc4e41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648622, "uuid": "4c4c100c-0bfa-4bed-90a7-068b6287ae9a", "comment": "Malware payload", "value": "d7558c94c93cd0da15df3b87aaa2ca8ecacf8f2ed0b6523e325e9ac118d1d768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648622, "uuid": "b704f04c-3f76-477e-9bba-c698aa056467", "comment": "Malware payload", "value": "6226cf1895bda222ff4cfda5fab1a310586506d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648622, "uuid": "c4e9c55f-1ba4-481f-bb8a-197e941c02f8", "comment": "Malware payload", "value": "a7e7cdb9d9614d62d756bde3fdbae9cf915b7d5ec67118d5ea62c16a0b1a94d8b923b7b6243f4ebc4a94efe8e61bc4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648622, "uuid": "d9f507a0-d652-4bf3-aa72-58977ec3b73c", "value": "T1BFF533AF7000F4EFC9512BF56303311BAEDEBC8D90C8974976D8C77B11A489067999AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648622, "uuid": "aba130af-fe44-4c13-adfe-91da7404ef00", "value": "98304:gh9duV5KDkv1u8MtpVUYxNl+MhJyhc0i2m:uIVQDkv160ENT9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648622, "uuid": "9195289c-9e0e-4443-a5a6-b96403f53d44", "value": 3403648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648622, "uuid": "fa33250f-4cca-4732-9c28-5564ef64767f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648622, "uuid": "102b382e-dc30-4ca2-848c-6ca512b62b7f", "value": "d4a8c86cf5ce87c41b6b3a729cfc4e41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ebd21e-c09f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678602711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602711, "uuid": "02e8b6eb-71ed-4720-af95-26ea495aaca7", "comment": "Malware payload (Smoke Loader)", "value": "878d08444acbf1df037f2e2eb738b07e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602711, "uuid": "a0adeb51-886a-4402-aad8-9bcad7681402", "comment": "Malware payload (Smoke Loader)", "value": "d7a1f3fd70a4c8cc0311dc0847247277c38ac4fab4bca6bb6a94903b87f2cbf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602711, "uuid": "bee78f2b-30dc-4de8-87da-42700d318521", "comment": "Malware payload (Smoke Loader)", "value": "73005b050a22050b133ce380ef6b4e22903cba7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678602711, "uuid": "d9734323-e531-4f5a-9da1-c64b0341521c", "comment": "Malware payload (Smoke Loader)", "value": "5ea286a8b9c565fcc80d8dfe9e7553b70b616b3ea93b25f8702c04813d9397882448468c0dd54a947e9960eae526efd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602711, "uuid": "4c48eb91-d0f7-464d-bc6d-ef37bcb56f9d", "value": "T1F2149E2273F06861F677CB315F3FC6E42A2FB9614E6967AE23045B2F0AB11D1E522351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602711, "uuid": "0d650169-3116-41c8-93b2-b73ee190d271", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602711, "uuid": "aa79d4e0-f42b-4409-957e-d679f2552f20", "value": "3072:zsiqtrZ3mw0RqqlEKHb5xqfdemxBjc7TX6D+TIYI:1qVtmwmEIb5WdHfjc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678602711, "uuid": "d6cfb6d8-8304-4895-b7bf-220fac1c6b51", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678602711, "uuid": "263b54f3-33a1-49de-bcbe-345e5e6f6da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678602711, "uuid": "73716a72-f64a-4705-98d5-d57890ffb7a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8a81b5-c11d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678656849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656849, "uuid": "4f5e007e-4c04-4f11-9266-44589e07febe", "comment": "Malware payload", "value": "5cb120f946b9000ff759f0df61aec241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656849, "uuid": "374a9e9e-0fa4-4d86-82bb-e40335e150ff", "comment": "Malware payload", "value": "d863273e0dbb3afb59600dcd3c5c60f1128fddcbd38757650660b3d10b6a9ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656849, "uuid": "f952c394-17d6-4235-af07-fb212922f0d0", "comment": "Malware payload", "value": "49a789fd48a8c79e8e5d6ed54e56934a165585e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678656849, "uuid": "cb944c7e-7529-4247-953a-120b04774bd1", "comment": "Malware payload", "value": "aa2f89de115497aaf8eab1b84e47178a727a1b97163657073198cc0766f521adfdc3c4507dbfdb3a7fb4cd55fc6f0fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656849, "uuid": "79ac64a2-a5e3-4968-b9a6-f75759ba1981", "value": "T1D35633264576B3FAD5F938F7165CECBDB162EAC0D69AC570E0331840223AC9391A6E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656849, "uuid": "ab450a14-08db-4a0a-be24-700423ecad75", "value": "196608:W9x9G9JpwtykN94/4KdH3WPdv16lzYrcttP5Kzj:WxRtykbuH3+x162r0Pkzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678656849, "uuid": "556349bb-bf0f-4498-8d54-058bc1c3d7b4", "value": 6381568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678656849, "uuid": "e301d984-7654-4a64-8a04-7e2439900e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678656849, "uuid": "24381de1-716a-4b29-8d0e-1c89cb71a429", "value": "SecuriteInfo.com.W32.Damaged_File.E.gen.Eldorado.20763.5285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2836ac67-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678633885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633885, "uuid": "d978b93a-41c4-479e-bb18-3be300cff02e", "comment": "Malware payload (Mirai)", "value": "166efd2bcf415cc601d26e1e06a03303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633885, "uuid": "d74acc1a-7986-4cd6-9b72-3d908f3ed66f", "comment": "Malware payload (Mirai)", "value": "dccf079eee0c5862e6da615efaeeedfcde187beb901b698ef10170063261e1f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633885, "uuid": "966b4b37-482d-4601-a654-95bd772c141b", "comment": "Malware payload (Mirai)", "value": "42184fc101d4d7c28f51e31f693019ecc7a8543a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633885, "uuid": "22a08498-317d-439e-a34e-32ed0a818bd0", "comment": "Malware payload (Mirai)", "value": "c6e4d3c140c5560cc910d61007fa3d656f8346c3213f1984dd77c509603c7ba62c40a52da000062fe0163b926303dca1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633885, "uuid": "01b8fc7d-b0eb-4144-ad2a-79d05ab7aec2", "value": "T19AF2E070C6563BB2CA71C97BDF57C2811AA312BDF871B3376160C7AC5A32646126D28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633885, "uuid": "dd412b65-83d5-4ff3-91d6-d44fc1bac517", "value": "768:YZk9tuPomYpzHjKWlfJktzdOUJ1wTowZCQBIRs3Uozk4:C4uWpDjHBJktzdrwtlI8zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633885, "uuid": "cc0c82df-dec1-44f6-84b9-46750f6126ae", "value": 34820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633885, "uuid": "3cd4be48-57a6-478c-8970-b889ffa4adf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633885, "uuid": "f99a7743-443e-4dfd-b9d7-4267d0dd4ce8", "value": "166efd2bcf415cc601d26e1e06a03303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44a30de-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678648723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648723, "uuid": "3b731876-65c4-4ec5-8ef2-4535a4f79ac6", "comment": "Malware payload (Smoke Loader)", "value": "4be996d41c1828980f8f1dc218249896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648723, "uuid": "4679c7ab-4d6e-48d6-8732-2e58266222e2", "comment": "Malware payload (Smoke Loader)", "value": "dd45680504395a404c346c97089f3077d376f7adae2517a62fe0020c73806981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648723, "uuid": "c45459b9-321c-427a-8f96-8c12e5736745", "comment": "Malware payload (Smoke Loader)", "value": "b65dd3368d20e04d6bb02031be1f784ca37278e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648723, "uuid": "2ef9a121-e5a3-4eb3-837d-e3c6912566ed", "comment": "Malware payload (Smoke Loader)", "value": "808d3e68d6bfb9604a3cf3f349747934a8790d379ac0e5ba37f06907251daa2d80e945fe1d91b56efb39fb7e873b5304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648723, "uuid": "28f5c582-0268-46e7-a075-bc780bc7032b", "value": "T158449E0273B16821F567CB325F3FC2A4AA2FB521EF69675E23045B2F0EB11E1E562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648723, "uuid": "9b010af9-3cbd-451d-b931-d6f438c38ba2", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648723, "uuid": "d5f88b8a-e39e-4878-b95e-2a6b415085e8", "value": "3072:fkb7qg2MqRWoliM6YU9ZNCM7Ll2SMCp3ZvJsmOQ5j1dpX6n+TDqYI:6qVMqRmMTUxjp/b39Jsmpxdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648723, "uuid": "659d3759-9126-4f2a-8235-f9df36d1b5fa", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648723, "uuid": "812c7103-b38d-40b9-a916-935622dca2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648723, "uuid": "8041cc6c-bc3b-4b21-b74b-8757a8300a2c", "value": "4be996d41c1828980f8f1dc218249896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91061c3-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678647013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647013, "uuid": "aa7d1f77-e1cb-41b6-b1c5-2db5301c840c", "comment": "Malware payload (LaplasClipper)", "value": "a5738bf405e2d273310bb9eea4275555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647013, "uuid": "025592b1-2a21-4ad8-ab43-4cd7d6ad74cd", "comment": "Malware payload (LaplasClipper)", "value": "dd9b8dbe2a4bd2f65eab24664fe843325690731cfeff8efa5aeaf24e6565fe69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647013, "uuid": "c53969c0-5a82-4827-9d28-17ebde51e98c", "comment": "Malware payload (LaplasClipper)", "value": "d582cad53d78f41f4d2ea814e083e5291e59820b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647013, "uuid": "17f4ac9f-4663-41ff-8f98-23703a4cf4ef", "comment": "Malware payload (LaplasClipper)", "value": "4e744586ab8913211736a8307efccf917cc8f2cd5acb95aff389639eca2d0cd18714f7fd8c3423c477ee83ee77cfeb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647013, "uuid": "65d464ae-e59d-45d9-8d67-6b0e13969c2f", "value": "T1A744C01353E1F825E762E771AF3AC2E87B2EF4A18E79765A1204D63F0CB01E1C562752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647013, "uuid": "e6b34059-9eb1-4e37-be96-ea63c98bf02a", "value": "858e6430e3652e12355faa06f640c4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647013, "uuid": "dfe317dd-8717-4df5-8810-43fe02d4a911", "value": "3072:4A9FDcQxP9TF9CeVQtVVO/gCyVed1XCCyj3yvKJIvVEhSZ1hvJzmCpZmcgl11ycW:lFgQxP9T6y6V7U453yyIthZnlZQzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647013, "uuid": "2e7cfcce-966f-4f34-8347-8c113bb8e90a", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647013, "uuid": "a6787663-3390-42c1-80b5-da976b9742a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647013, "uuid": "8d568e2f-af16-40c4-9cd1-de18465b1579", "value": "a5738bf405e2d273310bb9eea4275555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc6dab1-c0d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1678625120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625120, "uuid": "397e8086-d126-4d68-842f-1b070d94ed11", "comment": "Malware payload (CryptBot)", "value": "5596e51f79b311815847339e9f315693", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625120, "uuid": "37d01ed4-3eee-4106-82d6-af54a1f1214c", "comment": "Malware payload (CryptBot)", "value": "dda5577213a6db2971ff9214f79623c5e514a22810be3ec5368c837fadfcd5ff", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625120, "uuid": "be80c737-2bfd-4770-b0f9-7331b91c6d7c", "comment": "Malware payload (CryptBot)", "value": "cfbd2b67821369c129f1cc069d7132758d51c79e", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678625120, "uuid": "70765981-047c-449e-8289-73b9153053ee", "comment": "Malware payload (CryptBot)", "value": "6fc3ea540a16e539cb57798c7cfce4b3cc753a6373bbda8a8bc398c77beb8372a88abfcc39868ff43686dbd603398969", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625120, "uuid": "dc42b2f8-9796-427b-b41b-6ff9ecbd354c", "value": "T13F0502207A93C23BD02112B989BD9535226ABE705872B0DB33D57D3EF73C892E635791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625120, "uuid": "6c2256e0-783c-4fc1-ba15-35f019f50a01", "value": "12288:Rog6sEhSGnGQFcKyRqgklJqqvLBLxDrVoDXo61iqCkfjk0R3h54sRt/aJ++DPRX9:qIJqgklJqqvLZxdoDXziUo03NG+apZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678625120, "uuid": "28f9c8b7-f901-4143-8643-abda644bbd39", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678625120, "uuid": "e0c1d39d-64c0-4275-8d88-7917df5a1fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678625120, "uuid": "832daade-e30d-4ad2-9071-e781f157816c", "value": "5596e51f79b311815847339e9f315693.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c65539f-c108-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1678647583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647583, "uuid": "069eeb3c-bea7-4637-96ec-c5585e518219", "comment": "Malware payload (DCRat)", "value": "0c6e27ce495388c3e75bec3312820a4e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647583, "uuid": "eb35af62-a808-4343-a090-c03722d3ec58", "comment": "Malware payload (DCRat)", "value": "df5958a9823d8990969a3a03a628e3e50eea124f457c38367a28202d3f431407", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647583, "uuid": "0ede1bc9-7420-4f5a-90d2-5eb0ce876114", "comment": "Malware payload (DCRat)", "value": "72bd76402062a7b974a986cb2f60e87a54ea0ec9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647583, "uuid": "633e13f0-3c3f-4be9-abe8-27011166fd80", "comment": "Malware payload (DCRat)", "value": "55eea53a4644991b7b831bd1c74a3f19f67338f8065952dc5c9f20a94935d1341235e932d4dec1b6e927bb7f8a82b663", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647583, "uuid": "e9e68536-d005-42db-a57f-26ab188edbaa", "value": "T1ABA31F539AEC3CCBC038A3B077BB93D4D72EDD95A0A2C11E96D00295D8BD52779227D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647583, "uuid": "282ca626-4f99-417a-b5b5-7eda476a3815", "value": "7dc47ded6106d81622893b0c8cbea2be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647583, "uuid": "06e0441e-ddd4-4aef-a321-fd2a76343dc2", "value": "384:dNOXQvuKZPPm2gZ5HSLUh3Azf8o99Sjvb99Sjvh:f9vuYPm35ywh30v9Sbh9Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647583, "uuid": "269b8f78-fc46-49b7-87d5-f06cf561c366", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647583, "uuid": "61180078-5a67-4089-a9f4-784d3003886c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647583, "uuid": "5730d10b-43c3-4493-981c-abcd016b7728", "value": "0c6e27ce495388c3e75bec3312820a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a888a6d-c10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1678648975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648975, "uuid": "bf20b151-9fee-4655-a143-8c49a95a7aad", "comment": "Malware payload (CryptOne)", "value": "a7f29ef7948a9ba896808c41c6137f05", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648975, "uuid": "a1a90fe9-0e55-4693-8a0a-cf3d76854553", "comment": "Malware payload (CryptOne)", "value": "e07ef6e462ec400c8749c7718968488d3b4428dac171aea3e3fd2d6fca5cbd1f", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648975, "uuid": "cfd23b4c-e1f4-4d54-86fe-8317f8c0ce9e", "comment": "Malware payload (CryptOne)", "value": "7548e913b18d4dc1a6c6092e0bda5eb7042215e2", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648975, "uuid": "9ed0f0cf-1cfd-4585-a218-48fbdd1b2520", "comment": "Malware payload (CryptOne)", "value": "7bf6d19880f2c108cae5480ca0463da02944c97a0c2d7d6f671f0a772b2408dd5083faaca4345c69befcce25e262fba9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648975, "uuid": "88535580-b695-45b4-be23-e3597b4e3211", "value": "T1476512223AC18470E8771A3506E1D771AB787D3067358BDB53546B2E9F306E0DA38BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648975, "uuid": "84f2644f-b113-45a4-8d2c-995fb6dfadbf", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648975, "uuid": "319fbe54-c691-4c97-80a2-cd0c8c7a6b2e", "value": "24576:pLllLl7CEt5/ULLtOXENgXB2XQP0GXOertqubikOZldhmnA7IDyx9:BllLt9U0qgn0GXOeroubikOZldh5ZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648975, "uuid": "295d575d-ddaa-45f6-9138-cd1602c712c9", "value": 1462140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648975, "uuid": "980b5362-14ca-49d4-a396-03d4c457f1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648975, "uuid": "bf5ab4b5-9806-450d-84ad-2e26d78628d3", "value": "a7f29ef7948a9ba896808c41c6137f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d41ecf-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678642798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642798, "uuid": "843ded86-3113-4e79-9753-01d0cb275e83", "comment": "Malware payload (Mirai)", "value": "1088c41c4deac15baeacfee5ee718949", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642798, "uuid": "3e544281-bbe9-4b8a-a4dc-4012b70295d8", "comment": "Malware payload (Mirai)", "value": "e2c6278ce35eabba6e73288d7160439575d3d264f9026e7d5e0633b7394dd463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642798, "uuid": "6129111e-0681-48ea-99f8-9783b6b7da45", "comment": "Malware payload (Mirai)", "value": "731519b05feec192573cd0cf6a806ee792c9b66a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642798, "uuid": "9cbfbc90-9dee-437e-90c3-dd2d875d6f2c", "comment": "Malware payload (Mirai)", "value": "8327d2bfa3452573a330873c9d5e6f01fc2c8b64b93800463bf4b576629a3cd6cfac0c4bb888316648b5efe7dbf8de3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642798, "uuid": "0a829cd0-9a2b-4a8a-9b5d-f9eebf5a9acc", "value": "T1EBB34B21B9791E27C0D4A47A21F78B21F2F6478D25B8C60E3EB10E8EBF655503607AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642798, "uuid": "44491f36-075f-41b2-bc6a-1cfdbc3ceb59", "value": "1536:U4EH8SyfKmnAWg/QcaKDOpt49wHtrWE71r5Qt3DLtet0DQrObmJZIWE:UjPyim8DOtYmdWS1FQRQbrObmX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642798, "uuid": "09e736f1-f50a-49d4-9588-6bfb45ff7170", "value": 107900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642798, "uuid": "71a99ea8-1709-4be1-a8bc-393f5f312279", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642798, "uuid": "6b202eeb-e15f-4fb3-9d8e-eeeaed0bd3fb", "value": "1088c41c4deac15baeacfee5ee718949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa97abf9-c108-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647848, "uuid": "9a1820bc-bfb0-4a48-8cff-baf44acc2a43", "comment": "Malware payload", "value": "07c6c4939da7bbec658373a1a43f1d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647848, "uuid": "5f240340-c4f7-417e-8006-f35fc1157e89", "comment": "Malware payload", "value": "e33c16cbfba04a22bc370712c308677d1e12f1eecf2a23d08620d8e8569b355e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647848, "uuid": "55f05dfa-9e13-4b50-91d5-0951efe2bf65", "comment": "Malware payload", "value": "437a0f05111c2d6e650f942741e174cc3cfd290d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647848, "uuid": "4ec3111c-2fdf-43b3-a38f-c7116dc357fd", "comment": "Malware payload", "value": "70cb730c6981496f485be914a8cc09c25cee65216cf7f28ba7fc99892b0ae708b397237188dac77248809aab04e0548c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647848, "uuid": "2482da70-e9ea-4c9b-9b2d-1e0e6709db00", "value": "T1500401543BF0C5F7D8A14B700A3F1926EAE6E41238B45B0B03119E6D796B3D2E91F762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647848, "uuid": "bce4da3a-54d4-4575-9fc5-0b6dedcaf43a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647848, "uuid": "a28b85fb-74b5-4959-933d-9bae959514b2", "value": "3072:HfY/TU9fE9PEtu6vbl7W2g1fBx2FUy6nKrj/ZE1TeX/lHHOoYJXmSulcN3o/HN:/Ya6mFWv1fiFrbrZETeX/lHuXJXJuCNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647848, "uuid": "6e4f3334-b9cc-45c1-a680-b299e1975c00", "value": 177527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647848, "uuid": "fe3d189e-eb96-461a-ac39-e0a4f0b19067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647848, "uuid": "43bfc070-2144-432a-ab84-6dad6f80b5a4", "value": "07c6c4939da7bbec658373a1a43f1d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbd8a90-c0e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678632609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632609, "uuid": "485b05be-e5a8-4723-9155-8139638676c8", "comment": "Malware payload (Mirai)", "value": "c5a6034ad42af2ead7d9d4064a4e6693", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632609, "uuid": "d6bfd167-1fad-42bf-8cb5-5b6cdb349d1a", "comment": "Malware payload (Mirai)", "value": "e39d8b2033f37a3f13226b956be9adb6943f408e56a32a9d131b32d6a6ed39fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632609, "uuid": "16119b19-1e0e-47b2-9eef-3d565d72cc1b", "comment": "Malware payload (Mirai)", "value": "e45d5c00e2303ec5a83df590da1ed7ca36d362dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678632609, "uuid": "f5c397af-b2f6-4e2d-b128-375d28b2a2ca", "comment": "Malware payload (Mirai)", "value": "a8609189536653f87607e582daae1b2bcee0dda0615dfb2963a69c5fa6e621a163c25477e1bd64781dc71e9aca0918d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632609, "uuid": "d7a9072a-3097-46c0-9ae1-28d220d95b65", "value": "T13803E111F35594B5D49221FACD39C48F37432EB6F6A02A920B496379B44449CE0BEBDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632609, "uuid": "e73395cb-65f1-4881-953d-d21e41fc6d8b", "value": "768:2hyywVbEj8Ojni+NWnvNr3+LgIYs+WpMGHRxSlpF2ovwKBhnLLBlOtqN3Ks3Uozh:I6VbEoSi6WnvNr3XsmsRx0xPBhnLLBRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678632609, "uuid": "422c20e9-c35b-4af7-b87a-42378e0033b0", "value": 38700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678632609, "uuid": "0009900e-a230-4284-afc0-031ecae31b22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678632609, "uuid": "348e0b69-92fe-41d3-96a7-3f166fb519cf", "value": "bbx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a70167-c0db-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678628321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628321, "uuid": "23223e16-0794-4c2e-86d3-c800e4ef09e9", "comment": "Malware payload (RedLineStealer)", "value": "0528b9c8cace9dcd94b455c0d203afb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628321, "uuid": "ceb98920-5c47-43a5-a4c7-86c0fbc630fb", "comment": "Malware payload (RedLineStealer)", "value": "e3c02cb689843160808cc37deec2ef758a914b0b84973774343a106f09377752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628321, "uuid": "ff062001-3fcb-4535-93f4-9791c73187c5", "comment": "Malware payload (RedLineStealer)", "value": "2468e15441a2ecf5c3d92f86820eaf732fe1f586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678628321, "uuid": "027f36e1-9162-4a37-950a-ac9cc18fbf75", "comment": "Malware payload (RedLineStealer)", "value": "e659e5fe376e18df79928c8f86db761b58ea2224f5936b0c3b028fe4baca330f4c1e44c87f61cb96ea3ca50ed4ca9461", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628321, "uuid": "3a3f1dd8-7146-4710-a74b-63a219a78950", "value": "T1D8F40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628321, "uuid": "d7b9a8c8-47f2-4a77-8efd-17eb8eac16aa", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628321, "uuid": "f0ce4eeb-7e42-46ad-8ac5-2ef90e6e2afb", "value": "12288:EtvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:EtFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678628321, "uuid": "54e27615-5f28-4995-a59f-9c13b916a57f", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678628321, "uuid": "e7f48caa-4ee8-43d7-9b52-e336b1cd59cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678628321, "uuid": "d0bf3e94-cb69-4a05-94fb-12603514f3ec", "value": "0528b9c8cace9dcd94b455c0d203afb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a1c94c-c107-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1678647551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647551, "uuid": "cff052d5-65e7-4f0f-b6be-bb061cc59a37", "comment": "Malware payload (AsyncRAT)", "value": "55c51b45267d61bbd994f135ea87add0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647551, "uuid": "1341693a-062e-485f-bcf9-97b05494c7dc", "comment": "Malware payload (AsyncRAT)", "value": "e8e7259207aed56b83cd1b5ff9dd85fb31b03001e8044e41707d97730a5fe72a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647551, "uuid": "8356c8cb-4ced-44e8-8d02-602678ef2d15", "comment": "Malware payload (AsyncRAT)", "value": "5d6a15e373008b1f0fbafb763385568d93499002", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647551, "uuid": "db4cb787-1612-42a4-9492-bb4f74372e9c", "comment": "Malware payload (AsyncRAT)", "value": "acb50a17dee3ceab9522cee98c9c7ee1a336e983ace51086bc9a511d87f8a9aeefc42b6e027019ecaca6589b6705e869", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647551, "uuid": "24fc3205-fee2-4d3f-afa9-de02b2d418f7", "value": "T1DB247D0037E98A26D37F5BB8F4A111298372F413B626CBAF1BD554F90DB2304D991BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647551, "uuid": "df838e19-84e3-4f5d-8ebd-cda70b8162c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647551, "uuid": "060a9115-f54d-4f99-b555-ff53189a9097", "value": "6144:Wwg+t3rtwtOHWSIGbXddfS/zB5gsWdkr:Wwxt3rNHWxodUzBKsbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647551, "uuid": "edbed3f9-d6bd-4b39-9f83-70eb814cd706", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647551, "uuid": "db01af7f-483e-49f8-8b5e-4aa5145c8a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647551, "uuid": "615ee4e5-6bc2-47b3-8086-049a9ef98626", "value": "55c51b45267d61bbd994f135ea87add0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680a03c0-c0b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678612518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678612518, "uuid": "fc5450b0-71ea-40f6-865b-e09841181c0f", "comment": "Malware payload (RedLineStealer)", "value": "194ff15f1f381e1b8090913c360a9c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678612518, "uuid": "daeeb65e-d91e-4742-b363-617d3bba0e45", "comment": "Malware payload (RedLineStealer)", "value": "e9f47f6af8318c844d2b3461450c1d99ccc3b58073a46f811c0ebeb34ed28f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678612518, "uuid": "a203e641-afb5-49b9-a1ab-d1d8d0554b43", "comment": "Malware payload (RedLineStealer)", "value": "13041401a0122281dbcf87946bcd5c1b13f68abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678612518, "uuid": "0bd8a975-3204-4f67-9817-917828fb83b5", "comment": "Malware payload (RedLineStealer)", "value": "e483564843301774a1399f043175c1e9da5e91d4bb7a08043a0ca45d7697baecac6a2cbf3408717d5cb0c9cb82277b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678612518, "uuid": "08386e77-44e5-44ef-83bd-d24f45315dec", "value": "T11954C02263EC7821F5731A315E3EC2E52A2FBD639D2866AB32146E2F05B13D1D572312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678612518, "uuid": "8d002ae4-d351-414f-b354-b4d3ac58b43f", "value": "bd539b249d1dc5b6030dd4bb1a6c6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678612518, "uuid": "41c38e34-1a7e-4c28-aa8b-1cfaba99b85a", "value": "6144:eHXk2SPPtZEGGzfi5zmEKljaIL7i/+Mas:e3hSPPtVGr6CaIag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678612518, "uuid": "e0cfdaa2-7e6f-4e78-84ac-74440d96ed1b", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678612518, "uuid": "957b178d-a4b0-4362-b0c2-5541c4d494dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678612518, "uuid": "5864e471-40b8-409b-a28d-19d86a92fc3b", "value": "194ff15f1f381e1b8090913c360a9c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46944b5-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629047, "uuid": "674240ba-035d-4f24-a398-1440415619f0", "comment": "Malware payload (Mirai)", "value": "f095868cce33ac951085b6ab8fae80d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629047, "uuid": "dd1cd18b-3ffb-49e2-b704-06cb369c9e8d", "comment": "Malware payload (Mirai)", "value": "eb319bcf8f0cd93cd4289ee46bee2ac6b81d0a86b178f0c9e7e86bb543173716", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629047, "uuid": "2951417b-21cd-4097-817c-7e15b07e4c33", "comment": "Malware payload (Mirai)", "value": "72b938a0f79bcb51ce712c57fcd210187b1784ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629047, "uuid": "fc9540cb-f380-4794-a611-9a288a1809f2", "comment": "Malware payload (Mirai)", "value": "c0596e98dcad20768828b76be352326103c44697930d78dac977449c5cea2e126ccc06e874a1c17292c0a1bf06f6a276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629047, "uuid": "17d6e3dc-a9ba-4d04-be3b-7d8bf2f32f71", "value": "T1D603E1D894655693D7822539F0EE01C713CD2AB4F52633426BA042FDB6C6E8631FAE4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629047, "uuid": "4593cc10-ac98-4d6d-8968-cc05f034b851", "value": "768:/lExwAFfTR6tlMGJV06njs83G2JQEN856M16wl49NAMtM9v1aaLsq3UIjt:/yblTR6jps6nQ8W2GENO6KGF01dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629047, "uuid": "b7735cb6-97c8-4340-9005-756efe6e2bc2", "value": 39628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629047, "uuid": "bbce241a-cf4d-4c2f-8342-dd95e01e7096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629047, "uuid": "c98afba7-9bfe-4bc3-a84f-cecb2f93b1ac", "value": "f095868cce33ac951085b6ab8fae80d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98130288-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1678634073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634073, "uuid": "303ddca0-29ec-4b11-ac26-d59421a3b2e5", "comment": "Malware payload (Rhadamanthys)", "value": "6b9ddb30c9065ef851312a802b18c9bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634073, "uuid": "ce3a6cca-b2c3-42ad-b8e0-7aa173abe818", "comment": "Malware payload (Rhadamanthys)", "value": "eb926648f55c5cfd55e1d77b07c285afbd9f70b99954e9ed4350ff71dbf7a9df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634073, "uuid": "3b49013b-6328-4853-af7b-75c706a4b4d0", "comment": "Malware payload (Rhadamanthys)", "value": "d8f712b618e3582fe5a8922cdb5881ebc8dc4b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678634073, "uuid": "48e8161b-3bd2-4772-b3e7-d4ef28cb132a", "comment": "Malware payload (Rhadamanthys)", "value": "cb44442d9965df079fcd23b707d967fb394467399b486842006b3e056d73198eb67d50a37d846f52a3e6ee7abb50dbfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634073, "uuid": "11d73ab3-eee4-4a1a-8976-279b59629bdd", "value": "T1E7A5AFF18E92BE84DBBB0D8490DC19C08C6C1B9B969D8288FCCC5516E6E5664FFDD1B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634073, "uuid": "685466ca-6d41-499e-951c-bf32f1792335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634073, "uuid": "d679cc42-8267-4798-b9d1-75497e7432e6", "value": "24576:oL1iKZpMarHbNGyYwc2Ldv0fkI33VCwKJqE8sgYrSAJklhOYUivR2Z/c9KWQ3O4:oL6QA2OFpKL3J9IGRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678634073, "uuid": "cfdcd76e-6d6a-4dac-b19a-e94a54d79b94", "value": 2155520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678634073, "uuid": "421ed8bb-cb20-4b7e-a2e8-546a97b468c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678634073, "uuid": "6eb93b8d-75c8-4cb6-9171-d62895c6cd64", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26d4842-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648774, "uuid": "009b68c9-65be-4c58-a691-0d4d5ff3cd96", "comment": "Malware payload", "value": "7dfad66baea12787115c8c9b8e08e2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648774, "uuid": "6aada11d-fef4-470c-9b34-365fc1384883", "comment": "Malware payload", "value": "ebd6d27eb842a89f0e68977e9c41af105bb43d11084c0c4d293edc748a4f6635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648774, "uuid": "12594524-234e-46a8-bb8d-41d7a5fdcc67", "comment": "Malware payload", "value": "6ac7761dae57ec02a4ac778dabc02f70df412acb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648774, "uuid": "c3cbd0cd-8f2f-43a0-b84b-e3187df8685f", "comment": "Malware payload", "value": "bace2cb1084275a73ff68e298e7bc653cc3f1b248d49a2d3b6c34deabf563b363b86e2819d10773d2e15a645921cb618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648774, "uuid": "129c6255-f939-40d5-9eff-d024b3267b26", "value": "T10F4612F96148339CC01A88345133E944F1F6561E1BFAD6AD75F7BAC06FAF821A602F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648774, "uuid": "1a464bce-58ab-427b-bb57-1731f59629de", "value": "4670763b03e0378772271f1bc906b792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648774, "uuid": "d75659fb-9570-4dfb-a7a6-4280874bd2ce", "value": "98304:NBgEsxSYY8ASa+oR7XJyo4d2KLqgYdq8AmhF0bxqrI1MgaWudK/zjjLAtCNqKzPP:NBgEsxSYY8ACoR7ZyoDrz+40XMgaDwTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648774, "uuid": "99053001-e439-451e-958c-c71f6d11d5ae", "value": 5599232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648774, "uuid": "69b0ad2c-5d8b-4d65-b028-5f026abf1dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648774, "uuid": "5780fa7b-5cab-434e-8db0-1db0b3cfaa61", "value": "7dfad66baea12787115c8c9b8e08e2ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456b8838-c0c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sova)", "timestamp": 1678620620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620620, "uuid": "ab47ca8e-722b-49e7-8edc-e33e13100f1e", "comment": "Malware payload (Sova)", "value": "9fd97bba5a8bd561071b90be6d5207e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620620, "uuid": "6e9f76e1-5c7a-4453-bbca-96b0f21e1c0e", "comment": "Malware payload (Sova)", "value": "ec5b083c017570f846f6925b7c79d9e5886525a9b7ba7e514dabad0325c0af5e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620620, "uuid": "26a420a5-3a67-4dc7-9524-789bc83bfd9d", "comment": "Malware payload (Sova)", "value": "b2994507a862cefc9344b2f6360a62f3f5b89ad8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620620, "uuid": "2764bf56-fd22-4397-a61b-a882d46dc0fc", "comment": "Malware payload (Sova)", "value": "11eefac3ee1fa41d48b420f51ea197ba7982a32619f313deca1398d3b50f2b5c5d821d617ee8fee046d88a3a7521faca", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620620, "uuid": "2d77feb5-5c10-46bd-8d33-4659795368e9", "value": "T1C7261246F7D9A82FFCF3C3364776462651068C6ACB43E787595432BC18BB9C44E86AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620620, "uuid": "b0f88d79-3607-4a5e-9e25-0b565914921c", "value": "98304:qUtLJViFl3R68N3uM9RhodP0glrb2151AhDq5ZpxvwaGZXG6Wn++yc:b+ZhN399XoVwT155ZwDXA+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678620620, "uuid": "025173e1-e27f-46f6-bafa-a006bb646da7", "value": 4729164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678620620, "uuid": "0e652218-e294-4986-ae62-cbb064b26cc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620620, "uuid": "8a45d634-fa28-4697-b3f7-d10b57e897da", "value": "Tinder Platinum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11529063-c12b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1678662623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678662623, "uuid": "91221518-f138-4671-a273-ab87c31b251d", "comment": "Malware payload (RecordBreaker)", "value": "13b1551f9d6f5fd18a3c57976aaaeb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678662623, "uuid": "8ab17e8d-d888-42d0-9718-71f656c806f4", "comment": "Malware payload (RecordBreaker)", "value": "ee34ad155143b967d667a696e1d2dea0fe8ee29c7518180639eec38bf5923a86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678662623, "uuid": "6d42279d-9d86-4c12-bc14-465545ea3969", "comment": "Malware payload (RecordBreaker)", "value": "338058bc1660ed176c16d147dea7be82eb42843d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678662623, "uuid": "882824af-94ca-4e2a-8ebe-a21c1f87016c", "comment": "Malware payload (RecordBreaker)", "value": "bac4c3210305c8799c0eccb59fdff6664917337cb72a46a65c877c28347fd9cbf1df5c60d1cb329f9480e1ed07c30b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678662623, "uuid": "fc0b7f2e-eb64-49ef-9818-e45866dd15eb", "value": "T19CB6337362680045E5F5DD3D953BBDE632F373264BC2A8B4659DECC21A239A5E603B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678662623, "uuid": "49fb1ce6-d765-46aa-b3ac-f0e6df948ec1", "value": "a9168cc43274820afc74b8e42a968652", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678662623, "uuid": "1f2b504e-1c55-497b-8b70-5525aaf56d0f", "value": "196608:nNjXgrvo5xsSYBmIOhdxfCxs5sFRXTQojht33KL7GYf0hgIcqmi/SWxM21r8:teoYLOxfC65YRjzht36+VgM6WxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678662623, "uuid": "22cd613b-c2c9-41da-af70-b1a8b71dcf83", "value": 11381438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678662623, "uuid": "64272dfe-3b6f-47f5-8b43-2b4279cceee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678662623, "uuid": "27c41092-4701-442a-a5a4-6f6e190e89a7", "value": "13b1551f9d6f5fd18a3c57976aaaeb43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354415af-c08a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678593535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593535, "uuid": "451ead61-3f45-4c82-bde7-ce1d1a100404", "comment": "Malware payload (Mirai)", "value": "fb67ad43821a10c13e8fdded46e414b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593535, "uuid": "177d64df-bc87-446f-89b5-a65d63f71ef1", "comment": "Malware payload (Mirai)", "value": "ee636e409619c8d8b03d2ae760a6403f40ea6f67fc2d723835f8d1d73e04be5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593535, "uuid": "a6ae3a0b-b41e-41ad-8306-d0474275e2e8", "comment": "Malware payload (Mirai)", "value": "c332c7d13e72fb2f8d02a15b2baa22be637ab189", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678593535, "uuid": "532d9955-73ce-4a28-aa38-0e3e3534f6b4", "comment": "Malware payload (Mirai)", "value": "fae1f49b9981d5a520a4c273f42b55fdb2eee33524db041e35622e3d0a4f546e26296dcfb01dc5123e48c67119ad19ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593535, "uuid": "a794d9d8-164b-42be-8663-03418d34b665", "value": "T18613F164936BFFC0DB210C74ECB4828757457BE4828EB54220B5CBB63AE418972BB0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593535, "uuid": "209d06d5-0f59-4978-87eb-5943b9c8cc68", "value": "768:ttj+KG51OaSyfE7vFisAIoKhBinq0q2IU6AjIULY3SMa588YH93A5zlG9eK8cRtd:rG2aSouvFisAIBniqxiI73SMG88YOzlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678593535, "uuid": "3979dd7f-ead2-4850-8a54-bd089c168d8b", "value": 45532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678593535, "uuid": "2c926820-577f-42c7-a917-241a9200f4bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678593535, "uuid": "7eb70aaa-f0b2-4df3-9f31-33a5f2328656", "value": "bok.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa6b1cd-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648009, "uuid": "6a90e583-4e99-4874-9dc7-1909fa8238f7", "comment": "Malware payload", "value": "9f4f35cc9feefb35f677754156218776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648009, "uuid": "904e6615-66fa-4132-8559-dbc3fd7561ff", "comment": "Malware payload", "value": "ee7d03ff69bd973af6e04b044d12503f995b85adc7e12235c957d14491cb6212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648009, "uuid": "8ccfd812-4e89-4eb2-a175-9a0e1694829c", "comment": "Malware payload", "value": "592d66b83ee037e05d3a7dc453b51a7a8481bab3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648009, "uuid": "6ce51748-bd5d-4aed-be53-a3a51e9e47b2", "comment": "Malware payload", "value": "d4fb43c585fae62057fd08905b34eb88933ed31e533961b6e003f9975a92dc4a5b0d4a49ea1b48793600c7ce381d88b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648009, "uuid": "d84dbbd4-2d2c-44de-b4bc-a2761a70dbb7", "value": "T1D42633686243FB9AD36D187D3F6DD5E8A8C33F49E2D3CD2851AD52483EC169CD0E8858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648009, "uuid": "9d9d4aea-b94f-475e-9c43-19f7c76449fd", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648009, "uuid": "79e32c98-606f-43c6-a1e9-7c411869c7f2", "value": "98304:1YZow0Y3V4g3Opp1JR9TXG7r2G27tffpi7W:maY3VdA1r9TXQSBJBi7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648009, "uuid": "257473e5-f470-4b98-a1c6-923a927e5c2d", "value": 4509696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648009, "uuid": "0fa336d6-bd8f-45d2-99a6-3b0b8b88327f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648009, "uuid": "5ef2132e-8fdb-449f-a363-0fdb0e257cf8", "value": "9f4f35cc9feefb35f677754156218776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f2fa2d-c0e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678633296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633296, "uuid": "3ea08e53-26bf-46c9-99b6-8d02f5e0bd67", "comment": "Malware payload (RedLineStealer)", "value": "ff26ccb8031ca58b9344d6d8c6eaad0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633296, "uuid": "9d3503a0-1fa9-4e81-9c8c-e477cb20f085", "comment": "Malware payload (RedLineStealer)", "value": "f02fd9bf0b61db53ffc7c664310ad61da0a7d9e71f0352898d3a36140020a885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633296, "uuid": "77ba7992-b09b-4f42-ad82-1de579296c57", "comment": "Malware payload (RedLineStealer)", "value": "76491cbc1aabf5d3372b9a747e0732f6228e809b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633296, "uuid": "60140293-b241-4877-81e2-9c7820bf50be", "comment": "Malware payload (RedLineStealer)", "value": "b5126b8ebec895051f2a715ccb087e57c407b78e7f316b75d9b0c523f6f0b4ae5c108f9a7a18a23e383f49a0176174e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633296, "uuid": "9c135877-420b-46f6-9bf7-2e3d1f4c818f", "value": "T10AF40272E1F17451E1620A719E3FC6A9272EBCA25E6812DB3208765F0DB10DF82F574E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633296, "uuid": "464a1bf8-ce24-4d0a-aa3b-329a0278ed17", "value": "bc34a2c3909f8b2826a0eea6cb6504aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633296, "uuid": "0b8cef5a-ba2e-4ac8-a4f7-a0c59987066f", "value": "12288:ItvlfVlBmjL0L80wl9JLQIchxZUJ3Q+6qIwgP3PtYQNsCgN4Vs4Q/YIs423HGPc/:ItFnB0oLxwBQBhfC6qhgf5NhbW4QIX3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633296, "uuid": "6bdb8a70-a7bb-4e3a-8fe8-dba6a94b6c73", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633296, "uuid": "caf67c3a-d8d7-41a9-a4ae-cad03915a7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633296, "uuid": "33264715-0060-40b4-84ff-f02f0af9c9b3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59ce7c3-c106-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1678647007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647007, "uuid": "9c537961-929f-4398-a57b-a0e957b895b7", "comment": "Malware payload (Smoke Loader)", "value": "5941dbdcbf2b87e2c7c9fe1d8c9e6219", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647007, "uuid": "73ec1e49-30db-4da8-8c53-2330e73a9bc5", "comment": "Malware payload (Smoke Loader)", "value": "f0c9a51a75477e893f6ab0e5fe1a706c309eeff1fd11387f98526b51ded189c3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647007, "uuid": "edf6ba54-973f-4fe2-ba07-196758dc5775", "comment": "Malware payload (Smoke Loader)", "value": "ee7b195e496a0aa19b2377288a347da6f4436a01", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647007, "uuid": "afaf9317-5835-4fcc-9a8a-e39f0587468d", "comment": "Malware payload (Smoke Loader)", "value": "09df5a65bc7ff832555dd1811565aa337c1b935cfec9a053dda75bae25d88dc82cca827c3234447cabf62e37459f37c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647007, "uuid": "e2be5b26-39ce-4d80-b9e7-aef178dcd5d8", "value": "T1F4149F1253E1FC25E663E671AE3EC2F42B2EB4E14E79775A12046A3F0CB11E1C963752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647007, "uuid": "6e2343c7-8828-4f36-81c7-ed347715b1d4", "value": "858e6430e3652e12355faa06f640c4d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647007, "uuid": "be3223e6-49bf-487f-a64c-bf333e024643", "value": "3072:ugAFThjNP0xN9k1YRDnlaY1gpBJj29iiZfGJpn7cDmcglfK1ycW:CFhNP5+RDUY1UB1AieeXFzfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647007, "uuid": "dbe4320b-fd97-453d-b5f3-215a9960177e", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647007, "uuid": "aeaae819-dff6-4acb-a0ba-1b8e0844cdeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647007, "uuid": "f3dcb81b-04e8-4d5b-a238-4de9bd9fe189", "value": "5941dbdcbf2b87e2c7c9fe1d8c9e6219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b83a73b-c08e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678595263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595263, "uuid": "7757e09e-0c22-4fa5-9e15-d451e10f4f1e", "comment": "Malware payload", "value": "8f53b9863c70ad0d31085037f9899fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595263, "uuid": "6bc20c9d-45fb-4ae0-bffe-6ecf297600c4", "comment": "Malware payload", "value": "f1fe80a633a1cd5361e637c748ada6d0cfebc7e07f058f60b3dce6067cc91c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595263, "uuid": "1a9064af-baed-4932-a9d1-854dbbf634ea", "comment": "Malware payload", "value": "38131ba1e8f2501402bfd4800d3afcfca491584a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595263, "uuid": "2577aa6e-9069-4729-8a0e-4cb207d5b250", "comment": "Malware payload", "value": "376522ded44b58f07e3ba892c7372b6a44d77f0e1880007d35350a7c6ed8e0790c0affb1cb5ad5543c397ba3c64343f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595263, "uuid": "9c67ccdf-7164-4de1-bcd3-746d971c3265", "value": "T11E9559517E408C66D6920A74ECAADEB183327D5D43F642F3B2E1BCD77A39BC13926106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595263, "uuid": "15ccb996-7ab0-4839-a59f-85d5d47e352c", "value": "1187934de3acc20b2e347e5bb3daedf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595263, "uuid": "c1a2e2f0-5f0a-4e73-937d-f829db54491f", "value": "24576:6ITbG+zuGv31DVyfakr0tghoCWu3FqNiFLxQPkAUA/JpLNg:6ITBkfaM7LWuFqmQPkAUA/JU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678595263, "uuid": "7cf76c9a-83b5-4409-bbf6-f1853fd64ee8", "value": 1945088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678595263, "uuid": "1eed7aa3-cdd9-4f91-b244-e3e43ecec808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595263, "uuid": "04e46eaf-7c82-4c30-a0fa-d8189d0dd71a", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.WinVNC.gen.364.91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4a2d16-c08e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678595264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595264, "uuid": "eccb31aa-99a7-446e-b050-5c7df57cdf64", "comment": "Malware payload", "value": "b2f6fe4b2c5e5e92b08ffa5e7319e62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595264, "uuid": "97a4eb6e-490c-49ef-998b-91cce42d9be3", "comment": "Malware payload", "value": "f23faf36ea96a4e9a4b18260cebc05f841d8664cf0fdb628105068a53303706d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595264, "uuid": "c7195f24-6cc3-4a2d-aec3-fa8353245df5", "comment": "Malware payload", "value": "adbc51e01e55972cf34e8ca86a8be701ef2c2d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678595264, "uuid": "07ee9ed8-e93a-4340-aba0-bf9f1a85e20b", "comment": "Malware payload", "value": "6b3fbdc868a00e1a51d748efdfc3118027c6983b66a30bfbf3bb1a69be944bf3ecde1dbf0bac26acb44c16b873fcfef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595264, "uuid": "03aa4a3d-a9fd-44a3-bc04-741626ae28b6", "value": "T168D48D1972D841B8E0A790788C875A17D7B6748A12724A2F53B45BBF2F2B7325F3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595264, "uuid": "3f39f89a-d0eb-4c2f-baf9-12d77d2d78a4", "value": "e9019a3fd950d371b8790e101889313a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595264, "uuid": "2c2ab2fa-4368-46d0-858e-93687b4913f7", "value": "12288:y4xGy0XR7LcnOYjUBAxn7pz7EFmMNvD0Kx48vzzHpVB82z3Hbqaiws3wJOWH5Aok:yz6bGP3HbqaitAJOWH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678595264, "uuid": "f03dc099-f1c0-4863-b866-b2d1ffdd76d4", "value": 600416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678595264, "uuid": "8a759c03-62d5-4c4b-bb2f-2eba9a0f3be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678595264, "uuid": "15a54173-0914-42ec-8032-b91c6c202ac5", "value": "SecuriteInfo.com.Variant.Tedy.173902.18328.10251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5204761-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1678642390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642390, "uuid": "19a215bb-dadd-498e-a4cc-7b8eaab0de76", "comment": "Malware payload (SnakeKeylogger)", "value": "3fb3bfe35e43c2c32e615682c3d65eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642390, "uuid": "e8081cf9-e7f8-4f2e-b9fc-ad62cbbb358c", "comment": "Malware payload (SnakeKeylogger)", "value": "f315d7d883a82ce0b007f7f2b899047b781fa2cb5b05952e146ab679c8c64717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642390, "uuid": "07d4fa4e-f089-43e5-bb0e-c0eb927224fb", "comment": "Malware payload (SnakeKeylogger)", "value": "b41a2e35ca09af8c7dfa0c57cae3cec9dd2bc031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642390, "uuid": "920cdb56-63f9-4430-be24-1f3edf52fc24", "comment": "Malware payload (SnakeKeylogger)", "value": "f63fd74569e454cd63a537fcb2cf13b1986afcb02619f7b366791a64288fdd12726b2cb17fd75861c18aedd7d0708aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642390, "uuid": "b0d9e9ce-0e63-411e-85aa-a25e7df34675", "value": "T11E457D80A25098AADB7746F7BC2A693021B67D5CA8BCC10C0959765B15FB77120CEFCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642390, "uuid": "2b584d7a-5e6e-4955-a145-3a56043a25eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642390, "uuid": "b5298edc-8c84-4802-bcac-714e4c6f8a64", "value": "12288:Mjb4FlLKHFjcsTKKm1O5iMaVZ9mIReogKah7JTDTZQ5+lAW+6f/UpGzGNWJ3kREe:iKKmIi59iGq7JTDTZzlAWUpCGkJBRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642390, "uuid": "91c2f85c-af28-482e-8d06-409d460ec61e", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642390, "uuid": "96b8fab7-608a-48fa-95bf-3ee3b853ab29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642390, "uuid": "0947c592-520c-4864-b1c6-47362276de53", "value": "payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80076f3-c0c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sova)", "timestamp": 1678620785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620785, "uuid": "f78c90f4-d303-4b4e-84a5-91bc813ab399", "comment": "Malware payload (Sova)", "value": "22d82606c804126663992f59e3d1f0c9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620785, "uuid": "f2e515ad-fd9c-4835-bbbb-a1d0b90f5594", "comment": "Malware payload (Sova)", "value": "f3fc80a8793e60a901da44b9ab315931699e64a4f3eddb8aba839fe860de46dc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620785, "uuid": "0753bb54-9d14-403f-918f-d2a21e9082fc", "comment": "Malware payload (Sova)", "value": "a8a7c8896772bda9c5e17ce665eaabf32c0c959c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678620785, "uuid": "7c222922-1c34-48bc-b054-f0fb0e0c59e9", "comment": "Malware payload (Sova)", "value": "9fd327a6f22f81e2c7acb5eb7b52cc9e33dc656a7dbb8fe18d353039488808f30f01210c59e541e1ee4415308880dccc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "nexus", "colour": "#4DF50D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sova", "colour": "#A7AA3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620785, "uuid": "2f40ec10-5204-4b86-a390-d549f70a8c92", "value": "T12E261242F7D9A86FFCF3C3366B76462651068DA6CB43D2435904767C1CBBAC44E89AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620785, "uuid": "545b733c-1a2e-4dd5-8c61-1edf18fde1cd", "value": "98304:jccN08QfEUXSRxAJDFJLhohK0/anjwH9U3RFRGOsR3oHFoZdt7+CSEpDj9O:jccN08iEUioJZJ1oXldciOsq0t7tSEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678620785, "uuid": "7a742b24-8688-4c26-95e0-3daa7ceaaf59", "value": 4679716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678620785, "uuid": "e2fc2ada-847c-463a-b05f-260daed06f70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678620785, "uuid": "0cb5183d-c2c9-4026-8c5c-c9423e1aa790", "value": "PancakeSwap.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e76476-c0e8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678633900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633900, "uuid": "ea5a426a-0228-4a7a-8fd1-a3c1877f485f", "comment": "Malware payload (Mirai)", "value": "28b137e827835671b7d108b200216286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633900, "uuid": "4b771ab8-a801-410f-b376-771da8855e87", "comment": "Malware payload (Mirai)", "value": "f446b0944b1fe21a399f5797f64a317d8d121fd0af1708cb65dc227a3ada33d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633900, "uuid": "71b4fc41-2696-401a-bcd1-dd51421d116d", "comment": "Malware payload (Mirai)", "value": "fbaf7c9d369d5a46b6178b17e7d9a09ee4243485", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678633900, "uuid": "b3c30b76-3b97-418e-a3c2-0e53414d225d", "comment": "Malware payload (Mirai)", "value": "530ae94be67bef1de1632c2768969b8496dace4d23993bbc9c83c3cfad82644d43d0afd6aaf4b71461f6a78375e1563c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633900, "uuid": "4c984419-a373-434e-8827-7a2b7c715918", "value": "T1A1F2F1DCC8180F9AEF76A9B139F8BB8653E02D55AFA0CE82120D7F20A487D6D515C0C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633900, "uuid": "6f22cbf7-ad73-4a7d-9f22-32ad0a4d35c7", "value": "768:jZoTM44gWd4W+sFYZSKCFrHASXZOLLvNJDe/rBEh96nj67sJ4uVcqgw09r:j+w49WdisFhzAS4Xvb8Ehu4u+qgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678633900, "uuid": "c1c9db12-8462-4eb6-82f4-62f6651beea5", "value": 36560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678633900, "uuid": "b9d06f8f-1766-4c20-bb68-4f0783ee5181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678633900, "uuid": "7a3c560a-c63e-4647-ba6f-43da20695740", "value": "28b137e827835671b7d108b200216286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea34bd2-c096-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1678598838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598838, "uuid": "a55c1e37-5911-4c44-b1a1-023f446e07c9", "comment": "Malware payload (Amadey)", "value": "8eb447c91fc1e26718ab92136632dca0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598838, "uuid": "5b9d2923-e608-4e0f-8a6d-8240b95227f6", "comment": "Malware payload (Amadey)", "value": "f52d1c6bf0b45b5f8fed3180b431f0fc93368c110fe2d30c3f9c0115faca8536", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598838, "uuid": "94f9a5c7-9147-4a12-80b8-9eb7bad08e6a", "comment": "Malware payload (Amadey)", "value": "eef485dcf18af5936a09d975a837b7141ab27a86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678598838, "uuid": "fd63b99e-f294-4fca-b904-405568fb36a7", "comment": "Malware payload (Amadey)", "value": "3920db37fd6db036eb84750f3e4e56129fdb796a7be335cb26420a35e29e6769c17e1ad0d5187f87cbd90760d08e062f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598838, "uuid": "4ccdf742-f3a1-4030-a912-16f4534d446c", "value": "T17DA4F142B3E06D25E9B7CB316F2FC2F41A2FF9211DA9675D22046A2F0FB21E1D562711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598838, "uuid": "d15a195b-4ec7-4d3f-9fbb-d742c65b4267", "value": "a90cc1b6f902761feb40477393138296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598838, "uuid": "09069ec1-b54d-46f6-b274-05693aafa7ec", "value": "6144:UqLqMB0jNjl7QhHnzn+iP7frg2hsc5FfX01xKffmSY7Y9J7gpDyjzGyk:d+Myv7QtnznHfrzsYC0mS+AnzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678598838, "uuid": "fb6a30e9-a265-4cb9-ac92-228f43dd15c4", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678598838, "uuid": "618a12e6-ec1f-464f-ab82-3df57ae215bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678598838, "uuid": "66ce78ba-f431-481c-b484-12ca24ffe12b", "value": "SecuriteInfo.com.Variant.Jaik.128644.29989.21775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79674038-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588065, "uuid": "16701abf-8387-4f3e-b0a0-b5bfb6d0b40a", "comment": "Malware payload", "value": "e699ff001dad735130cca18d832442a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588065, "uuid": "687ce503-8f7f-4265-8608-a11a4b536575", "comment": "Malware payload", "value": "f59b81fda6ba719cefa74145e15d7044fb9da1faa8f09ce912e83a8a7ae60bb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588065, "uuid": "1a7541e2-f3e0-4cc1-b431-fd217c8ffbe0", "comment": "Malware payload", "value": "ee80f3944f2d50f68fef855e513bee26ae637474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588065, "uuid": "e12ee30a-5382-439a-a27c-1252ee21a057", "comment": "Malware payload", "value": "26ac2dceb220ddacdf20ae1e6ebb3c442dfa2da3661ad77c07cd5c90efeb55e5700332ce82c569d0e26c98201d6ccae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588065, "uuid": "a8a69adf-41ff-4482-9a06-1270eb50517f", "value": "T142E35993749094B1DC35487165F1A0F16F2F38620BA6687727B8E33E8FB0A91DD3B616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588065, "uuid": "07470899-6c64-41a2-8d30-134981b8e40f", "value": "c497c7ae4ef231e5be5c8a519a4916d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588065, "uuid": "781f641b-8f46-4216-8a9c-3b803e564008", "value": "3072:4ClHd+1gG5hUo8fn638Znlknv0sIG8iQOhIIlirlJ:7lU/58n6VVkOhIIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588065, "uuid": "d7fcf667-0782-421c-9131-1a29465e2870", "value": 153128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588065, "uuid": "b5c62548-fafd-4094-9442-edfdde5a5ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588065, "uuid": "bab12686-cae8-4d0d-8587-b1405ea8c11a", "value": "SecuriteInfo.com.Variant.Fragtor.155673.18033.26332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e3e62f-c125-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678660061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660061, "uuid": "4cb3d370-4d0b-4b2c-afe8-d30250bbae5a", "comment": "Malware payload", "value": "f53093650258321295da6cf2d22d47a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660061, "uuid": "b72bc231-da1c-4988-b67b-373ab95b3d81", "comment": "Malware payload", "value": "f5e1380410aa2eb6f6759ee151bab63c06af6e9185651d6e7be6f1ea8c626698", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660061, "uuid": "839c1e8f-6ad5-47af-8e5c-3510efab633e", "comment": "Malware payload", "value": "036d73e558c935735c7938c39441d58388116299", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678660061, "uuid": "fd6fdf22-0e6d-45ef-8c78-cce06ddde33b", "comment": "Malware payload", "value": "ad0edf141ca906204f08c3f52ac39ab3733e51f364819b8830afefa551975754d62ef1df9256d966e05859a273635332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660061, "uuid": "641f0cc8-3c31-4a8d-8986-2330b74b814e", "value": "T1B735124257F06C60F17386329F2AC6F4AE2EB421BD7A36767258571B1D72DE2C1B2321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660061, "uuid": "72cf1c5d-fb84-497d-a4bb-af27d7d98dab", "value": "763e9e576ac4f8f5d8c94582bd0a0f4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660061, "uuid": "30adb4e5-3f0e-452a-a119-c2c1930c1fb8", "value": "24576:DusZZe3gfRLVp2b8vnI0zGHHRBx6i7O7evx:Dus+3gfRJUcnwH0i7aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678660061, "uuid": "a4e54df6-245d-4914-9673-bf5800ac8247", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678660061, "uuid": "95d0344b-cdb7-46fc-a763-65f6d394cfae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678660061, "uuid": "37384e11-07bf-44b7-8af3-e96dc17f19c8", "value": "f53093650258321295da6cf2d22d47a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fc805e-c077-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678585585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585585, "uuid": "c49e9256-1fc0-42b0-bb59-560531a0cdca", "comment": "Malware payload (Mirai)", "value": "7f4fb4c4ab27a99ef49cbec2f175f5e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585585, "uuid": "5044fdb7-a750-46e8-9f6e-648100f2189c", "comment": "Malware payload (Mirai)", "value": "f8429e068d8694c8e2499f840465744e5fbf01c53658397e21224a99273788cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585585, "uuid": "876591bf-110d-466a-a24d-042e3eb9e442", "comment": "Malware payload (Mirai)", "value": "dd0190558ca0fd57328ad7425ae71d9ec4821b28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678585585, "uuid": "ec5b6a6e-f2dc-4412-9b81-7c2985b2b654", "comment": "Malware payload (Mirai)", "value": "84df4acba2407bcbdb5cb7a31f54d1a9c01e3e4ab518a10f12234fbec7ce0b01a8148d705af60805ac4ca1ed69c6ab9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585585, "uuid": "e6f0dc90-fd52-4d57-8256-94365006c022", "value": "T12D539E63C4641DA4C1544AB0B9288FB61763E60087637FF6426ACBA99057EFCF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585585, "uuid": "4d7eba1d-bde2-4701-a020-3b5268d31239", "value": "1536:oagv1AOp/umClcqseyyYGsYhSSSijKmR7GrxhCKkdV8:ox11KmqsFIS9iGm2xhKV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678585585, "uuid": "b2ab574f-c3d6-412d-8d56-bdfe853b2833", "value": 62592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678585585, "uuid": "eed20343-8073-4951-a0d0-e90e95693c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678585585, "uuid": "33fc1042-f703-4d78-a5ec-efc834b2eedb", "value": "7f4fb4c4ab27a99ef49cbec2f175f5e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bd5f4f-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678642854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642854, "uuid": "10f8bf1d-d0b9-4e11-ac2b-4ec8fd8c3aad", "comment": "Malware payload", "value": "e2186c8dfe2bf176ffa180bc8038b45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642854, "uuid": "cfd29f20-1823-422d-8376-9c2c25a15378", "comment": "Malware payload", "value": "f978ad359add698024287eba93f88d8eabe3c458c62768bc49e3d9e4fa30f2d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642854, "uuid": "febde89a-d5e7-496f-b729-7a841bd0083d", "comment": "Malware payload", "value": "e6b4d52d408861211307531679479ae3e5ad6546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642854, "uuid": "f7be6036-2bee-4627-9677-bab0ac31346b", "comment": "Malware payload", "value": "ad982b6a3d056e4368b80d06cbe1642a8d1acc9a3bbcf8e1f4ec090fdf0fc1d8e3229b727056b51ecdd8bda49cc580be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642854, "uuid": "2ef1845e-58d1-4d6d-ae62-b9958e4ea859", "value": "T13436E0D9F13112DDEA274323CF00A68872A594BB451BF9DBAF28D1F2815B15826F6F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642854, "uuid": "b9c79d48-06c9-471e-940a-dcc19d7e0d72", "value": "0cab0170722ba12b99e4419aa79e51bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642854, "uuid": "c8ae240e-aa82-47d0-8595-ba3b61817484", "value": "98304:ZrNDnifgPgjhcObmRCevTu6QDiU98WJONhZ9gsb0jJu/2vJYL4ooq:ZFBMuOCTpDLaqiRYLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642854, "uuid": "e4cd6137-a1a9-429f-927c-79e0a64e4f81", "value": 4979056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642854, "uuid": "c76971ff-a665-4bd9-8527-f5629964f359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642854, "uuid": "a7ef977e-682a-416c-a6e9-95146290fb57", "value": "e2186c8dfe2bf176ffa180bc8038b45a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f938b208-c0dc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1678629082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629082, "uuid": "b68b5286-f3a2-4e78-bf46-48be7f297a8c", "comment": "Malware payload (Mirai)", "value": "dff177dbd13f2409807fde9d5f08f9fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629082, "uuid": "08af6efb-6a5b-4cee-964c-32ebdf3a09dc", "comment": "Malware payload (Mirai)", "value": "f9c81f1857ea3c94feee13c99c18f4a3d7d6348326c2bb1c27cd83c8b9168274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629082, "uuid": "0070536b-6ca1-4208-a5ad-bae7652b438e", "comment": "Malware payload (Mirai)", "value": "6a8791bf81615716da7125df62c0f5e6fb554f3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678629082, "uuid": "42f466d9-73b5-46a4-a561-4285ed9b73e5", "comment": "Malware payload (Mirai)", "value": "a26a541ca078a463030e687bd3a0029002b8039e26e25fc81b0d367b4dda635457c473893c6405afee8580a4ea9b7469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629082, "uuid": "a2919628-07c9-4113-8b5c-3fdcf491959d", "value": "T14EF2E2E086D185ABC14445F7EBBBCB8005BF8BACA2FE7675363C571598CA0509F7C506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629082, "uuid": "f028c697-7020-4b60-b399-8363940fdc1d", "value": "768:x/vckbWsXUpnOACeglTti+OHqKtzIn/OWYOo9avmrC3U6e:VvckbWskIdTtUKaUnWWYO20xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678629082, "uuid": "a00e637c-fbe3-4d3c-9035-242447240114", "value": 35200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678629082, "uuid": "53afcde0-2464-4dde-a5aa-c0dd21dd622a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678629082, "uuid": "6000c6ef-55c7-4168-b88e-d742f7b87c13", "value": "dff177dbd13f2409807fde9d5f08f9fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdd1313-c0ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1678621330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621330, "uuid": "e69112d1-ae5c-4918-bb0c-7efa6b14f481", "comment": "Malware payload (DBatLoader)", "value": "bc8803cc253bb7c2ed80fe823af43eea", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621330, "uuid": "20fde799-9b06-45f5-b687-2c7c4c400d96", "comment": "Malware payload (DBatLoader)", "value": "fa8676f51efbb59d92fd71b77ae56c6d14d062e998e1ad301619fe6f2a7e31e7", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621330, "uuid": "87bf4071-1982-4606-90d5-9557cc7bb625", "comment": "Malware payload (DBatLoader)", "value": "aa367912cf6423711dc0ff3624257d4ff8e8bb15", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678621330, "uuid": "5d5b5910-820a-4863-913c-a58e976a75ba", "comment": "Malware payload (DBatLoader)", "value": "7fa9f935200335423f6e3380549f3a8b487267efbdeb2b1c7049f233eecad26e3170cd1a99f7c622eafd35f63db2a724", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621330, "uuid": "ac252bc9-15b9-4d34-8e8f-ed7c19a5e473", "value": "T176845A39F680D537D43159BC8E0FE2E5A569F2302D351957B6E51F4C88F9283AE2BA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621330, "uuid": "6ab93e47-82a7-44b0-bfbf-47c3f0692257", "value": "70ecac21951390289e31a1a3b129c186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621330, "uuid": "c9344b74-284d-47b1-a698-a6ebf3b24590", "value": "6144:I/6XWr0/M0OTrgZEBCjXm2Zpair5vpofIP2NFFL+In:JXWr6MmyBI22Zp11vpo4aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678621330, "uuid": "832f6788-fc1d-40e9-978d-b6224172e715", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678621330, "uuid": "af355b10-469f-4973-82f2-b32acc4824d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678621330, "uuid": "a22f5f75-d3d7-4633-a457-dc0b4dbe0cee", "value": "2023-03-11_bc8803cc253bb7c2ed80fe823af43eea_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b22092e-c0fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1678642856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642856, "uuid": "79eb1d51-1803-48ae-b4fb-3b0c896b690c", "comment": "Malware payload (RemcosRAT)", "value": "bcae06ceab767b7cfe609336242afe02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642856, "uuid": "5157ecc8-3c19-46e5-94f5-5e0643d38bbe", "comment": "Malware payload (RemcosRAT)", "value": "fadf7ead90f9991fc48c3605e00461e0d6495cdb65ae6b97b6e3cb86f73cc9df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642856, "uuid": "3d45ecff-2dd9-434e-b53d-34084e3801de", "comment": "Malware payload (RemcosRAT)", "value": "8df5614bedd2db78892b11e6a73017d1e05d4183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642856, "uuid": "200f064b-aa83-4edc-a322-e1d35ab36dca", "comment": "Malware payload (RemcosRAT)", "value": "f11eff8a7a883c763b5532a99a6ba5349335069ff33a9bfde452fe55740d5485466760d0dcd9ea2820ae6f2b46339646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642856, "uuid": "7258ec7e-f297-454c-a447-02742c792289", "value": "T19395F140B3D1E0F2C0643E715B6283949B54BF905B9A748F52A43FFE61A0F85DF266CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642856, "uuid": "00f93fac-8300-4dc4-b1e3-4c8c0844a223", "value": "a9e5f3ce5156d21424ffde8025e47b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642856, "uuid": "b2915a8c-1789-4ec7-8ca0-d1fbb9d3d4bd", "value": "49152:OrHfMapQaxQtWjWLEjTerPUDvW9o8u0pQLElB4I:OrHfMapQaxZjWLEnaUjo7u9LElH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642856, "uuid": "4018a1bb-78f7-46be-b610-180802841372", "value": 1928096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642856, "uuid": "864f9f3d-963a-4756-8636-c44aad87b70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642856, "uuid": "e6509896-82bd-4bb7-80cc-801511555693", "value": "bcae06ceab767b7cfe609336242afe02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cd1f0a-c10a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678648650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648650, "uuid": "58c09366-b486-4a0f-bb27-af1c0df02871", "comment": "Malware payload", "value": "e827a3d2351f72c2260a978f05b11a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648650, "uuid": "ca54562b-aaa4-4922-ab79-4bde9328037f", "comment": "Malware payload", "value": "fcbc000eb7fa7cbc849578d6e1c5e95be58f04c11dd6951f296ca88fb26fbf6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648650, "uuid": "df66a7ce-21ac-490c-b907-cfb5a2110732", "comment": "Malware payload", "value": "263c35eefd7e31b27a0a775e98e0070387717e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678648650, "uuid": "83da5b93-dced-4db8-91ac-7208d0d1379e", "comment": "Malware payload", "value": "80c77a62a6871aa81043ab333c570a27b6b8f83a035dd8c919e6e4c89a5d6806ed8fd117579a9557f63b2d325174b073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648650, "uuid": "2ae4f6c8-88b7-463a-a939-32835547e739", "value": "T150358D26B2D19537D1721A3C8C5BA3A5582EBF512E38794E3BF82E4C4F3A78138552D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648650, "uuid": "2f144cce-f280-42db-9912-89bdfab48406", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648650, "uuid": "19c532f9-3508-4bc2-a760-616dafb98cf8", "value": "12288:0MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9VO25nQopS:0nsJ39LyjbJkQFMhmC+6GD9t1pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678648650, "uuid": "4058f785-a94b-44f2-a766-6bfc1af67cc2", "value": 1090916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678648650, "uuid": "9a894ad2-47dd-4420-a499-7a99d097c9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678648650, "uuid": "31483a95-2481-485e-9e03-248fb8995d11", "value": "e827a3d2351f72c2260a978f05b11a13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabcfc74-c0fc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phorpiex)", "timestamp": 1678642828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642828, "uuid": "959998a6-c2c2-4bb1-9305-73fb885d123e", "comment": "Malware payload (Phorpiex)", "value": "7ff30ef548a0a98110da90cf3580bf0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642828, "uuid": "f2f79053-1173-4719-9922-2274c18795ba", "comment": "Malware payload (Phorpiex)", "value": "fcd498935217755647d3d65b427b5d65e89a1326636e80a99e500d172aa80ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642828, "uuid": "697e778d-77c0-4137-ba88-2d6b8c768b73", "comment": "Malware payload (Phorpiex)", "value": "9842a372a43c072494c2576e13b483cd596b8609", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642828, "uuid": "fab1c48d-8c64-405e-aeae-60a5035d65d8", "comment": "Malware payload (Phorpiex)", "value": "ccd3c77799a42a9f9deef1afce66035f1569fb07ccdfcd3b6bdac8b2ab99e84fb5870a5399ee7c10b02df8ea34aa9310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642828, "uuid": "5c9f4748-90e2-4ece-a2cc-4b6ef22a0c37", "value": "T1EB731800F280803BE0F685FFEAFF52A91A1C9FB4534594D7F2B1649F5A246C6BA36453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642828, "uuid": "730d3d49-e6ac-47bf-acab-ec0e9640b2fb", "value": "dac8ae7c837e7fe3a3ea62e0b6800155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642828, "uuid": "39e645c6-8fcb-4b06-9896-d018db6334b9", "value": "1536:gU3Mz8HjuhhzLcL7WX718DVMED5WK1qlfFdIaeeeeeeeeWeeeee:4wH0pL2yL6/1zqlfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642828, "uuid": "1c04d552-f53d-4ccf-9788-1b59e221400e", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642828, "uuid": "8ed8fe7f-1d19-4e25-8bb4-fc0e0a6a3069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642828, "uuid": "ddb225f1-d19b-4040-a0cf-0b8d3852faf8", "value": "7ff30ef548a0a98110da90cf3580bf0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74e3bee-c092-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1678597189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597189, "uuid": "78ada356-ebaa-4989-8577-a1a08a9a390e", "comment": "Malware payload (LaplasClipper)", "value": "65d1d51e4c8c97f851d33600f3c8be67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597189, "uuid": "2afed85f-7dc6-48c3-9052-cf52e2c4fa94", "comment": "Malware payload (LaplasClipper)", "value": "fce94037edf0225b19e8781e0a892f08a1c4b245ef10a0fb6bdaf2eb66b4a334", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597189, "uuid": "e9cd296e-b11d-4dae-bb4e-d687137703ac", "comment": "Malware payload (LaplasClipper)", "value": "2089edc0ee02e0d8a1ca33f1428da89450d104a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678597189, "uuid": "c1b416a6-9d85-4ebc-b081-f69248843259", "comment": "Malware payload (LaplasClipper)", "value": "2d5eb680060bb2aafce069b638f4cce788492358dfcc4bf43898344e1dac9391d72a5d38ec8efbca9c5f11aff9ec6497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597189, "uuid": "2895996f-6f60-43dc-9dfd-1ed9ba33e73c", "value": "T1FD74BF12B3F26861F563CB315F3FC6B82A2EB5515F69776E22048B1F0AB11E3E562311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597189, "uuid": "d49c640f-5c01-4e26-a3d7-40e4828acb79", "value": "d85c6d7b055e0be9b1eeac889c1c311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597189, "uuid": "3400db86-71dc-4e06-9a56-41ac650c027d", "value": "3072:5KnbqmODDLqslJcVjQPU+JmZRXTQMyN/r6gajYsm/jv8/fzIyZBW0OkX6n0+TDq1:WqnDDLKVMivXUM8uzg/yLIVlk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678597189, "uuid": "3473ad67-d071-431d-a40c-10c95cfb168b", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678597189, "uuid": "6c9d1eb9-af78-4384-8e7b-b7c19f1a8e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678597189, "uuid": "b07c3009-0612-4982-91b6-05186d27b276", "value": "65d1d51e4c8c97f851d33600f3c8be67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18782ad-c0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1678642276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642276, "uuid": "72fefb85-639a-41b4-a6b0-bbf636ecd03e", "comment": "Malware payload (SystemBC)", "value": "e7648fead0e7a54203b744fc6acdb61f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642276, "uuid": "6c6e8987-7191-4ee9-a494-7a70a9ffeabb", "comment": "Malware payload (SystemBC)", "value": "fd0186f1f00b619ecb45adb4e958b3ce535e0e8efa195589b1c69c1cae010401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642276, "uuid": "69e022d1-e240-414b-9247-91c7637dcc5d", "comment": "Malware payload (SystemBC)", "value": "deb722094b75bd567ff8c3257af4a01b63f90459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678642276, "uuid": "c6eaf6fb-803e-41ba-9d96-12b764672dd0", "comment": "Malware payload (SystemBC)", "value": "9adf961771af089c75428d93792d83621d27bfb63920e30cf7a2eee09b21f43dd378296a49cf9b608336552aad43816e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642276, "uuid": "b5e679cf-76b5-4af0-a435-0de0e4d99221", "value": "T14054D03235C0D072C47B51345960DA95EB7EA5305639998FBBA81FAE8F303D06B3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642276, "uuid": "e7b8b91d-3de3-44ca-9aa4-e48694fc45c5", "value": "ecf2cf91793bc455a24f8d379859c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642276, "uuid": "50c60795-e23d-4b73-9ab4-64fd0ef2c9f0", "value": "3072:UHCXpKhE+CTjLkmnYWfpy5G2YthbVBkV82KjYv5Vct7A+BDR7FSD5CHJdwl:UHCM6LkmnYSp1Q82h4iStZSDCdwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678642276, "uuid": "0a83cdaa-c837-49a1-9663-1b8d4d8887bf", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678642276, "uuid": "885a6e63-2334-4321-a58f-06652a4cce3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678642276, "uuid": "c0028ada-5c1c-410e-bde6-3253dc567676", "value": "e7648fead0e7a54203b744fc6acdb61f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d9a22d-c07d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678588061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588061, "uuid": "47c2fa53-d6c0-4ef8-8234-b30ee176af8c", "comment": "Malware payload", "value": "8c280efe8c6bbd3f90324e49b6297a8a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588061, "uuid": "a2ba23b2-bab3-4fbb-9d1d-f0f67a4a0177", "comment": "Malware payload", "value": "fde817b21f7495a28616609b0a87703bf1eb4a2b7c04ef7982d4610166b81eea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588061, "uuid": "27123f2e-8492-4177-9a1e-23fe15f7a5af", "comment": "Malware payload", "value": "344b08a638a079731bf0089b4fc7ce34514d3d4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678588061, "uuid": "1e61198d-fd34-47a0-98fa-f69ad9b0c151", "comment": "Malware payload", "value": "92e1d8d004ce0842cbf92b69ba6f19009feceb161d693daa14370f85cfee0215b4097306dedfd83aca8839c1dd2d095e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588061, "uuid": "ba7b1726-78d9-4d13-b30b-a1eaa1768fb8", "value": "T17CF4F901A7919138F9FB25F555BF20AC993DBAE01754D4C7A3C4AEED8626BE07C3021B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588061, "uuid": "e8f10ffe-74ca-469e-a619-8ff91b3e6bee", "value": "e218907e8c7942fccaa0c758a9592fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588061, "uuid": "45e5fff2-5e69-4d05-9f47-6e959a9faf0d", "value": "12288:UFQgc34vLTyAiIE9+jpna3hSNrMavIurETksdIv7:eQB+jpaerMaEFi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678588061, "uuid": "5ee200d0-9d5a-41b6-acfa-3c113a565977", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678588061, "uuid": "3ea1ff61-d55e-4c55-9b1c-fc690833d415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678588061, "uuid": "f0391bfd-47f7-4896-a88d-a9fcba7e3bcd", "value": "SecuriteInfo.com.Variant.Zusy.434961.16118.5313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c881ae8c-c085-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1678591634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678591634, "uuid": "59586939-426a-4e88-a5e7-ee2d4805e276", "comment": "Malware payload (RedLineStealer)", "value": "ea2350b0968c6968b0812209c09814c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678591634, "uuid": "0c760829-af7f-4f10-a8c1-17942e5804bf", "comment": "Malware payload (RedLineStealer)", "value": "ff0d3d756d963bf9c9df4c74620d4d04bd48ee6db8f71d9e4897a5f75780c2d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678591634, "uuid": "02cb71d7-1f69-4cec-86c6-ea32b3ba3130", "comment": "Malware payload (RedLineStealer)", "value": "d73e41be99ebab6ff3183f5a0f04c38f355b53d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678591634, "uuid": "db010f12-b527-4188-b0ea-b190de6eb84c", "comment": "Malware payload (RedLineStealer)", "value": "02a9411167529e8444097ebdeff90270c2a52be1176b3abe1066d1f4c86d01f781f34e2fa86186ac1b975edd08c568fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678591634, "uuid": "0a63cc13-c643-4adf-bad7-dd915aff0ceb", "value": "T17954D62B13FCEA30E54D837AA26E962098A9247317EF0245BFC501DD4FB0A55B837D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678591634, "uuid": "0464ed48-77e5-433c-9268-b471f8ff67a9", "value": "f5bb3bf3856cb08782d3dbaa36a5825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678591634, "uuid": "4804e8a2-2901-4a3a-b900-9814c12e6d11", "value": "3072:MvimVLP0nQRgf2Rcy3rH4omPLRGy/0hVI+v/g4TOQinTvhLrRN2cCej9OTOvcszY:4imVL2QRgdnYS44hLrR/9L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678591634, "uuid": "6495ae69-d82c-4b0a-a825-5d63dd0cdb9f", "value": 299376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678591634, "uuid": "8c183f99-2059-45bc-81b8-9c3847efb2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678591634, "uuid": "6f5a3b51-cd1b-41bc-8a00-7463e53179ed", "value": "Gta 5 Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045b167e-c109-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1678647999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647999, "uuid": "3feea5e3-558d-4b16-aab5-a13d88784efe", "comment": "Malware payload", "value": "f2f0cea4d982de0c2a72b3ad036f95d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647999, "uuid": "ffa39fa7-fff7-4a2f-8119-4bbd137601e1", "comment": "Malware payload", "value": "ff5c080f472342f8394a52df7e596ae6acc9e7451d2f2bcb32f2603f1e13e987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647999, "uuid": "4c132160-7e51-4079-bca3-141afb6f4529", "comment": "Malware payload", "value": "9f95e32f3527b1bb43003ca463d0da1ea6a9fb66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1678647999, "uuid": "26723001-0894-4d03-ae3e-72fdae497cf0", "comment": "Malware payload", "value": "368b5b6e5043d5ae26063320afcca841b8cebe356896e01c24b209514dd5a65d03af95a959f756c255b9d09de0f42a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647999, "uuid": "e23d124a-47bc-47c0-b7c5-b7c0d866e4c2", "value": "T10D26E062C2747B88D4B81CEEC7ED0832009F14D13D970E6703DD99D61BF72EA2AA5E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647999, "uuid": "d6088e01-eb80-4b2b-92b9-9be79199ec3b", "value": "ce02c2c69b4ea04873b5d37f16f49ae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647999, "uuid": "e27ff41e-7520-4125-9be5-2da1756eb6ed", "value": "49152:ICs1N0xewXOBD4GaacfSG0K4ubh1992ZccWWF6ybP5XVvdDbNtOL4cCZtey+4t4l:YojKDtNkS8CRNdDJLcwZ+419RlmItbDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1678647999, "uuid": "5508b733-9ed6-4d5f-8d82-9fa6b8084115", "value": 4855664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1678647999, "uuid": "bbb613d3-e0c6-4ff5-a5a5-aeb40e3f195e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1678647999, "uuid": "c1eed869-4786-4660-83eb-d955ea99170b", "value": "f2f0cea4d982de0c2a72b3ad036f95d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }