{ "Event": { "published": true, "date": "2023-04-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-27", "timestamp": 1682640181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "58e3418b-339b-4ca3-9346-8713a39313ea", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdcb81d-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553989, "uuid": "6509b8da-4431-42f4-846e-53e03a8fb304", "comment": "Malware payload (Vidar)", "value": "b711a60cd0a867a1fbe256eaa0e4703a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553989, "uuid": "034da8b9-97e7-4fb2-bcdb-3d3bcbc60384", "comment": "Malware payload (Vidar)", "value": "005dce2ddcdfce4418c7782afe3d59d6ee9cb8a3f0a9f303ebf92b60151aa55e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553989, "uuid": "21c46941-7959-423b-8154-c17d29cd0ce3", "comment": "Malware payload (Vidar)", "value": "c2e34be818fcaf20e64218128b445374f49008bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553989, "uuid": "f12f5533-60e9-4188-bf7b-bd1d7ff84b7b", "comment": "Malware payload (Vidar)", "value": "237d3ef8c7f3aed28dc868a49d4d1b30a710a14cab0c889e33983334d2191cd8a19d72348eccf1e01808c760c531f8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553989, "uuid": "ba50c1c9-3e4a-494b-aa7d-cab1a60e7da3", "value": "T131648D4393E13D45FA666B729E2EC2E8761FF2518F19776921189E1F14F20B2C273B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553989, "uuid": "b9c3a811-ebfa-4cef-a4b9-79835e36dfc5", "value": "f4d72c3d48b97275dbb7753d2cd3f6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553989, "uuid": "303d693f-8517-495e-b1bd-18ce66635241", "value": "6144:d2H51V45ltdhwjbiC7VtvqjSbxgMlarL5d:MH5ItKjDyj2ixf5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553989, "uuid": "308eec20-6d2e-4f73-9475-23cf29b77ca3", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553989, "uuid": "d8e52f14-3106-4c5a-96fe-81648a573c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553989, "uuid": "b9d2549b-56e2-488b-a9da-4e711b81bbbc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeebf2d-e527-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682619460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619460, "uuid": "17d14d0d-bfdb-4d22-b493-c27a1afe72de", "comment": "Malware payload", "value": "17d43726e2c4b6505d3c962459a943e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619460, "uuid": "cfd24a90-2947-424b-aa4e-12bce19a7eb7", "comment": "Malware payload", "value": "009d74425719609ceec9b819ea424cd50772f4e5cea308108ea7b8dc434e3327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619460, "uuid": "f902098a-cc73-40d1-8518-c98d42958fdb", "comment": "Malware payload", "value": "f61ce8b1994054238671823ea6e17e0c0a4bdd9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619460, "uuid": "769cc480-ca23-4a26-af50-51098c4fa1c6", "comment": "Malware payload", "value": "e7d89fa567dd0e192c55345e7a5d80d8b4df33e50b7bba9cd43f2dcd48ab1b5b1fe89b31c26875fb7527b3d2a3c372e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619460, "uuid": "2524ab6b-c9e5-47b3-9f49-7ea3bbd3ade5", "value": "T12DD4D0CDE34D02B5DF9AE5B14FD1BB9B28C6D2D229206CB83A3C45A4E54E73DBB40185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619460, "uuid": "05c59fc6-8dca-4a6a-9af4-2fb879a94d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619460, "uuid": "26890f44-ff9c-4ede-9e17-7d2d5534a716", "value": "12288:GxGqlMnX8L+dTogLD8iuFKoYLbOdEG7crHUdzDpiDL344:yEg+ljD8wxLP8cr0SDL344", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682619460, "uuid": "c89f7bc7-53d7-4e38-b8c4-e1e809d6f56c", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682619460, "uuid": "ff5c00d5-116a-4eba-9608-bc253017a2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619460, "uuid": "c1d94000-e6d3-4428-885c-97adab5bc42a", "value": "d1bVQedD65ut9Ie.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c266e85-e4fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682600804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600804, "uuid": "0a310ee3-0364-4545-8cd2-46e2641c1a1f", "comment": "Malware payload", "value": "248646106dd2cb102d4a5c6e1e822c87", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600804, "uuid": "05bb6ef4-2e97-4442-8269-bc0e1dadf7cd", "comment": "Malware payload", "value": "00d87e984f0fcd2e8fb55e4b83d86027dac67fd073958a95cbc98961ab940f4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600804, "uuid": "c86cf1a1-6c41-41d9-9112-282f9f8ccbe5", "comment": "Malware payload", "value": "27b56b3519c1526dc95b59917e89e413287d80d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600804, "uuid": "00e5f057-8945-4f94-b902-48fc9daeee13", "comment": "Malware payload", "value": "5a688f73f6ff9f392e5d3e91245b91397156a2fde69d22225dec0db5cd5ced3460dfb9b8784d32533bb473907c5fd805", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600804, "uuid": "9d371138-7972-4087-a0d5-dc1c9d65a11e", "value": "T1D0B2EBBC28E361949563B27F560FA804B1A455870C79FE29788C72609FDC23C83B5AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600804, "uuid": "fac9216e-0047-49bc-b248-9c3a440aba73", "value": "384:wWhLYkkI4U8ESd9h04BCllDkacIRgVQNNyUqZw:wWhft2EV9kaH8Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682600804, "uuid": "03ff26df-f987-472e-9897-35c5cf9daa43", "value": 24526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682600804, "uuid": "6b9e3a09-4d62-4b33-8af7-bb04fbb1d692", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600804, "uuid": "36c5eb5f-1b85-46a3-a57f-4d477e27d8d8", "value": "order_details_Y7Xwgku4.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554753dc-e533-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682624415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624415, "uuid": "939c080f-56bc-40be-bb86-4c8ea5983ba1", "comment": "Malware payload (RedLineStealer)", "value": "4b1bb754f64df3f1e99cd0c7a719bd9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624415, "uuid": "68824571-e5de-4985-93bc-8819c1b48ab7", "comment": "Malware payload (RedLineStealer)", "value": "01f093f3710e5946b76aa98ab56e2b4e5b41e8a8ce3eb80dfbf14cb3bdb9c99d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624415, "uuid": "7aee5307-4084-424d-9594-d30f3d44beef", "comment": "Malware payload (RedLineStealer)", "value": "9f7db3e6d114a55b8b07aad5f55b83572420ed92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624415, "uuid": "0e21e53a-134e-4331-bbb3-327371fd088d", "comment": "Malware payload (RedLineStealer)", "value": "37fe64ad217d972cc9a5e97b5d42a13cb182c9d63cd48095cb2caaeff8fcbb3d8759f84f5efb817ea3aadd597f7c32ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624415, "uuid": "b191c6b1-906f-4041-b6b2-2c4b3f37f463", "value": "T188F41223B2D84632D9E617B15AFA13C30A3AFCE22F64529B77916CCE09B25C09471777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624415, "uuid": "04c58514-ed63-45eb-a77b-23c9a1ffae2a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624415, "uuid": "aced7dc0-ab95-401b-bdee-7f0320196dfd", "value": "12288:1y90JdguRKSJ5x+8HQT29T7PnUa41lA9E07L9g6CkzP9ObKMshC7IVlEAxa6YVph:1yyAS3n2GLa5WF4KNRVlEA46qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682624415, "uuid": "227c40cf-cf67-4139-8ef4-4ec3dc034c68", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682624415, "uuid": "9615ed06-f983-4a8a-8e28-f366fd496ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624415, "uuid": "9856b513-e8b3-477f-85fe-18ec44029a27", "value": "4b1bb754f64df3f1e99cd0c7a719bd9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae82c2d-e54f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682636531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682636531, "uuid": "0358ef72-dadd-4725-9ac7-fb2dbda79c74", "comment": "Malware payload", "value": "9281c7ae3964758c9daf6101432d6492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682636531, "uuid": "f8bd407f-7dd4-44bd-b29c-3fa0e9695bcb", "comment": "Malware payload", "value": "01fe7a9f9aea5d0eb542105e15381a4cadc190f20603f83b79ca3a6fe83e2dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682636531, "uuid": "bb3587f8-fe6f-4421-b5b4-79ffc9a6b637", "comment": "Malware payload", "value": "09a15b5b38faffde270e5cd2171cc87ad8157711", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682636531, "uuid": "6b2d6064-89ce-4c76-b446-0224ab6efeb6", "comment": "Malware payload", "value": "2d3c415612f2d46f68c4ee27725faaf85eadf39e3724e18b4b8f1ae4849ff5a87043203a1d20f5bda1c74e53e30764fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682636531, "uuid": "936eb317-22b5-46b7-8d3c-952db7ad2047", "value": "T1F8452312A2CC5032E6E517F068FA43830A36BDE3AF7542AB23456E971DB35C499317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682636531, "uuid": "95ca7c94-0303-4de2-85d3-cd4f7ba57500", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682636531, "uuid": "7e42516c-70aa-48a4-a04a-63ab6a79159e", "value": "24576:hywnwqem39pChpOnbnZ1DTIZDfDrqyZca3AwdB:UytemCfObZ1DeDf/qyOaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682636531, "uuid": "28dcc52c-da03-489c-a465-a453536ca306", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682636531, "uuid": "33db720a-3c48-42c6-938f-816aa0df1a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682636531, "uuid": "48ab9020-a6fc-42d1-a7f5-76ba1bf1c310", "value": "9281c7ae3964758c9daf6101432d6492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eeaf2a-e4cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682579777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579777, "uuid": "d5ef4838-bd8e-412a-9ff4-f454772ce218", "comment": "Malware payload", "value": "fc6925e4bf5f890a1c62a406693cea77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579777, "uuid": "64f4aa2d-f940-401f-8edc-930b520c32cc", "comment": "Malware payload", "value": "03f8e0b404e2ff092e515614d63a8dd3a167ce5df128ae3b0406c07708ad3310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579777, "uuid": "efd8a8ae-db40-4506-bbdc-cbe4a7491690", "comment": "Malware payload", "value": "595e9e5c1736f28acfeb529a695fb3eada2602d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579777, "uuid": "89373d33-db65-44df-825c-03a544fef709", "comment": "Malware payload", "value": "efef9540fa53896eb72c4319695a5309000c095dd96ee003f8120d3719f7a96cd3a8a168ef76a280cb4cc379192280fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579777, "uuid": "dcc25cde-e116-4e94-946d-3f8e1fe2094d", "value": "T1F0258E382BA6CE08FFE281F0D5E50212209DB7B4C525E745CA361D35C9B2E857FA27D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579777, "uuid": "61f9054d-38bd-4368-a3d3-ff8dcee6513a", "value": "12288:Mp+tJodRhl6EEDiXnx6rjxI+JXFxN+rsH4ctY6rJQyz45dHdsVCzMtgBRWQ:HojWIUvJXFoy+dHdmCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682579777, "uuid": "599ef924-f84e-4821-83c7-5d940946ae32", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682579777, "uuid": "be962977-e8c4-4e04-a5ae-0951cade0b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579777, "uuid": "40cc4e04-e74f-4f48-845e-9608a2d668dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a79044-e527-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682619315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619315, "uuid": "465c49a6-c83c-4c52-82a5-1b7899e47409", "comment": "Malware payload (RecordBreaker)", "value": "0bf7ebd17797542feff31918b60e62fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619315, "uuid": "69d80f4f-4a2c-4d5f-bf3d-574af29a7330", "comment": "Malware payload (RecordBreaker)", "value": "0411e296abd55cdcaa456dc348f7ec2283786ababa91f06e2349d81bf73fa1a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619315, "uuid": "2583f8f3-9e48-405f-8b34-b7bfdfd1a1bd", "comment": "Malware payload (RecordBreaker)", "value": "51d387ac5f86ea4c534bc175b5080fc450700db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682619315, "uuid": "231b07b1-71ee-4a67-a077-97a6d4ab8d72", "comment": "Malware payload (RecordBreaker)", "value": "d0400eb25296ee486b2aa4fcb01c2b39616d1eb16f67a63587bc66042876b7089cc00f67b28d50a6a02214176b4e9a48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619315, "uuid": "59e3e256-aadf-456d-953c-52afdac448a9", "value": "T188C4D0269F639819D08B1139035EB52C913C694A6F6166E3C438E0B85936EFC9734BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619315, "uuid": "adf59849-2b52-44bc-b595-ec778b02be6e", "value": "6a44aa7b71823c8c87d212261eb4607a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619315, "uuid": "5e115153-6c3f-4213-845b-54513d7a9805", "value": "6144:ocLV2X84KEnO5TNhQXRaX2DjaQ9J6t7vcrXgNzDT7uWydETYPD2C5nbry:ocLMKEn6Toh3DjJQSXeTj3C5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682619315, "uuid": "89ae2dbd-29f2-4373-9fcc-7e09e0df63a6", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682619315, "uuid": "e9c1563b-b68c-4b3e-9202-336a124852c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682619315, "uuid": "4e5ba16e-fcdb-4905-8481-d7862adff95a", "value": "0bf7ebd17797542feff31918b60e62fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76561ad8-e4d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682584098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584098, "uuid": "45ad57b2-b101-48bf-9a51-ca9db9540114", "comment": "Malware payload (RedLineStealer)", "value": "042f6ee1428d19409c719956e83f00a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584098, "uuid": "3db23111-b318-4872-b9b3-e3890e952c68", "comment": "Malware payload (RedLineStealer)", "value": "0704f27b1964f5620c430e260e3c17a1071f6146d5b9a308ef30099cb04a7d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584098, "uuid": "f3220781-09b6-4cb1-8763-af82a37a1d4f", "comment": "Malware payload (RedLineStealer)", "value": "21d9a1411c444b6933c7269f743eea69fb40703c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584098, "uuid": "bf15c6d4-4397-487d-8b4d-2577e66b5fbd", "comment": "Malware payload (RedLineStealer)", "value": "7b916415f077c12aac5efe3ef5534f435c6a9514a031cc0dcb62a1a920eef645d3af1ec6639cb2a8eac1ea52f5d3b708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584098, "uuid": "ac86661b-d49c-4899-9038-4db78d53ffbe", "value": "T10B75E03217A6BDEDE37F0D3CD84A19690CE868BF911CDA78788420CA5575758EF22CB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584098, "uuid": "7236b87e-36b1-42ae-b3eb-45c5e93c68b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584098, "uuid": "b03fdcb5-72c5-42c2-b331-85c4315500b1", "value": "24576:nckwmHaHwU4dVBCaq01IYM/ljQmXy8RZVc1FYVfpTa9OFs3:smHfuyKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584098, "uuid": "c4552543-10bd-4363-ac7a-e32735733d27", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584098, "uuid": "c83a7b55-4a1e-4476-beeb-621db35a0291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584098, "uuid": "0b5ba778-93b7-4f37-9d7b-fffde5e5a140", "value": "SecuriteInfo.com.Trojan.Mardom.MN.9.12323.7787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f7506a-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598381, "uuid": "9f5c1eaa-f84a-4946-b793-9a78513a18a8", "comment": "Malware payload (Mirai)", "value": "7226bdb8ea06fe717504a7d2bf2dc738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598381, "uuid": "7a40d1e1-c255-434f-b9ea-629e6fb03ed6", "comment": "Malware payload (Mirai)", "value": "075467a25012c98f2c1d40ea10528e195e387bb3087733e21353b62112071a1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598381, "uuid": "00aeab68-dbbd-4fdc-bd54-5e5faa9913a1", "comment": "Malware payload (Mirai)", "value": "23c7864619dc44af009a5e622fde9f1460ca333e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598381, "uuid": "d87b8218-e819-4718-a8d3-1c5f2de085e8", "comment": "Malware payload (Mirai)", "value": "aa620395ea051a0971edeba88601e9bd1542ddf5bdfc181671860ff2ce3d6f852ad6efa96f69412f895f25d63a60ca07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598381, "uuid": "19c55e5b-5a64-42c2-9ca3-060a1f20c796", "value": "T18383B40A7E218FADF79D823547F74E21B75833C527E1D285E1ACE9015EA024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598381, "uuid": "3389fafa-7dc3-41f0-89de-42fff569ab7d", "value": "1536:/hX8g7Kjc2OGarydMSy8zO/78benUHVwbZnr4r:/hX8k4c2OGaKMSy8zO/78PHVwbZnrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598381, "uuid": "f32e3624-d0db-472d-8415-526877fa453d", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598381, "uuid": "ca9fe01c-596c-4ac2-8c7b-8a1bd5fb64f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598381, "uuid": "bfd6f0a6-c649-430c-a554-98f81f55f08b", "value": "7226bdb8ea06fe717504a7d2bf2dc738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15180a8-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597108, "uuid": "cddbdc39-8497-473c-8853-85a7458263d4", "comment": "Malware payload (Mirai)", "value": "3f264c0a215e8f8633f55bab14a18583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597108, "uuid": "57fd67ae-0dba-4a49-813d-3c75d6b1459e", "comment": "Malware payload (Mirai)", "value": "076da9ee595794df45bcc17084851456b3b8ffa9f850579bd3975df487dcc24d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597108, "uuid": "b5212f44-6290-40dc-8a64-852adb709a70", "comment": "Malware payload (Mirai)", "value": "fc8300dc16e14d908e690b8f0b0da3a6ff4d7eaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597108, "uuid": "2124a69b-cdae-43d9-b60b-f197d67357c6", "comment": "Malware payload (Mirai)", "value": "7cae57af2eef6c75246a5205d08c494850e271cd1b857e8be113aec58b6e75277f50a933081218fff113090188080428", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597108, "uuid": "0f253b6a-db59-4a31-b644-0ca750cc6a25", "value": "T11A435A51F8819A23C6D1127BF66E028D3B2613E8E2DB73079D229F2137D682B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597108, "uuid": "25b741cd-ed72-4726-9582-4fbf79531e9a", "value": "1536:im24T1doxQlKXnBvDjgWDH9apyaiC6ravnnar:R27npjtDd09Vnna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597108, "uuid": "54a5c022-3b7c-4c8c-8326-057b12f0078a", "value": 59256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597108, "uuid": "f219c484-2633-4374-bc17-5f4523c11d1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597108, "uuid": "d436c977-4d1c-46dc-9c3b-b326473fa1a0", "value": "3f264c0a215e8f8633f55bab14a18583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35b5c9-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682592966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592966, "uuid": "7b9b5282-7433-4004-ab39-2a353b7575d5", "comment": "Malware payload (Mirai)", "value": "ba3561b7e8184449b18d798ed2fa6c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592966, "uuid": "a48b02f8-95f5-4372-ab0e-9b5c51bab14e", "comment": "Malware payload (Mirai)", "value": "07a9e3fc3f336cdd125200f02d703afb17116c701c6d132856c7c40427be28ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592966, "uuid": "fb799b25-4b35-425c-af0b-5e215d4bda03", "comment": "Malware payload (Mirai)", "value": "f314a9b5ca2f58cd59671a563de191b22c41a31e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592966, "uuid": "e0062e42-5b7a-47a4-842d-c5051c9c6fb2", "comment": "Malware payload (Mirai)", "value": "b8825bc8d7678903f770a3f255c4da1b95ed914854dba518b2990fbdef622e8c7fb4b0494e87612e3ef6bf4dbea9c667", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592966, "uuid": "cfeb8108-6d2b-4b91-8bcf-7d2cddc6157b", "value": "T1612329C4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592966, "uuid": "5e08721c-3bbd-4a43-988b-65f30194e9d1", "value": "1536:4LInPCqAAXJLE7cxtdG8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdG0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682592966, "uuid": "e4135675-3a38-4a9d-ac35-ec680f60a705", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682592966, "uuid": "8083fff3-a990-4a47-9633-519ffe831da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592966, "uuid": "5bd55058-f9df-4e08-8bbd-8cbd043c9e7b", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9021c26-e501-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682603108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603108, "uuid": "3ddf362d-d978-4378-9510-185eace667fd", "comment": "Malware payload (GCleaner)", "value": "ca20b663a93e868d96e56e220143b8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603108, "uuid": "325a7647-0142-4b6d-9502-12b129c3fa5a", "comment": "Malware payload (GCleaner)", "value": "08df2ac3fd0fb504126575f3ade8c98a47658aec539843317b639026fae9fc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603108, "uuid": "12c810f1-1c3e-4c33-926c-38fb1f115754", "comment": "Malware payload (GCleaner)", "value": "efe7399d09a87c8d40d3f31ca64b1130590d2f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603108, "uuid": "14fd5b2d-98d5-466e-a937-59cfced96b93", "comment": "Malware payload (GCleaner)", "value": "0f3828d1b69f8ffeb00e706f536e0a3b9c7c6305ee8065aa38e8d6a6b22487b510db26803840e98e2d0c7fc9f97eb881", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603108, "uuid": "0f52f791-89e9-40cf-8870-d953bc022f9f", "value": "T167E5330AB1B18471C37079B0DB0BE535C217A568DABFE58073ED5EFEA357652A0413A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603108, "uuid": "f008aa75-ad57-4860-ad67-59a1180983ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603108, "uuid": "e8ce4709-e2b1-4456-b33f-bad1bb3bbc5b", "value": "49152:EGlJfstq9YrlGiygWilzFY1wgV2GvgKHkul7vpq+Xl5A7uGCCWoFdSVVGG3dDWHw:5cA0GinDzFY1pV2GvpHkuVvdl+7ouPST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682603108, "uuid": "9cef2a51-d3d6-4259-a825-cc6dc3b6f6de", "value": 3069735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682603108, "uuid": "fd8e1c73-4ce9-4d08-ac09-9973a8581e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603108, "uuid": "96c6db9c-ff4c-48bb-8888-5cac34490ead", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb81b9a-e534-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682625018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625018, "uuid": "0f7185eb-c2be-4808-b4db-c27cf963e0b6", "comment": "Malware payload (RedLineStealer)", "value": "193febebb57c5d44656c5a29e2901aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625018, "uuid": "6564df19-ef12-44f6-b22a-2ebc43108e55", "comment": "Malware payload (RedLineStealer)", "value": "09810e653d1acdd8a4575734ca34f8c972f37c803c8d6903ed781a3347e00798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625018, "uuid": "115eda3c-5a54-45de-adfc-be3b72599290", "comment": "Malware payload (RedLineStealer)", "value": "3727392170f568a1dc7569813706c479dbe5aae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625018, "uuid": "29231909-4503-4666-bcc2-bb360f2fd8bc", "comment": "Malware payload (RedLineStealer)", "value": "eff0542d3dda8cbb5ae867fe818a99523b7fc55d94244d644d54a72c6cbaf508bfef9b3d43e0047357db5a46ba2f59c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625018, "uuid": "15cc9406-fb8d-4cd6-95b2-93e3b8da8d1c", "value": "T10AE41292B6DC5072E9F517B00CFE03530736BC955B7442DB6B8A968B4CB22E4B53632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625018, "uuid": "7b8a8173-2fe3-4047-9b39-8b6df8ff1a48", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625018, "uuid": "00093982-16b4-4d83-9554-2508c89ff185", "value": "12288:5y90xP/nRON+mchYzyWSPMn3Pu6x3ZU3gRNvpjYH:5y6f42uyLPM3/XTCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625018, "uuid": "46f4a030-ee3d-410e-9326-4e9d3a4e6178", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625018, "uuid": "1a5979bf-f256-4533-b258-fca49e0c570b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625018, "uuid": "e52b658c-03dc-4793-9706-a49f691a3360", "value": "193febebb57c5d44656c5a29e2901aca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c106c99e-e4bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682574774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574774, "uuid": "8178148c-01b5-4a97-9156-679e94bb4bf0", "comment": "Malware payload", "value": "fc6a689095a3f74ac336c4c3968108ff", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574774, "uuid": "040cdcbc-6d90-4975-af66-bc78e44073df", "comment": "Malware payload", "value": "0b86c2794e8c07a237d80ac1b0d1ed7130666e8d8ab4762a7e7c0ef717cf7380", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574774, "uuid": "a2c2bf8a-69db-4b83-bac9-e36bbf8ce109", "comment": "Malware payload", "value": "6072dffc994f5ab22a4b7320d9caba21b137b34b", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574774, "uuid": "8e9c8dd0-be09-4e28-aeda-1dae5ef9aa77", "comment": "Malware payload", "value": "e9b54741b9794ab5b2215ce2c30c4e89778128556fc0432c4d237d693fd77fff68ef1cc1de91d397bac9374c95a8187a", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574774, "uuid": "7dae3c26-154a-41a2-b498-8c803b392cb1", "value": "T10BD4239D505C508CC4C5F5C8FA3D4BAC9ABF196F21732D5C9BAB2CAF12B26A104C2797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574774, "uuid": "d5e93f48-6f94-4558-a249-760d0be3358d", "value": "12288:8Xe5od4GlT5Z+/O5RjKBI8AeNNQqW7aJ7luADCNr1Gmn6Sv3:ITHlTX+m59sXpIqr7luD5J6m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682574774, "uuid": "79c20f39-c6c4-4658-b209-fc6ffb92a243", "value": 610031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682574774, "uuid": "d59c45b1-2da7-4dc1-b4e5-378f9cb16ddd", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574774, "uuid": "08792b8b-96e5-4e7d-9dcd-c9e9631846b9", "value": "DHL-AWB 764312.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17b9b27-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597189, "uuid": "ced8c3cc-1df5-411e-b794-71296196343b", "comment": "Malware payload (Mirai)", "value": "e10516ce1c07c564c4886a4fa5226712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597189, "uuid": "3e97fe83-68f9-4a48-bdb7-570c2d8fe81a", "comment": "Malware payload (Mirai)", "value": "0c3ee9e6230541d4d1afa14bfdc26d5f5d2925316ee932035f7449ee456ac406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597189, "uuid": "ed47c969-3a91-4ad5-8138-3e9cf55f3768", "comment": "Malware payload (Mirai)", "value": "d640e684aeacbbcb629a0e9871427e969bcb9bf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597189, "uuid": "60ddfbfe-2ec7-4bd2-8533-ddaebe477c10", "comment": "Malware payload (Mirai)", "value": "e0adb4f845bb8a8a6a9879e3f8081866916fd15d8b7907119584941842bf25cc3f047de3eb25514234aa5afd352bf138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597189, "uuid": "02af3fbb-ccab-4777-90b1-1b6415b840b7", "value": "T102E30976A4A35EB7C0126975357E2B640F29BD531F0F0997653DBAA0077B0CBE00EE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597189, "uuid": "d2607fa0-7fdd-409a-bc55-0312504de066", "value": "3072:mr5oMcsll6fpzOiT38RVuGmeX8TwacJwjOjIDfW4AG0bagaF:mrGjsInrEr+jOjIDfW4AG0bagaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597189, "uuid": "8a3f379f-0086-472a-98a5-82b441347b17", "value": 148073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597189, "uuid": "7d499029-329b-4c70-9577-1a3d0f7c7b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597189, "uuid": "a82f5772-9b15-4f40-bec0-18087558d3f0", "value": "e10516ce1c07c564c4886a4fa5226712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce96b437-e4ac-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682566636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682566636, "uuid": "2c9ca45a-8b15-4a71-8c6d-6d933dbd54f6", "comment": "Malware payload", "value": "4a1823df8b1b452cfb680a7d6bf7b115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682566636, "uuid": "90044fec-52e8-41c2-b05f-bdb5e1ae6a9e", "comment": "Malware payload", "value": "0ccd637a3d8d60609f39f1ac207dc9327079348a8f3c921d65b1b05911a6b947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682566636, "uuid": "4d60800d-bd4c-405b-aa76-d72f15d85beb", "comment": "Malware payload", "value": "967f5a30addf1ef5322295081c03f007a6f45110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682566636, "uuid": "a7d43289-885c-4814-9048-3fa847721824", "comment": "Malware payload", "value": "87966efe1c758b3c2c80af3bca483b1c561f1a0353234758f1cad2ae0439d64e8d5a24cee2f680a07ff4a69c8e0d0324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682566636, "uuid": "37a40024-8b52-4522-8195-280c75a9e617", "value": "T1B1A35D30679C9F19EAFD1B75B472012043F0E08A9091FB4A4DC194E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682566636, "uuid": "f04d2ed2-af95-4ccc-ab94-76f3324944b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682566636, "uuid": "29863327-9724-4027-b2f0-7608d7c0772f", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2j3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682566636, "uuid": "9f3cbe82-4fe3-4ee3-9032-0ce55163deb0", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682566636, "uuid": "31a6bd60-2d49-4b38-8c0b-7237b3ea87b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682566636, "uuid": "973b9375-0652-490e-8dae-cc839e048d8b", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308d2bbf-e541-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682630366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630366, "uuid": "9f51a47c-8b24-4c1c-9872-2cc5be7200a4", "comment": "Malware payload", "value": "f2ec1d5c618be0e6050aa480cc00aa14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630366, "uuid": "53000b5a-da58-456e-9d81-abb4a86cde1e", "comment": "Malware payload", "value": "0d5996e68d654bb1ab31c89ae0a5b3c810f9f761f20df825d4ab5bba3d510bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630366, "uuid": "d1f71a61-2cab-48b3-b324-ec338114f86a", "comment": "Malware payload", "value": "b8d4d6f3e345c96fa0e32cc0dd6298b36e480157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630366, "uuid": "e51f55b4-116d-4ee4-a349-ed9ac314627b", "comment": "Malware payload", "value": "9cb29a641e61d90934a0a40123da5970328b82e5a4575b1bced934e99b4c8f58758c58137fec9df16053801387c5901f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630366, "uuid": "29831dc2-e067-4fbc-81b2-3ed3d24f78e3", "value": "T12CB4810C7A668DF0FF6E1AFD65A11B104739B6139208562A1FED94C91BC328D8F458FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630366, "uuid": "0622bae7-add0-4f7c-9c02-81e56b4e931f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630366, "uuid": "6df794a2-b5ce-45b0-8b5d-484fd6ef3080", "value": "6144:lNYCitV/mPzmlrPetJ6W6XA0SKZ9bAtxtSI3i/I0VTFo8agThv:cBJW709otxt/CI0VTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682630366, "uuid": "e63c4bc9-2887-409a-95eb-2aa1b9da5f67", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682630366, "uuid": "cb4b85df-d682-48ab-9d7f-a3fc008fc2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630366, "uuid": "bb8f4a73-3a73-4c3b-a275-5027fd466b04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94378e91-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598321, "uuid": "02424ae9-5da4-49b2-9814-909c199195c8", "comment": "Malware payload (Mirai)", "value": "9b5d493f8471037ca112304aba40a253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598321, "uuid": "fcf76d42-fea4-4ffc-818b-04b357ca095d", "comment": "Malware payload (Mirai)", "value": "119f77a217637c1555edad8374dae83333ec5d85fcdd7323a4a0ff26fffd930a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598321, "uuid": "769f2695-0a5b-4cb5-bc33-5ed6b84d296c", "comment": "Malware payload (Mirai)", "value": "97613289db2af7538a4dd186080bfb93046e7cf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598321, "uuid": "e8731ac7-99de-4dfa-ad83-83b460e928e3", "comment": "Malware payload (Mirai)", "value": "a3a6446cd1e95decd6dcd25efe7240a33071acc34033aa7d6661297601c6d9fc935bcc79d2c5f7ed3bd4f30f4110b9ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598321, "uuid": "8c8a08f8-86cc-4c8c-a673-d10f5fe5bb31", "value": "T1F5C34B36F607C1B3C4430A79024BAA9A5D31FE77562A4D8EF3583DB4BB328C47521B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598321, "uuid": "0f2adef2-4577-496e-a377-6f868178098d", "value": "3072:EXY5gzI24XRFnDjmoRcQeFxfusim3ZkvhzD9oY4giAGaJpP:EXY5BDXR9Jc5Om3ZkJzD9oY4giAGaJpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598321, "uuid": "e2f4b6a6-8e75-43a7-a584-5b70c378b283", "value": 127274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598321, "uuid": "31f1bf28-bee7-45c8-88ea-dd8205039384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598321, "uuid": "6784f19a-4da1-4f55-b881-96b6ce11c59d", "value": "9b5d493f8471037ca112304aba40a253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f75c762-e535-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682625318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625318, "uuid": "ea05c4cf-ab7c-43ff-b439-eb1022ee75d4", "comment": "Malware payload (RedLineStealer)", "value": "bd17cf0b20a52cd2e6b8550257854f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625318, "uuid": "9ae606d5-67dd-43e6-b197-3d700cf9b72f", "comment": "Malware payload (RedLineStealer)", "value": "11ecd9e6c1c28244fe80686c531c851f64c73b288732d53af945159e96fc1065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625318, "uuid": "4a2cca89-2be6-4928-bf7b-109449fa5dfa", "comment": "Malware payload (RedLineStealer)", "value": "054cd955564e51b06b029a8bc27766b13def6e08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625318, "uuid": "8ff77508-214f-4e0e-b257-65455facd8db", "comment": "Malware payload (RedLineStealer)", "value": "19dabddf0dc3ed52687fe3ba720b501bb54836b349375ca51736282646faf5934c0e9277e488e1544890f2dd4992a6ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625318, "uuid": "52e2e31f-4688-4355-8897-a815d1b8104f", "value": "T139452352AAD44633E4BA277014FE09D70F39BCE2AF6563EB2A54BD8A14736C45830737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625318, "uuid": "910783ab-2704-4d0e-a8e9-b0102a4da6bd", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625318, "uuid": "21d3afb4-a48d-4fef-86b9-875c3ad396d1", "value": "24576:6yh2k+ejptvtO2tRkeMqZnQGS0K1apWDDN4uKISgoYZHsQ97:Bya99tgqZnQoKM6mASYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625318, "uuid": "2aa73951-2074-45a1-9e5f-4cfb61afb508", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625318, "uuid": "e33a2c18-7577-4ffc-8438-584aa86f100c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625318, "uuid": "2d59e181-2173-4517-808c-c5317a1dbd3d", "value": "bd17cf0b20a52cd2e6b8550257854f07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45b8a9e-e4e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682591557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591557, "uuid": "d22618e1-b8c9-462d-9cbe-5adc70c68386", "comment": "Malware payload (RedLineStealer)", "value": "b2f8eee175cdc5c82d14af31b833a808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591557, "uuid": "085a2f98-5524-4a5b-b436-f84cd383280f", "comment": "Malware payload (RedLineStealer)", "value": "1210bf06d11e38b627b8b1080f45aa8727a4ca66ab5e71d65857982ebc311451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591557, "uuid": "4eab2150-d458-46c6-b7dc-426066987736", "comment": "Malware payload (RedLineStealer)", "value": "585a193be6effaae2c97307bdc452433230f4e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591557, "uuid": "ba26cf11-2c3e-49aa-a604-77b9cee373f1", "comment": "Malware payload (RedLineStealer)", "value": "bbfe56c08a39ea5ce8dd180e30402020aed62c6ce8bacede4979f5e205bf78fb604e29b33a5bffdb99781c44342b4c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591557, "uuid": "487ba781-3d8e-437b-80c3-a253e684f550", "value": "T15B352353AAC89726DC7103B114F702831635BDE05FA8C3DB674969EE6CB36C4693272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591557, "uuid": "93eff0f9-7dc7-4039-89a4-22b295eba10e", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591557, "uuid": "850fc296-e680-40c4-8f60-abc174307754", "value": "24576:3yojSmIfwMb6+l5NAX8tYKKoM9i7+s4NZbdxVRT7R0Fu6A:CG7S7rzNk8t8z9JzBvR/RP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682591557, "uuid": "21a963d8-2aa5-4752-be61-a1d2040f696b", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682591557, "uuid": "fb958298-c1fa-4cb4-9a33-11bbaee3df48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591557, "uuid": "21c9b2cc-3a45-435d-b2fb-640e391670f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ec30db-e4fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682600960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600960, "uuid": "e09c18be-7fbc-4667-bc85-225a34a0e259", "comment": "Malware payload (AgentTesla)", "value": "bea327c4b9e5be6e2443d52be22eea09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600960, "uuid": "b744b83a-e343-48c7-a12a-db59c63d20cf", "comment": "Malware payload (AgentTesla)", "value": "1550a435aba0cb055a5412c79c4b3e659763f7eb78a8984e6471212b11c57d14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600960, "uuid": "aa8dd5cd-17e2-40a2-8ac6-35c37971870f", "comment": "Malware payload (AgentTesla)", "value": "3efcc3911ddb06e304350b4f6f1aef028c8b173b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600960, "uuid": "ea75fb6b-5458-4c11-abd0-4b1a0855b41e", "comment": "Malware payload (AgentTesla)", "value": "82c2360af76bb73e77e6eccf73094a06cb56e0f2da2359da3b96ef6fac357e2b5876b44acdf71664ed4738bdb189ca71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600960, "uuid": "4fe14cd8-0d04-4339-a7bc-303d40cba14c", "value": "T143E4153C09BDE23B91B8D6A58FD1842BF740E56B3115AEE6ACD347564316E1234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600960, "uuid": "f4eee112-a5b6-4faf-b3b1-00c8ba950777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600960, "uuid": "2abf83d1-efe3-4d4d-af99-b2ec2f154133", "value": "12288:ZV9B637JL7sj5w4+hQKxYsY2zq2aPLHbLxW3vJF1JtS/G+:ZBq7Oj5w47Kxi2q2arbNWfTvaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682600960, "uuid": "0fe1eb6e-1320-4a16-931b-0788e40a76f9", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682600960, "uuid": "20a1fbf3-b754-456b-94a6-3f5af6bf2af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600960, "uuid": "31a59dea-3b3b-4489-a2a8-5df37109ea21", "value": "damianozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a289a68d-e542-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682630987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630987, "uuid": "09a1fce7-618c-4d18-a790-07743a30a48c", "comment": "Malware payload", "value": "45760160e9464f1e98593efd4e3d2b7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630987, "uuid": "3f2f609b-014b-4ad4-bb49-9035aac0ca0c", "comment": "Malware payload", "value": "158d33b73d30c564636b62cba4971821eb0962847ac1207164b9305445fec810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630987, "uuid": "cd458c74-54f1-4f8a-9a7a-83d3f4054da6", "comment": "Malware payload", "value": "c90413ca2285184d0796386fb4428fc84715f7f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630987, "uuid": "49402afc-9647-4905-a932-108dc0d21aa5", "comment": "Malware payload", "value": "aefa19bae2bd1f1ddfe4aa532d1219364f78c129ff1356cd701ad99cdd0a4304f6232e6903bf4d645b76e744416950e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630987, "uuid": "d6c56aec-d5bc-4759-b9f4-a0eb4fa3e759", "value": "T105E4D0CDE24D1276DF9DE4B14FC5AB9B19D6E1D32A307CA83A3C49B4E14E72D6B40284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630987, "uuid": "ccf993c0-4abd-487f-91f7-7519ce894e79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630987, "uuid": "8fb07982-6ab6-4851-9e6e-46488e06ebef", "value": "12288:BPRAsigfgo4mJeZGvCU7WZcgoCe21ZI06d3837vvBbLzm0G0kvQbLB4:DRDJBL7WigoMrt3TZXzNG0vfB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682630987, "uuid": "b0e72828-ab18-4212-b788-8dc08bc014e9", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682630987, "uuid": "9aa75bfe-5540-4cc0-850c-41dc6c14c430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630987, "uuid": "633c2bf1-69ce-4776-b83d-b379fa67d770", "value": "PO 52031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319b8730-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586130, "uuid": "9d68227c-f518-48cb-a6dd-efd33328b0dc", "comment": "Malware payload", "value": "94bf6337e2659b50dfc2061d64dea34c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586130, "uuid": "d5b00db0-661f-4325-8bdc-08f5b8376d86", "comment": "Malware payload", "value": "15f90ec9db0f559c33a51d1dfcc3fe44df3f348a1dfb3d29c9b3a364b39c3e9b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586130, "uuid": "bd664975-0a9d-461e-9034-a9ebf00291f9", "comment": "Malware payload", "value": "86af8516e5a3d9412465a051715d15da40629d61", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586130, "uuid": "9b92aba3-d2a7-4b6e-a4dc-bcdcd98eb628", "comment": "Malware payload", "value": "ca0a519009185b2d0907ba0186f82f9c395e13ed989d4d9f305219d4d40e8b34a1d2d92ad53fb0b6a6b7283a4707777c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586130, "uuid": "41273942-7504-4b88-9d96-11219abfae2f", "value": "T11C45E003E6458E6BE61583B17F03898717197E227A82F897319E374F6B32FA05D6760C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586130, "uuid": "8a3d7565-67e1-4308-9438-815849396747", "value": "24576:6LKRw2VKz8VQILsBG4LcMrJxX6fvyvFsfVqZE5grn3ucbncAZ/:6LKPyG5qJxWvyvFsN6ECr+ypJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586130, "uuid": "398169bb-c5c7-4f97-acb6-81c4654c20bf", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586130, "uuid": "5c2b91ff-6d2b-4a3f-9391-d37cae7415bb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586130, "uuid": "5242e0c2-11bb-4641-8479-4700a7965372", "value": "Order TD00242 - Confirmation 2300518 Tbilisi. Georgia.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431c9df-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597086, "uuid": "2a328087-99c2-471c-b0e8-87e4a7b4b91f", "comment": "Malware payload (Mirai)", "value": "b63abab8c5ae254953daa5210bc8a2f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597086, "uuid": "c11aa95c-e062-425a-ab17-a9d5217739aa", "comment": "Malware payload (Mirai)", "value": "18db5a2a1f51948a1cca0b190f56399888f4e3374ba3def06c1c89a74fb5e7dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597086, "uuid": "2a489ade-c99a-4d5b-bc19-e323a0470981", "comment": "Malware payload (Mirai)", "value": "e37494431478e4ef350194d9f2811666fd320790", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597086, "uuid": "18d9121e-fcff-414a-b434-67e97196f781", "comment": "Malware payload (Mirai)", "value": "22e76050c80a3af7a03a9a37878184ef5f2a6b2160e4c9858df23457a656a434ba517a4d258c4baeb8b88af032c5f150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597086, "uuid": "84a1f283-8204-4471-ade2-ec82acfff810", "value": "T16083095AB9814F12C5C6027AFA1E018D371357F8E3DFB2239D206F21B7CB92B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597086, "uuid": "0c6368ef-a04e-402b-a660-940521aeb6cd", "value": "1536:7FnIZUXHKgW6i/2QV1eYGzsriW8pKWfaJ9o0YIpiESeWo5Hy8785dYoFwbZnJZ:aUXKb91aAiZwWfaXS5o5Hy878jBFwbZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597086, "uuid": "d9479df6-4b3f-4c1b-bb87-c38ea604c0a2", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597086, "uuid": "332fb974-88cc-4c22-8ede-17a65fd4cbd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597086, "uuid": "1b42ecae-73b3-4ad3-8055-eda6e669922b", "value": "b63abab8c5ae254953daa5210bc8a2f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad4d4e8-e4d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682584374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584374, "uuid": "6861f404-35ed-4a43-876c-1749e641c9ea", "comment": "Malware payload", "value": "20d91e228097bebc548810a2f004e1e6", "object_relation": "md5", "Tag": [ { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584374, "uuid": "834e3b42-5d39-4f25-81a4-43de53ca84e5", "comment": "Malware payload", "value": "1a424c25c13280bf50c3c85c1f58c6210eedf94135424f240bbcf08c63b922e1", "object_relation": "sha256", "Tag": [ { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584374, "uuid": "1c0648c5-aef7-4bbf-a89d-9607d3f894da", "comment": "Malware payload", "value": "5e416707fbd871622e7fc40c389a6181e8be1aeb", "object_relation": "sha1", "Tag": [ { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584374, "uuid": "bb7de732-7317-4775-93c3-c4a82cfea2d9", "comment": "Malware payload", "value": "42c6af1f3adbc7c82c688540baa8c70b0b01a17ef8761e08ab69cc0e70940decd213bc99b763dc22cb1d2b3c2f8c0dd0", "object_relation": "sha3-384", "Tag": [ { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584374, "uuid": "6294567c-7da3-43ce-9441-117026a4ba78", "value": "T1D64733D1E02C1FA302E1B5954254069513777ADC32F8BF6BFB9F12621BC52B9983F60A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584374, "uuid": "0966afe1-e1f1-47dc-bfde-b31343bba2db", "value": "393216:jZcrWGs7oa2l/Op/g+KmU5PCngdsGj5nEgGElbq82knGnqTyxtWwuIM61xZUb5aq:aSqJuU5ndsuEgplb1GCJUxogf4uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584374, "uuid": "b4d152c2-f31b-408c-bcb3-10564e67bff2", "value": 26202683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584374, "uuid": "e40e8bb3-fc87-46ef-9052-275de7b5e65a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584374, "uuid": "2d3843ad-0ac5-4f33-a890-c08ea42530fb", "value": "FlappyBird.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c39023c-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554446, "uuid": "78e427a1-ee4a-43c1-94f4-4990f6f15e0c", "comment": "Malware payload (Vidar)", "value": "fdee54d2d5e1165ad6c69c3203105051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554446, "uuid": "72b13daf-c7f7-4572-bc6a-615aebfe0eb1", "comment": "Malware payload (Vidar)", "value": "1a945013489a88af369312fbce20f6701fb0df180e29113533d1cab036ce66a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554446, "uuid": "3c40ddda-716c-4716-bb03-96722b85489e", "comment": "Malware payload (Vidar)", "value": "0cf14c4b80ba0d9a8396c6e931fedcaa093f7ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554446, "uuid": "e0a5f98f-af9a-4572-8c3f-126037a9a75a", "comment": "Malware payload (Vidar)", "value": "454e11a49318fb57c2d4b55a5e32accbce07a05e9f0aab8cc5bd247ca7ee6496bfee92f368ad161229f03239e54b0760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554446, "uuid": "c7583939-5e91-4bfc-8aa5-8eec747c4445", "value": "T13074F111BAD0DC72F94674314460CAF4AB6FFCA4C36682DB77982B6F2E70381567A358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554446, "uuid": "8f4904eb-af97-4b12-bcba-9f940221b62c", "value": "8eba349bf88b630ce19c4f8ea59d9698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554446, "uuid": "a76e3c61-b4d0-411a-a4c1-381fbc22b7f1", "value": "6144:7mtF3hes1by8aXBKnNctjoYQgQ169yP9O8g5Kvlg+k6pHyiIDdYL0:7zsn2BKuVQ17PW4jpHyiI5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554446, "uuid": "936cce91-8a60-43a5-9d92-bddaa9a8c952", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554446, "uuid": "a19aa2ba-6680-4ba9-8853-0829aadb5edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554446, "uuid": "e9684e1d-ff9c-44f1-8131-40d96b453355", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b90cf1d-e53e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682629016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629016, "uuid": "682d45f4-c868-44b0-9332-cb32a4bfd9af", "comment": "Malware payload", "value": "707aa07af052d10cefbaaace52551b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629016, "uuid": "c5a0baf9-a915-4b8f-9ecd-bf97de4e662c", "comment": "Malware payload", "value": "1bd488efb6de4c54dd3122a9c9380953a992b0d3b6734d6e0d1642ede9588b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629016, "uuid": "aea4b878-5618-4c1a-9051-80632ca9cd4c", "comment": "Malware payload", "value": "c24d23a39b883108e0edb879d616e8a1483ad17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629016, "uuid": "cbe857ed-3b02-48a6-8324-7634cce3aeaa", "comment": "Malware payload", "value": "3e084f1614898e9aad4e0eb5eadb6134f8cf008c2985ce2e83c32c0b43b1eee37883abb0b08aacc2b4d26ddd1b228f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629016, "uuid": "7ba2191c-5545-4e29-bd58-19e9bb10056f", "value": "T114E533A54A670831F48DD5B81B6AD94C527D75A930B880ACA33C87DF1DA7382EF0D376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629016, "uuid": "3af4ca2e-d767-47d0-9379-046c4d9ea2cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629016, "uuid": "0d9362a1-74e7-4ce7-b25f-b28ee05b578d", "value": "49152:EGlJfsMqRT4zakrl6vt+u7ZlNl+bVIw5eZNOz0TDH4jbcAwI3BBmj4FHNx9oCsWQ:55qRs2kls+ObqITcYTDHYbcAwI3BBmjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682629016, "uuid": "16ea79f7-c9cb-4e03-8ab5-d197272a18ff", "value": 3126759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682629016, "uuid": "d521dded-bf54-4c04-8205-416de9432301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629016, "uuid": "a42111a2-2af6-47b9-8bee-50adb6351b2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55432430-e543-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682631287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682631287, "uuid": "4bad424a-609a-43b7-b431-c8e9dd0f57eb", "comment": "Malware payload", "value": "3ebd0db69d94dd249acce98ce56b8e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682631287, "uuid": "976838a2-90f9-446f-bc4c-919ea27bd9d5", "comment": "Malware payload", "value": "228f33f6b0873332f08f0ebe58654f236134582fdf7a37c666dffd9cc47f724b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682631287, "uuid": "47034b44-120b-4d5e-be20-4a556a7b023f", "comment": "Malware payload", "value": "3393be62a49c64d4f70f5d7c57e1648fba669a79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682631287, "uuid": "bc9e889f-bf16-46c1-858b-763094066491", "comment": "Malware payload", "value": "42930d3933af17e8df87d414549aae6b67c0995d1b7ed71c11f998deb90c279962866daab627cd8d3cd636e3f0681bed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682631287, "uuid": "cf8dddba-a25a-4119-bc97-97d417374ed3", "value": "T164452362FAEAC036D97517F498FB42831F36BD50AF7446CB7354B98319B2280A4713B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682631287, "uuid": "4971c599-1397-478a-b2ba-9d5d2071141f", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682631287, "uuid": "c0873cac-eb9a-4f51-8918-22f14b5f33db", "value": "24576:gys9pxUS4vWKRRQxaWppJbbZWYpp4hq9gDr/UqvEY+v+f6N:nCbzZKsdpHvBpI//UeEY+vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682631287, "uuid": "f17a2978-8b63-427a-86f9-da7d253e2bb2", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682631287, "uuid": "a0ef75dc-d3fb-416c-91dc-ed8a3fd81845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682631287, "uuid": "a43004da-6965-40be-9b40-d6c1457b839b", "value": "3ebd0db69d94dd249acce98ce56b8e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95a90bf-e4b6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682570976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570976, "uuid": "a56f2168-b812-4ca6-9ab8-02c90ce0a781", "comment": "Malware payload (RemcosRAT)", "value": "5db00fb6ffdb44187b95918cb69ce6b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570976, "uuid": "6e3c0af6-8b03-4f9b-9996-77c6e5abd866", "comment": "Malware payload (RemcosRAT)", "value": "2416e5bfdf5fc88f9d7ceaf117cd1173370b357b8d4b5070f81f0df7a0253075", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570976, "uuid": "2bb70c63-314a-4442-bbfa-5b9fccd6c717", "comment": "Malware payload (RemcosRAT)", "value": "ba3a4c7b0e2de310a71d43020889296a97fbb9d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570976, "uuid": "7fa02c8e-4453-4b9d-a1f5-8748bbb64fc2", "comment": "Malware payload (RemcosRAT)", "value": "4500f52a9ad3c9d1de94e4b6890e870e90986b20a52506eaf8f3e0c59ff971f0bfb908fb14f31eae7ca058c40d51c112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570976, "uuid": "9f90a154-9481-4ef6-88f3-c43063b2377f", "value": "T1C1257A3C19BE223BC079D7A5CFE5C527F014A9AF3121AD65A8D78766470AE5234C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570976, "uuid": "ac5c7da0-5918-4d96-a2ad-c24fdb96365f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570976, "uuid": "cb74e1e2-f28c-4600-a33d-ce6aa70e56e9", "value": "24576:y0A9AcgfZfJECdGurnE4Co1yXoNfd88Pk8+P:i9OlmCdGurnE4/AR8Pk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682570976, "uuid": "de1bf542-219b-4c81-a927-20accee4f124", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682570976, "uuid": "5d42359e-eb53-4168-9165-18a3353a1f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570976, "uuid": "9265f782-44c9-4b59-a135-60fa9b98d86e", "value": "5db00fb6ffdb44187b95918cb69ce6b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ead864-e4e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682589623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682589623, "uuid": "92167af6-54dd-4103-9335-40e5ed50c07b", "comment": "Malware payload (RedLineStealer)", "value": "125f033a5176b89ca5485071cf96ee43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682589623, "uuid": "5e02bca1-43d1-4d99-bab7-8e3a093539d5", "comment": "Malware payload (RedLineStealer)", "value": "275f2f9c90c3d2df4d0353b1ecc812ad68e0abaf29e901a99a7b768efbff12ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682589623, "uuid": "24b30c92-b816-4d3f-9ce2-e817132c8508", "comment": "Malware payload (RedLineStealer)", "value": "ecf155103a2497fae1b1e217465ba76e131a20ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682589623, "uuid": "23051db3-6053-46f1-86ac-ab3a2f65a254", "comment": "Malware payload (RedLineStealer)", "value": "4d484b66b547bde14ff63dd29b61cfb6b1b76eaca35a58c2ccb884cccbdd2688b00b707e3b059b19df1971661e7be51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682589623, "uuid": "cca29993-893c-4f4a-8c32-d53d429daba8", "value": "T167849F01B6C445F1E07229321E757B21AA3B7C200A768D9F9F9C685D9F735C09632B7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682589623, "uuid": "9bd5e761-31e2-48e9-a7ea-4c52ca4ec0a7", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682589623, "uuid": "ba2fce72-6688-4531-9c88-4c18b29f17ab", "value": "6144:cgZiAEAO0sByNsAal3gVAWgS7/Ohwjzr10JfQyiPYFJ8z:cgZXEAO/BUdG3gVdt7KWr1SWPy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682589623, "uuid": "e10f5b82-4088-4a33-a3f4-4335030cd410", "value": 397819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682589623, "uuid": "a9ce042e-a622-42b0-833b-e458cc5e4ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682589623, "uuid": "5e7027c8-7fbd-456f-9c5a-29adfb846d24", "value": "125f033a5176b89ca5485071cf96ee43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8b98bb-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597077, "uuid": "afe4f16d-e877-4862-baad-233bd9ebbfad", "comment": "Malware payload (Mirai)", "value": "cc50b1583af25a8fbda2e0f241be1f53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597077, "uuid": "3c289c4d-13e7-4423-a179-f20a5b82571a", "comment": "Malware payload (Mirai)", "value": "27c3ee9f469c51e36c840fa3021ccad263850c45bf5f60c0e417d7b4e98ce18d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597077, "uuid": "ed64ad8f-9567-4367-8f38-67c5e7047039", "comment": "Malware payload (Mirai)", "value": "05eb4309165a464976007e9c2b3ac45d914c0ba3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597077, "uuid": "166f3dd8-10ed-42bc-bbe4-63f964ce830d", "comment": "Malware payload (Mirai)", "value": "93f52f23ded4577c98e59ea2e0859a09a00935e23594d32e4bb27075c4ebdf8b415244881a27785205e88c2c396c1fd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597077, "uuid": "b456c58b-83a1-4d86-8597-f9dd0d841e5b", "value": "T126040830E650872BC2D223BAEF4E418E3F261F9773EB37155A347A742BE17A91939510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597077, "uuid": "1e08dfbd-fd16-4c34-966e-8fbb02f61949", "value": "3072:Pe1ywfQgR7Ee5ZiI/naVa1w/O/N2B1dWAHqsX43mGnWmgcygSw2EZAi:PMEyjaVa8OwdWAHqvmGnWmgcygSw2EZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597077, "uuid": "a046f682-b476-4dfa-be09-91e4817d83ca", "value": 178980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597077, "uuid": "eb69bbea-d3b7-45ce-8d50-0dddbf0261a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597077, "uuid": "5d2dac8b-aa67-4eda-bbd9-6b8ad31498e7", "value": "cc50b1583af25a8fbda2e0f241be1f53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f11a5f-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682598349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598349, "uuid": "bda66750-80fc-4610-a66b-efac4171b885", "comment": "Malware payload", "value": "55199b1f314304830d8ac3b76c4577a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598349, "uuid": "fa8727da-3f6d-4b58-a8c0-0de12a09fcd9", "comment": "Malware payload", "value": "282727b13ad58125ed132085dc8fd0f799b1827527a476f8bfc9b38ca4b2f63c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598349, "uuid": "53429e5b-6118-4204-a087-72b3cb60fe24", "comment": "Malware payload", "value": "4ccb7e461f4a4eee268877c00067ad1afe360c0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598349, "uuid": "00ef449c-a1c9-48fe-9417-5e7c52808179", "comment": "Malware payload", "value": "1507b862629d15da42bcf2a57a7907f61db3297cdf4b9df746bd115001bfca09b8f7d4df102fd9d597b4db583afc8adf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598349, "uuid": "5600e694-680a-4f28-97b1-d260a4146a98", "value": "T1BF433B21BA760E17C0D1A4B621F74B25B6B147DE26E8C60B3DB10E9EBF71A406543EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598349, "uuid": "b072ac20-3db4-46e3-9320-bf84faf0e1fd", "value": "1536:tilA/JV3p2kCWDbTN2SBQsY75jt9VyN0X:wl2t0YYV8N0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598349, "uuid": "f5062b76-63a6-48f7-b724-5f036df57966", "value": 59464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598349, "uuid": "dd22e0ec-098a-460e-b055-a45feabbb781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598349, "uuid": "25b56198-6613-4439-b2fe-d448bf119c65", "value": "55199b1f314304830d8ac3b76c4577a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b4d9e1-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1682586112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586112, "uuid": "190fce1a-c67c-473d-99f6-c4f207762507", "comment": "Malware payload (RemcosRAT)", "value": "56c9f47b5c9d683312ae04da36ff36d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586112, "uuid": "7a391c4d-5813-4654-bb70-87f79b87718c", "comment": "Malware payload (RemcosRAT)", "value": "2b4c534df5fe4c7ee7a402f384109cb60b54c7f301ef8644e7b1eba397d89f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586112, "uuid": "2a670ae7-ecb7-4068-8ca5-9c15d1f6cd9c", "comment": "Malware payload (RemcosRAT)", "value": "cce55b5bfbf5c3a09a21bc289bc74a3e14ecac4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586112, "uuid": "9ded55a8-5cea-4e58-8c42-06bbfd3131f9", "comment": "Malware payload (RemcosRAT)", "value": "915ed14453338f63341fae6d15e4911d6007d8555120e164dd4f51511c55d9f91aceaa407081357d7519ef1f42a4eb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586112, "uuid": "23e0ab47-a65f-4fce-a094-bc6b80cdd471", "value": "T1AF121C14A7D55232C67A0B36ED6363901BB4B7A7D883DB6E48CC616B6F023110E72BF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586112, "uuid": "e8218dd7-b8ec-492c-8a07-0683bbd3e3a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586112, "uuid": "fd9fc544-1839-40f5-b2c4-294088f34f4b", "value": "192:exvKPvfgLEBihQ5zWRX4r7fxzNzNWUO2Z43Jrg:Sv6oLEBihQgur/zQU9ZQJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586112, "uuid": "2b98d982-a68b-4eeb-b0a4-8994a6f465aa", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586112, "uuid": "8f3faab4-525d-4074-b5bb-cfcab74d93cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586112, "uuid": "4767efd1-9ec6-483e-8359-ea153679d1e3", "value": "alloy_steel_pipe_accessories_specificaion_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2642f1fa-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553899, "uuid": "21cf1adc-2d93-423a-9906-f45006c7d018", "comment": "Malware payload (Vidar)", "value": "97016f1a26122d9ad6502b5760019b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553899, "uuid": "5ecd7f54-2454-4c43-8a30-6782ff6ee141", "comment": "Malware payload (Vidar)", "value": "2c3399c0b13dde9c28a4bbcbd0c45a61238736d09123c838e1a8765194874c30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553899, "uuid": "1c38ec87-2bed-4427-854e-f59f069f7ea2", "comment": "Malware payload (Vidar)", "value": "a6b3c9902c8669b69b6c06429cd532005550b877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553899, "uuid": "87b31161-d1ea-42a9-bc4a-d112cc23c48f", "comment": "Malware payload (Vidar)", "value": "b4ac89dd1be013ae8f5c1c22c696f674595e34e90e4e40d206f69da14c90ce3bd474417f8731c3956e21a8137eb9186e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553899, "uuid": "11f9a08a-d5d7-4cfc-8a64-5ef3f612a059", "value": "T11E648E4392E13D45F976AB729F2F82F8765EF6528F19776921089A1F04F21B2C273B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553899, "uuid": "17d819fe-1b9b-4de3-9696-6b998bf1c058", "value": "f4d72c3d48b97275dbb7753d2cd3f6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553899, "uuid": "af3fdbd4-17d3-4137-b140-adb61c47d4c1", "value": "6144:7d0S2Q2oPUtXyyiguikPDwzVRgvkTJJM:p0ShpPUt8/8m4JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553899, "uuid": "94bc571b-57d0-49dd-b043-a881fcdf46f3", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553899, "uuid": "b3153e82-07bd-40ca-bd6a-3d7b46ad9fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553899, "uuid": "c40cd2fb-1fd6-4d6c-8720-ca93af88f305", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca9f60d-e4c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575626, "uuid": "155cdb0c-14fc-49f8-a152-07cbc05e262d", "comment": "Malware payload (AgentTesla)", "value": "9bb55b061c9c404ac88ada9a6408700a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575626, "uuid": "48e2338c-2cdf-44bb-a0de-fe00f8329361", "comment": "Malware payload (AgentTesla)", "value": "2eb75598bf4298ca672af9d8261570fdef407dd6a01fca0c0e2a04f8ff853bd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575626, "uuid": "f8660d00-56ed-43f2-9118-792eca03264c", "comment": "Malware payload (AgentTesla)", "value": "374fb6eb089c294e7e181f1ad99a33d37076e4f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575626, "uuid": "50824540-7979-476a-a5a2-91a4b340556b", "comment": "Malware payload (AgentTesla)", "value": "b4d11f7d128dddcffe5a4ee0088a83c41630eb5d25b2db33d96338d65504d5f9d9b6b599a690e58620b34ba7477bb8d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575626, "uuid": "dd00a1fa-962a-4c2f-8197-742479bf271f", "value": "T199842328E7A380CDC2B02016233AE7DA9DF31BE9353447241B658B3E6BD5A65F1CE741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575626, "uuid": "b9c4aafd-bcc5-4716-a448-8830e55ed90d", "value": "6144:IHANprmqeN1vv65nqoDgsZJbWC+IHpxXcnvG2xVDacNFgwFZe2SYK1hAPr70wng:IgnmqebvvtoDPtHp5ZAGM/wLHcr70Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575626, "uuid": "cdcc5184-3d7c-436b-ab5d-da88497a8f60", "value": 381008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575626, "uuid": "470c6179-4386-46e9-b192-10dfbcc6724b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575626, "uuid": "c6ce2529-a6cf-4029-ab81-a63968938d34", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee04f7d-e533-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682624700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624700, "uuid": "7668c498-66fa-43a1-a636-35011766e282", "comment": "Malware payload", "value": "63398748f1436b50e7a8d89a8f4acb4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624700, "uuid": "e6f715bb-8a16-4aed-bff2-9a5de030abe4", "comment": "Malware payload", "value": "2f463640ede2ba652be4fbadf180af9b992917a4100e702c518405ac9ebe3aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624700, "uuid": "6a951690-1022-4de3-8600-ef63c300c494", "comment": "Malware payload", "value": "42c15adf7ceba23fad468cffe2d09e36d7b47b26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624700, "uuid": "8d1df2ab-a10d-437b-92df-31f9a52226f3", "comment": "Malware payload", "value": "3fab792ee9f7e2643033f03f7c1d90c3f7d050fa216b6c78009feddcad59fa36e9d26896e9c3e5b4f2bf09c5276399ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624700, "uuid": "ac51e4e8-b3d3-4efc-993c-1f7a6539e5b6", "value": "T1F0741981B3DA4028E0B2C679CEB18363EA767C155B3056DF07609E6A6F73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624700, "uuid": "d80f200f-c041-4079-a84a-8b78d06608e5", "value": "77e359c59376704055cd15c273e85720", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624700, "uuid": "dcc9e4d7-0f7b-49ba-9e5a-eb48579f6791", "value": "6144:xFH8RIT6Fam4StJ3rXDW49wY7SKDuPiaODgKYleQ4HBP:xWdtXDzCStMuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682624700, "uuid": "d41c4463-64d7-4507-825e-5a84220901ad", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682624700, "uuid": "3d0c7b65-8a4c-438a-ad73-a1c7385e2f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624700, "uuid": "f1a60d97-e43b-4ee2-b21c-7933aa7b3e7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81aa452a-e4f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682597861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597861, "uuid": "63aaedce-ce56-4cd1-b6b5-ed0ad139d145", "comment": "Malware payload (AgentTesla)", "value": "b134f378d92e6338d0fd3da28e7eea80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597861, "uuid": "61a252f1-15be-4d41-8a55-c2ed0a4c3608", "comment": "Malware payload (AgentTesla)", "value": "30a821884a0ebea379cb9130bf94168aa04e115baa74b63bec5aee4d8dbfc62f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597861, "uuid": "e96fba03-6bb4-4a9b-bfcb-937ed2969f8c", "comment": "Malware payload (AgentTesla)", "value": "40f9b70ebc067dd14726ea9a73f20fc1a7646d81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597861, "uuid": "de67a27a-6ac1-4ff9-acbf-b33282f19d57", "comment": "Malware payload (AgentTesla)", "value": "db230f70346cef3e4171b747f3eda84c99813817df1e0eb037f1da4a9eb3c18f80a17289a298580ea8afdda19373a7b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597861, "uuid": "811ea3e2-c2b2-4a2b-93d5-562cc96554f9", "value": "T104D4D0CEE34E0275DF9AE5B14FC5BB9729C6D1D22A203DA83A3C49B4E14E72DAF40151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597861, "uuid": "4520412c-baa0-491e-8615-fbc69264839e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597861, "uuid": "482d179f-119e-4372-a310-7dce0c609529", "value": "12288:P915PRTCn2OCySjCeDavK2WGrwF7K+kfMg4:V15pTROCQvK29Fzkg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597861, "uuid": "6ad89cb1-5d3c-4eeb-a83c-d6460434d51d", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597861, "uuid": "779f7ff5-99ee-4ee2-9448-cbb572fef574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597861, "uuid": "11e93ca5-e0e3-482d-beab-91b5428e7e60", "value": "RFQ#MV_HS pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30afcc5c-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586128, "uuid": "74f8fdc9-c621-45a7-806e-4df704335848", "comment": "Malware payload", "value": "ba07223a894931526fd69b0c2b21221d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586128, "uuid": "4af19182-8b7c-4a6e-b070-1dddfc08ab8d", "comment": "Malware payload", "value": "315061606e655e66db6ed9fa5bcbbac33e645c36da0a5730717973b8e323eb0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586128, "uuid": "7ba8a882-22d2-446d-b741-9d24fdb6f28e", "comment": "Malware payload", "value": "d7b63bb26abca39ef9c5ececa1a7bee5aa68cd15", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586128, "uuid": "6ef1bed6-281d-4b4f-8d0a-c73fcae8c560", "comment": "Malware payload", "value": "4a56e33c4ffc8535e9b2ca4674d360716f05dfe4ce77b0a4b93fe1766b65f86fa61efc13ac08df44a3faef4551994ba8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586128, "uuid": "fa9917ab-b448-4286-a182-9e22952a5818", "value": "T1C55404023E8BFA3C145F3C0055392E769F8EFE61C21951562A496FB883BB58D077F929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586128, "uuid": "020abe21-94f3-4454-b5db-9d6359b78b7a", "value": "384:d7QL+L0YoyzODjxosdoKF5vT8b8Qq6Pu7r7eOFDl7k7EDFh+2O0i99RVz8Jm0Jp1:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586128, "uuid": "42db8079-ecf6-410d-97d7-506bb70b8043", "value": 296754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586128, "uuid": "dc440653-77bc-43a3-8b3f-08e6469c3ac4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586128, "uuid": "148ab8d3-b041-4850-8ee5-f84c0c32eba0", "value": "Order-Specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9a66ec-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586150, "uuid": "d456435c-7dde-4bd9-99fe-4c256e1c75ba", "comment": "Malware payload", "value": "c09b1be0957746c346982a0af00fd1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586150, "uuid": "d316618d-8bb0-48d2-9ec3-99759e42be71", "comment": "Malware payload", "value": "315912e5009d08ca493911cecef22b5ec76691599bbd7bad757d47617fce352f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586150, "uuid": "2585236b-a7fb-421c-b556-27641964b29a", "comment": "Malware payload", "value": "bff8f32e4bda1ff252e432a0a0242ea2d4a5758b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586150, "uuid": "62fe81a1-77fb-4cf8-a07c-0293090c225f", "comment": "Malware payload", "value": "ad4f3e0c6b7ef66e4936ba4548987d55af91cd5373415fa97a2d451ff8c499840754a3162b55ef136fe389ce448577e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586150, "uuid": "29dcb7c9-bbd7-484f-b4a3-3d7ffdfc52d7", "value": "T112749E4393F13D45EA628BBE9F1EC2E8761EF6508F19776D21189E1B08B20B6D273351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586150, "uuid": "6a7a67e3-3efc-4b2c-8e48-fa16df6b0ca0", "value": "958f32b2db4437f7a0509a6814224698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586150, "uuid": "4260f90b-26f8-40a1-aa1a-4d61971ccf61", "value": "6144:cmhmU7mk4cPUGfXa4z84gddgFTkqnnEJKtIqSNv:cm4U7tOp4gddgeqnztJSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586150, "uuid": "d7a64d0e-e589-4c5c-afd9-3890dd5503c3", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586150, "uuid": "faa8dd5a-0c73-4ea8-9487-d7ff7565a421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586150, "uuid": "aabcf582-2313-4f4f-9cbd-c5b6332a2bfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e33f562-e4cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682580702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580702, "uuid": "6c19a9d1-2ba3-4809-999c-0b34393f1300", "comment": "Malware payload (RedLineStealer)", "value": "c9fc671394f808838d4c748a1c12f08b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580702, "uuid": "9398ac7a-c875-48b7-b341-15cf700a074c", "comment": "Malware payload (RedLineStealer)", "value": "31f6dc2489aabbce556c7d27e1cc4e752acef6661d810b8863a130f9b65e66c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580702, "uuid": "9b4b079c-8617-459d-ad46-8423017b5df1", "comment": "Malware payload (RedLineStealer)", "value": "51baaa7ba4a3ef8a550a43bc5f251d8edf4757c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580702, "uuid": "251e66fc-5220-4316-96b5-90d1db82971d", "comment": "Malware payload (RedLineStealer)", "value": "f55b102955938d8bf90e2511420692feaad44775ff3f56716a117c486ca4b8f6be86a42b6b6581cf566478efe28240cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580702, "uuid": "6726c8f9-2fe8-4697-834d-45b8ea638dfd", "value": "T110556C03A940B03AC4A7D4325FA99EE44A39A5523743F9F753947BAC4B321F1A6F3853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580702, "uuid": "74d478d6-26d9-484e-abac-5a3a6b8af3ee", "value": "6fcf97452805b04976b38c9953f83c4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580702, "uuid": "dfe157a6-8b37-4ef7-b538-c751b780b1d7", "value": "12288:LroPentg4fY0pnjGv3zJzaOFKbi/qg5KZ:fCUg4uz5vF8iygAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682580702, "uuid": "143aede0-8f04-4d87-a5e3-3b5ac559031e", "value": 1345440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682580702, "uuid": "466c8db2-aa7d-4388-b0d2-5773dfbf917a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580702, "uuid": "4a085772-53ab-49bb-b5ce-5c58a67cd883", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6dea59-e4c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682576030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576030, "uuid": "39a7ef46-29fc-427f-a2d8-10f04aefbdf1", "comment": "Malware payload (AgentTesla)", "value": "8a2817d5c1871eeb72182f44633e5f54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576030, "uuid": "770b795a-b56b-43d2-9297-fdcf685daf55", "comment": "Malware payload (AgentTesla)", "value": "333bc1da1ebac150e52df580ad487c35d31caa25bcdd8e06dd1579cd6dd86019", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576030, "uuid": "478f2215-2499-468c-90bb-c78f938c45f9", "comment": "Malware payload (AgentTesla)", "value": "49d495bcd4a58925a709be90b8d4aa071fa954e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576030, "uuid": "bf9e9635-cbbc-442e-a56e-50ba222f7a77", "comment": "Malware payload (AgentTesla)", "value": "da4518ec60849109844ed88d025d57e64fec4f36ca457e93e8ec5c3fb577fd6b1b0da42f09c9b7e0cd3eda05e5075501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576030, "uuid": "9995bb78-33ca-4dcf-9b9a-49043cb4636e", "value": "T1EE05483C19BE263BC079D7A68FE4C427B114A9AF3121ED65A8D747A64346F1235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576030, "uuid": "6a25f8ae-5ba7-4c26-9541-07754d020639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576030, "uuid": "83a298b8-2fcc-4d5d-bbb7-7a0d14b96e0d", "value": "12288:um4/9WflU/9n7El601352HXhSiXopz6L8a2n/nBL6eckiFpfT:f4ylUmB1J2HXt0n5Lb+fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682576030, "uuid": "1d7893b0-43b8-4d46-ac9e-69bf9b5197fc", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682576030, "uuid": "8e8bee85-a8f7-441b-b00a-0957f6ca8f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576030, "uuid": "3b3bd646-1ab3-4cb6-ab85-a1601942d467", "value": "PI 0116710AA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f628dce-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553941, "uuid": "989e4a75-d62c-47c3-b1f2-611ac8c7b764", "comment": "Malware payload (Vidar)", "value": "0ee0b8674b67d55f62f639ae54486497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553941, "uuid": "a943b040-bb0e-4cf3-a257-5cf5ca2527cc", "comment": "Malware payload (Vidar)", "value": "354a1d3180f92329cae26075d2a152561df4d9bb2b8254b50ac4b97c7ee89e06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553941, "uuid": "13a082f8-cf29-4e62-b379-ed59014ecb62", "comment": "Malware payload (Vidar)", "value": "15fb646bbbb99019e33e32395bd3350311c4f58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553941, "uuid": "846156ac-4d52-4606-bec5-cf758b21d3ef", "comment": "Malware payload (Vidar)", "value": "56eb6220f2165dd3fa3f5886dbb15a575dbe355879696b27fd67322573a89d888f432c2ce585d33bcf011105c277d188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553941, "uuid": "feb16f83-2676-43c9-b131-49ae9fba2ad6", "value": "T1F6648E4392F13D45FA266B729F2F82E8761EF6514F59776931189E2B04F21B2C2B3B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553941, "uuid": "9fedb9cf-a697-46ca-84fe-760f985f7d81", "value": "f4d72c3d48b97275dbb7753d2cd3f6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553941, "uuid": "cff19a9e-4be9-48e4-92bf-563ddf5c6f1e", "value": "3072:OvS4l6xcwmGmQw/8Fqxz6nHaXE3rPlc8AMi5y+Ef6AsJs0dp9O1pTCF5qtJk0o:MhycwmOw/8q9ib10ElSAsBdpgNtJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553941, "uuid": "b3a84324-8e10-4b60-91c9-576a3a25bcbf", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553941, "uuid": "3383f87c-6baf-42c2-936c-680c294d3860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553941, "uuid": "18934427-d695-48b6-b244-c441187d381b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1401af53-e4e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682591234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591234, "uuid": "46d196f4-e41d-49c5-ab35-8d3254c9c40a", "comment": "Malware payload (RedLineStealer)", "value": "88ded4edd431515a83f30dec15ddac03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591234, "uuid": "99d0eaec-9231-4ee7-b91d-072f56d1d926", "comment": "Malware payload (RedLineStealer)", "value": "36f863a981f1c96a0fff1fad17ee83db18039d758db71382d97a4cd1189265f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591234, "uuid": "7b4ef73a-984d-41ed-8839-655af8af5307", "comment": "Malware payload (RedLineStealer)", "value": "e4df525163e12ab65014118368b95834ecb5907d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682591234, "uuid": "1a252515-537f-4bad-970e-d7bd242c3b94", "comment": "Malware payload (RedLineStealer)", "value": "3a3b7eea8f8d5ca591133f3c644358d7526412cbd343776fe04975f7833ff08f6a38df7609de5602d504213f5c403616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591234, "uuid": "21d62151-5aae-44de-9fb5-91ea7b7fdde4", "value": "T1D5749F4352F13D45EA764BBE8F2E86E8721EF6408F19777D22199E2B08B21B6D173341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591234, "uuid": "ab375596-b8dd-4b0b-b0f1-85bc7512557a", "value": "aaf91e6cab5976c3af4756e59b45ffc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591234, "uuid": "f9ac3dbe-728c-47c1-87f6-32b021196635", "value": "6144:Mv6uozYvDrs8Weks+SeGZly7TTiLtRLd1Fj4xHedpRW/APuLrRNvy:MvkzYM87EBGZAbiLtRrFj4Edps/A0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682591234, "uuid": "29b152eb-f8c0-4556-94b5-240523933e57", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682591234, "uuid": "becbe0c7-5661-41a5-80f3-77e52bcfd1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682591234, "uuid": "e2a4c8a3-bc06-45e5-9a1c-9971f041e654", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188c1de4-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584799, "uuid": "89a3d64e-f13e-4fd3-a74f-96a71c170b84", "comment": "Malware payload (Gafgyt)", "value": "cc69a2f2025f5c2f9e3b2da347211361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584799, "uuid": "60d0fc02-7acf-4222-823d-0b0d637dbed1", "comment": "Malware payload (Gafgyt)", "value": "371b24b958fc6d2cac6813604c7763bdd2ecc8b481342556698ea472d53a5242", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584799, "uuid": "0d3b0800-9ad9-429b-b63a-f65be123f7e4", "comment": "Malware payload (Gafgyt)", "value": "4f60846ad8e3b1fa2da975c21c57d0eaf31288a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584799, "uuid": "87a4f6b2-1946-4339-8f70-72f338ad5eb6", "comment": "Malware payload (Gafgyt)", "value": "96e7ef1123dd72db0889c28e439e8ab8a8e71dbaca205fcef727cc9b671fcf66622fd2bb694f3b6431615625c4bc2365", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584799, "uuid": "77d03fec-8506-4adb-8f95-095fd763055a", "value": "T1F1C3093B6B270A23C0D9507102E31332B9B9DF5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584799, "uuid": "1536d009-170a-4619-8d0a-aa828c661665", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAARdc0sfm7ypwYujl3IdnuW:ZP0DNPAJ5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584799, "uuid": "cb8ff656-1561-44ba-ba27-365aa73fe8e2", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584799, "uuid": "b798112d-3936-4fbe-854b-c5a8096bd4d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584799, "uuid": "a0447608-a61b-4f3e-9fd3-e932bdaca068", "value": "cc69a2f2025f5c2f9e3b2da347211361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9d4fc0-e48e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553721, "uuid": "302bc46b-c0b5-4917-b2ef-165c29ccac73", "comment": "Malware payload (Vidar)", "value": "ab10f2eb9e72185620a9bd2bdc1a848d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553721, "uuid": "79c25f34-a5ce-4c15-823c-d9fa50f4655d", "comment": "Malware payload (Vidar)", "value": "37f90d14d9b6dbc7813b30dea8379637336a2e8219110dd0c479f2dc5d7a5fd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553721, "uuid": "cc67cfde-8df2-4fc0-a5a3-0ad1e90ae7ef", "comment": "Malware payload (Vidar)", "value": "7b591638129c102efec60a42656837d47cb4bf36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553721, "uuid": "7ab6e339-f226-470f-83f7-82437aaf8e5d", "comment": "Malware payload (Vidar)", "value": "9d48ebc05f05555532f4c9ef818fa6be5ae194d54315c7b7e95930e67799618d993d0c51580239c53cd260cff67a7414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553721, "uuid": "c44d10e7-cda6-41b4-88ce-c259b05ec819", "value": "T140649E4382E13D45FA26AB729E2FC6F8760EF2518F5D7B6921189A1F14F21B2C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553721, "uuid": "08257a51-742f-4796-9d95-011394200d83", "value": "aeef7763af0e2894e4991dc94400d180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553721, "uuid": "02733460-525b-4305-bb2a-4d2ff82e13fb", "value": "6144:itjDkgWc24OtJzwHs6U1L297o/LZoA7o9tWwkPsl:e/ObJzKs6Qek/LZoA7YXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553721, "uuid": "d19bfc95-9682-431b-8465-e577cab4a02d", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553721, "uuid": "477e82ec-8564-460f-a8a6-aa85cc7c805a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553721, "uuid": "f3e0a635-aa82-4616-9261-7c1b71759eb0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845db1b9-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598295, "uuid": "f4a8c1e8-d6df-4c6f-a68f-accf41170899", "comment": "Malware payload (Mirai)", "value": "afe4cacfdb77e6bf9e9f05d3015e14b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598295, "uuid": "0202981b-bacd-4c84-910c-74d24ec9b4af", "comment": "Malware payload (Mirai)", "value": "384ecd737de74562e886d240aefcb6b2b3036f8b24b2e87752b46b86591bf879", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598295, "uuid": "464dd733-3079-40e1-9032-f2af5b866c6e", "comment": "Malware payload (Mirai)", "value": "0c362992dda037b740dd746f035af310063dbbd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598295, "uuid": "088a7075-97f5-4212-b36e-3ab617244276", "comment": "Malware payload (Mirai)", "value": "4b4ac55776a8b21290db08723000385019aeebeda2214f796e5ad81da02f72fd65beb97698ff911d22927337d5c56b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598295, "uuid": "2d90e60a-8354-46fa-8615-3e30be8d7897", "value": "T1CDF3E730EA05832BC2D377BAEB5D028D3F351E9777EB37111A3439742BE5BA82A25510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598295, "uuid": "d32108df-1865-43cd-a8dc-a496cafb34a0", "value": "3072:fywgcFqA5RXHX72MORPiXVNDyXLBYwArfyDujp+SmjlliUmh:lvFKMOZUNDyXLyPKDujp+SmjlliUmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598295, "uuid": "45edbbbc-d556-4e11-b1c4-0c7886f40bfd", "value": 165382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598295, "uuid": "2b494c01-65fd-4938-a16b-d307bcf881bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598295, "uuid": "1fe22094-0c89-4aff-8466-e4629ac5ba58", "value": "afe4cacfdb77e6bf9e9f05d3015e14b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f06817b-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554504, "uuid": "0c2b0a3f-3843-4830-a9ed-49acba0892d7", "comment": "Malware payload (Vidar)", "value": "c0290d7857688841b7a3e50bb237615c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554504, "uuid": "406d27e9-7084-4678-b3c5-b03b3aad3f50", "comment": "Malware payload (Vidar)", "value": "396ae4c1158897e71763b09fe32b147bba5414531a46c53b11ff8ccbd4589d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554504, "uuid": "033f43d1-760b-4aa1-8194-0492cd7654ca", "comment": "Malware payload (Vidar)", "value": "7f77e9d2226703f59a263c99f1e81ddc778cad3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554504, "uuid": "cbd45388-eaf3-4e97-b660-5fac156a8275", "comment": "Malware payload (Vidar)", "value": "d3a7395527d6dc38260c2cc886766f94598c460d2b9dc8761651206f3159200061b35f04b8e22eec6376fa78034570af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554504, "uuid": "0f39d66a-fea4-4ac6-814b-bcc71e7e7f44", "value": "T12A74F1127AD1D47DC61700714061CAE8AAFEACA19A5946CB33683BBF2E302D1477BFD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554504, "uuid": "219ebe4b-ee72-4934-9179-a6cf08d97f23", "value": "49d57250c01123af7161754f5cf54349", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554504, "uuid": "00a0b383-b2a7-444a-b9b1-82b5d7e796e1", "value": "6144:fz8xaEVFeIYXh212AYJDIPNcEMUxuE9JbScXezjcswfNiODz7eD:fdEVxYXU12AYVIVcEMUwE9Jb3XencX7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554504, "uuid": "5e189ad1-41eb-4d3b-be1b-c39d2115a60d", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554504, "uuid": "a3e57eb5-5833-494f-8956-dd65104f5189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554504, "uuid": "8eafaab9-c2b1-42f0-a818-a5aa8c6ab411", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9802cd3a-e4ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682595321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595321, "uuid": "14169acb-642f-43d6-a5de-d3a98c2e9d65", "comment": "Malware payload (DCRat)", "value": "1dde40817b31fedcd414a7857387d8da", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595321, "uuid": "3a6f18ec-eca8-4e63-96d6-11cbb0bfd104", "comment": "Malware payload (DCRat)", "value": "3b2d67c12fb9248a282b48b115ba3c3f339ee9d4e37c381793db4b1b64d88fd3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595321, "uuid": "add4068d-6048-4b6b-9909-c2fe698416a4", "comment": "Malware payload (DCRat)", "value": "b67f778e885d5957d4be981ff581104d77f6ab43", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595321, "uuid": "d6866854-c7c5-488e-a737-f6d9b9037a66", "comment": "Malware payload (DCRat)", "value": "3cecafbf8108b0f552be7c420435cf77547b88d569c9fda3e91cbc726150c7bc0b3a033a67fa961ec8f3bf4e88c7edd2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595321, "uuid": "fbab2cd5-13d4-4911-89ee-b61b963fc38e", "value": "T1C9456B027E44CE11F0091673C2FF498857B4A9516AA6E32B7DBA337E95123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595321, "uuid": "db912114-dbdd-4cdd-9e87-9e4943bf8bc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595321, "uuid": "053fad0e-b7a3-463c-9806-9b0c9733c03f", "value": "24576:95CchGPskXQAl38KeALrIx3dLMhf3nzOeDLJ:bCcGAARdwjghfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682595321, "uuid": "9c2810d3-5334-4396-bf91-ca360b18b4dd", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682595321, "uuid": "3a6f2af3-2e7a-4194-8b82-be50826c576c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595321, "uuid": "74afa2f9-54c7-4985-a6d6-0b80a7b1eca4", "value": "1dde40817b31fedcd414a7857387d8da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d612b344-e4bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682574809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574809, "uuid": "155eab00-6d82-45f2-bc85-f265ff22e486", "comment": "Malware payload", "value": "a43bbd752fb4993d081582844989c3ca", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574809, "uuid": "e0773800-8b8d-44b1-9930-c3aa24afcace", "comment": "Malware payload", "value": "3e88000f7d58054fc0e3d5e96a98acffa0a1a73b2222bb7aa7d3821afe7797f6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574809, "uuid": "cac0b58b-cb6b-4769-9b25-c75b3b92d908", "comment": "Malware payload", "value": "c1e830cd799e2f2ae48f1a1eedf864c9d996ac65", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574809, "uuid": "69d613a9-1b85-49fb-9549-11feb645a016", "comment": "Malware payload", "value": "20222d8d9338134ec99dd5b99971b2ea816022f458684ad5a52ce574adcc253c769a424acaf857f0788af1ed78e96a54", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574809, "uuid": "181d8ed6-7bcc-4368-947c-cd8f6b835ed0", "value": "T149A1530669E06DC6234383F37D26E1D0ED7E646BAF55444FD400EA993D84A74E8CBE32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574809, "uuid": "24b68a37-466d-47a4-a042-ca998886f0a2", "value": "96:0rARsmAWFjJkgRKcViFa6Oq3m/fq3J2Z37sYxVJXL80BuFtuin:080w9RK1JQfq3J2VYYxVJXnBuFtuin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682574809, "uuid": "d112926f-7313-45e0-ab8d-b8c8b1ddf030", "value": 4634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682574809, "uuid": "c530a125-2f5e-48a0-8b90-58a45143ef1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574809, "uuid": "b2110385-1854-4a5f-b026-547494b96136", "value": "Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f52daf5-e4c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682578852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578852, "uuid": "3767dcaf-435e-453d-a0cd-9c988bd26673", "comment": "Malware payload", "value": "f5bca9d0493c4053330ee4db3f8a8691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578852, "uuid": "9ba732bd-f8fd-41a8-b4ee-cbb403148361", "comment": "Malware payload", "value": "3f197103c6faf2754dc6bf8d2fb11cb7762b6d1d5161ffb8ee8544f678e926a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578852, "uuid": "4336accb-760b-43db-a3f7-d6813d305c36", "comment": "Malware payload", "value": "954438a54e0e3d1fdf8185fa3942f15b2af45720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578852, "uuid": "1dfd2cc7-7c94-4336-ab5b-8446a0522c6f", "comment": "Malware payload", "value": "e33b424acb9b649300c3cee941c1718ba931c6fa34b788540993ce84e3d6a05f2144b3546bb331037f8090b140b3bd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578852, "uuid": "02420e33-a7a5-4ca5-89db-1959539c4efe", "value": "T1BA1623E97BDF5E18E0F2F53788924F02803D7E0739A8F51E265B515905B73C26A48B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578852, "uuid": "978ea941-db7d-466b-9019-50a73b354253", "value": "98304:xQHkk9ucDv/9J/qJ4Q+9RITsm6pmuDfsKC9SleQzg6+dK7P:mDv/vqaVITszfC9SleK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682578852, "uuid": "acfdd125-0a2d-4266-9277-2ca9a102658d", "value": 4372480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682578852, "uuid": "90118f45-8277-4633-8496-56fb8f4f83c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578852, "uuid": "d0a160ff-d1be-45ec-86f6-74ea206ac15c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ba4093-e4db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682586805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586805, "uuid": "ee52d46c-b15e-4dc9-9893-cd29c4342956", "comment": "Malware payload (RedLineStealer)", "value": "59121c5cf7799da64980f62195cc4f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586805, "uuid": "5706aa59-fdec-40d4-bebc-396daf19450d", "comment": "Malware payload (RedLineStealer)", "value": "3f8e9b1883df8ce6b5aa9c36d869adb01360bd4a08a8f90730c7a9d6af3bb1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586805, "uuid": "5cb04d9c-46e4-4e56-899a-792fb3464eb3", "comment": "Malware payload (RedLineStealer)", "value": "15e18813a8f314efbc6391373166391d1c49a1af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586805, "uuid": "b6a59ed7-474e-4169-abe1-f60e005236a2", "comment": "Malware payload (RedLineStealer)", "value": "815f6cd9734ce46f0a282aa1b5f85b57976f816f6b7a060c1cf30bac4bdef5de140dee75c13027dcc89313c2aea204a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586805, "uuid": "6942d1db-12cd-43ef-9988-3ff94398795a", "value": "T16835230AB9E954B3EA74133098F343C31A797CB65E3891E76342ACD66CA37D09172367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586805, "uuid": "f95ada7a-57a0-4f17-a78f-db9c7e99767b", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586805, "uuid": "87d7fc6e-d13e-43c5-921f-5430a9f3dd86", "value": "24576:vyVPqCDhVBtEyx0495EVzvDlLw2gfi9D/eRFsbUfuwH47TeTAkr:6cYttx049OdJLnga9De/qyuO47T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586805, "uuid": "6326b0dd-785e-4839-b825-e30e328c9a4f", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586805, "uuid": "ed953ec6-2353-4d64-8a10-3b0676c30517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586805, "uuid": "35d0949b-f382-4ae8-b4b3-b909bacfab94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1fd756-e4f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682596237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596237, "uuid": "d4910587-3eee-445a-ae97-f1021021a4f7", "comment": "Malware payload (Mirai)", "value": "6981f8c8d7db99daa13efe04699bc3ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596237, "uuid": "922cc7a8-9209-4e22-b89f-90fc7f762b1a", "comment": "Malware payload (Mirai)", "value": "3fd06c08b93b9d54e07de1b595e05d4050b6cae488c8520983579d0dca597412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596237, "uuid": "cd9d3a7f-ce68-4940-91f5-04ec28aeaca7", "comment": "Malware payload (Mirai)", "value": "4ba4185b110c28e23f7af508a7d7237c1ed22e04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596237, "uuid": "079b568c-de92-4ce7-8a99-71cc01f42dc9", "comment": "Malware payload (Mirai)", "value": "414c7d43d2dcd17d2cda4e4c586c11b7a7ad22e1972397dde41b4254e5a3944264d91d187c55f08704e4548fc80cd042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596237, "uuid": "3c715292-1584-4cb8-8e86-4d4a96f7ca70", "value": "T138633A95F9815A13C6C612B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596237, "uuid": "d9fe32f0-7209-46a3-89e5-ae1d7d38beb1", "value": "1536:qnyorX4GaLAYVhWXi8/CAkTfHHo5Yrouvy6wbZnN:qnObVhysAafHHFny6wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682596237, "uuid": "832d2bcc-c0ae-473e-8126-3b9059c63310", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682596237, "uuid": "f842129d-2796-4a1a-8525-cbfeed5c0df5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596237, "uuid": "3c9b4942-6747-4321-aad1-58574a14415b", "value": "6981f8c8d7db99daa13efe04699bc3ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7591d6ef-e4d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682584097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584097, "uuid": "1f9763a0-eeb7-451a-af2a-1ef177fd8dec", "comment": "Malware payload", "value": "8edbcdafc2b2752bb2391b62e9093218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584097, "uuid": "b6c4cc3f-d9e1-4af2-a062-fecb818ead93", "comment": "Malware payload", "value": "3fdd327bf4c63a7b2a531571e5cb2aedf4bb57345fff941ed167181ec6de0365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584097, "uuid": "40107e28-d951-4654-81ce-d889d00ca88f", "comment": "Malware payload", "value": "0a604c5761f1bad6437293ed2b27798ee771ca1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584097, "uuid": "b0cb8714-343a-4fd6-a5af-e53ab5c68368", "comment": "Malware payload", "value": "d15ac8f0894a197791f2f843b0dec24716ae70013a6dc12d168c1e17627887f580728d313d098efce3592a1f6f113bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584097, "uuid": "02d66596-7266-4c22-9d4b-ac661c413bc8", "value": "T195432A06FAF3B5A5DC6A48F244EBC73E09457D10ED328829E2E1570BA972E314914FBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584097, "uuid": "bbe8d5de-1aa9-4672-be42-439eadb69097", "value": "10b588c378272a13512785afbf09165f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584097, "uuid": "aa2beabf-a1b8-4d8f-bfd9-6385430555ca", "value": "384:xtNmj7gve8AWE0prvzaRsayXJ+Gij0ubE1HO0x+bIyBlkNUclTJxqh+sKlO1Nf:xtNmfl8AWE0Lh0bICl8lTJDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584097, "uuid": "a23ee40a-ad8c-4d58-b9c3-233aee87e151", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584097, "uuid": "262e4be0-ad7d-4f38-8d27-84dc8566497f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584097, "uuid": "3ad224f2-a960-4b5c-8c3e-3b1b4297cecf", "value": "SecuriteInfo.com.Variant.Fragtor.108925.6242.15005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79d6158-e503-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1682604072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604072, "uuid": "75303f5a-c9bc-41b0-97d1-c4446cbb28ad", "comment": "Malware payload (TeamBot)", "value": "6f376d25fc8b446e9f386e7c4cef2078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604072, "uuid": "f6f9fcc1-0718-4cc0-8fec-e6624faaf9b3", "comment": "Malware payload (TeamBot)", "value": "40673b87aabe0b0a9a759403ea1083dc11737ae634bb9040acb8847644c7dd5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604072, "uuid": "02ab7c0d-8d52-462d-b547-8ca8fa5248e3", "comment": "Malware payload (TeamBot)", "value": "5ae8e23e17ef0c547449183dc1132af59d58f0bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604072, "uuid": "83c14cf6-8245-494f-9876-ade94b7a5997", "comment": "Malware payload (TeamBot)", "value": "4c726a30c92cba888cdd0e54f8b44973eb0462ca21bd2167edb7925e1801a358cc5aed166ba84c82da93cbf41dfa79e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604072, "uuid": "7cd75536-762a-4c58-8d8d-4c4a0e248c21", "value": "T10E344B1352E13D54EA664FBE9E2E87E8761EF5118F19376D221D9E2B0CB21B2C273341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604072, "uuid": "eb782d18-eb64-4d6c-a59a-4030eceb283f", "value": "3b1217408d4bba412a22718d3068dd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604072, "uuid": "709adb1f-c6b1-402a-868c-e674340949b8", "value": "3072:c8mwg4TrvsBHHcU3gHeQPCQ85cs1A/yLqJve925c+wpUXKff8s5C8H1Nvxb:cQ/rvc33Qe6g5V1A/yi293gKffaa1Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682604072, "uuid": "0c61ae97-d521-4a47-9ec8-c0fc0f484301", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682604072, "uuid": "95d1da9c-4e29-4e90-b4b2-04e23e633231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604072, "uuid": "fffab0a4-116a-4fa1-b0fe-181732ba5c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703a13f7-e50a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682606851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606851, "uuid": "d932534f-e781-40aa-9f68-a722f84c55f9", "comment": "Malware payload (Vidar)", "value": "771660a86ebbd32d9ecdd4a9809f3e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606851, "uuid": "1ef5c31c-6822-48eb-99bb-aa2c77c03569", "comment": "Malware payload (Vidar)", "value": "40d11f822879f81adc2a95cbf4f88fed9a86901515ffba5af6e3c8e84601e80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606851, "uuid": "ece867de-a76f-4598-96e7-e5f098b36597", "comment": "Malware payload (Vidar)", "value": "1ea602681b6270c4a858fc081a1b5258e01a88a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606851, "uuid": "0f8e5027-b944-4dcc-a74d-b5c9fd08cd76", "comment": "Malware payload (Vidar)", "value": "55b6e54b83e69f4e763738236929599061d1bfbd8a387b329e79a46d354c2cd9c8872c1073914456635e2d13f86f4ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606851, "uuid": "ad7e99df-13a9-4fbc-acd2-d18e949a27ce", "value": "T18A944C4392E13D44FA664BBA9F2FC6E8760EF1508F19376E12199E6F08B11B2C173761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606851, "uuid": "eebbfc5f-485e-4171-9bca-16fe9f63a0cb", "value": "3b1217408d4bba412a22718d3068dd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606851, "uuid": "0dd1502a-7c1e-4c6d-b86d-eab6a8809c6a", "value": "6144:WXMts0ssn9ntJSCnCgcljrsRPxotejXpg7PgIU0w5Piq/VEjLPdNE1:WD0ssn7JSCnpGjEyOpg7Bwliq/ViDdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682606851, "uuid": "41f1d2cd-6713-471d-8acf-1cc27cb31cf6", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682606851, "uuid": "f9684941-7dd7-418b-88ca-e39a13c1668b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606851, "uuid": "187fbde6-605b-4739-83ff-95b5eb766088", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87328ffe-e4d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682585844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585844, "uuid": "bb016f8d-f3f4-47e6-a8ab-e476d5107c96", "comment": "Malware payload (Amadey)", "value": "a7e54293629d6264bb9d563c88b3cf59", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585844, "uuid": "aef98dd5-10cf-4e44-8302-ed18d26ed67b", "comment": "Malware payload (Amadey)", "value": "40de86101bdbae3707b1ad9fb963d9f257607201080c95e006135dbf1f2aead2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585844, "uuid": "14233e4a-1a8c-4ade-aaf3-c7c2fe24541b", "comment": "Malware payload (Amadey)", "value": "092f6901438b26a4d635854027257277d1e4c42d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585844, "uuid": "7fda4895-50ce-403f-814b-9e42af5efe21", "comment": "Malware payload (Amadey)", "value": "8ebabbb911b84aa908420c9344879e08655945661fb8babaef072da98e5b43f6f3d9147a8e4ab6bf5b307215db6b21a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585844, "uuid": "1507e949-4704-4ff8-a66b-34cdebb394c7", "value": "T1B4242A03A3F13C44EA658FBE9E2E82E8761EF6504F59776D22199E1F08B21B6C173351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585844, "uuid": "3da12928-6f03-4913-8011-00613829cfd5", "value": "958f32b2db4437f7a0509a6814224698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585844, "uuid": "aa472446-4e0e-48ae-b58b-9a28ae8c2aaf", "value": "3072:6jgLFMrKm+lxEyD+8QhhmTdNzaxtUGec1RrHYf5Rq5KmiWNvs:M/rKm5R8x+xtZ7r4PBmiWNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585844, "uuid": "6086b448-7010-4a10-a586-2bc577ff8856", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585844, "uuid": "48d1c1b7-0674-4875-abe8-9d02651bc531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585844, "uuid": "0a084bc1-4693-4a27-b76b-fb5f3980e252", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e937c69-e4cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1682580085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580085, "uuid": "1598d118-84e7-4393-8de0-b4ea3b7519bf", "comment": "Malware payload (LummaStealer)", "value": "790f8810a2bc764c4885ac2adccd4323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580085, "uuid": "b85658b0-0361-4370-b932-53358fb96927", "comment": "Malware payload (LummaStealer)", "value": "42e66271fe0e4b5b9b9ec7509e9cdf381d48d6f39febca4d12d05402df3f8841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580085, "uuid": "c3a0572f-b440-4636-98c0-0f28a21a7992", "comment": "Malware payload (LummaStealer)", "value": "9a0f02744716f3ab335618d7cf2c4df82fb3b179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580085, "uuid": "e831fab3-ba2e-4174-9c56-c54dd49fe0ad", "comment": "Malware payload (LummaStealer)", "value": "6c4a6c50ff5b30375dfdd2aeb168bcd4ff8d869f8859465972e4eca21e659709c4eb949aa46f6555c41d1ecab07c670c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580085, "uuid": "b0944fbd-5ab2-4d73-8ab4-bfcf5649f3ed", "value": "T14D243A4392E13D41FA26AB728E2FC2F8765EF6518F59776932189A1F04F20B6C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580085, "uuid": "81354009-d2f2-4590-a005-4d51b2352b26", "value": "958f32b2db4437f7a0509a6814224698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580085, "uuid": "d6d56b10-0b53-4609-b8cd-e3fc29d75341", "value": "3072:FIOkedd8g009KYWnmqPhhWISBm6mZPHH5K7Sj:Sedd8gaP1hhQB70PHM7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682580085, "uuid": "e0957b0e-a80c-4658-9331-85965faec348", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682580085, "uuid": "075d0aa4-1415-4414-96c3-7cc7fcbab240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580085, "uuid": "3ad420fe-1b0e-4fa8-acf9-b9e093c68d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09666756-e534-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682624717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624717, "uuid": "8dd6069a-bb93-4ce3-aeb9-066b0e9789d8", "comment": "Malware payload (RedLineStealer)", "value": "8630c0b40e6878c0a120c1da88841dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624717, "uuid": "8981778c-4f23-4dd5-95ce-e97303468e18", "comment": "Malware payload (RedLineStealer)", "value": "43631c799b3c2ca657ae670548956116faf902244d4475d7c45f00fcf7ea5da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624717, "uuid": "977fc57b-b0ff-4da3-b58d-644fdd8b8793", "comment": "Malware payload (RedLineStealer)", "value": "8e55e3564d303a55f801d63182ff69719639c9d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624717, "uuid": "d3409f04-c1bd-470b-8359-f664bcb4d75f", "comment": "Malware payload (RedLineStealer)", "value": "9855c5c666aa3133bd72b5a7f7831e25174da74e633e87e7855e2cc1585fe8288d6136856794d8f05f51003e87ea5996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624717, "uuid": "5c27a702-134b-4e6f-85bc-9a3f390999ac", "value": "T1B0E41263F6D84173DAF113B048F956930F79BCB0AF6482DB2B9559A90CB25C4A83076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624717, "uuid": "7d1fd31e-e65b-4d4e-9c44-afe9c6858dee", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624717, "uuid": "ebe08f9a-39fa-4c10-a061-638fa2683c16", "value": "12288:Xy90Fq1xg4tJmPPbg003Huv7GiIiSvD1Wh7Ffbbis:XyFjtJmPT5CHc8iS5Whxfbbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682624717, "uuid": "e95747e2-35cd-4b9f-b817-9065fbcbf376", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682624717, "uuid": "04130100-cd83-4392-acf5-69bcf27dfb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624717, "uuid": "a25de523-2363-462f-9a6d-984a020d01c1", "value": "8630c0b40e6878c0a120c1da88841dda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73403514-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554028, "uuid": "1f8c8b3e-e325-4a29-a256-a0da03eae108", "comment": "Malware payload (Vidar)", "value": "c0909339442d5c3b929dc090bb6d63f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554028, "uuid": "a366e675-c4dd-4a14-b6e9-ebdf6dd654cb", "comment": "Malware payload (Vidar)", "value": "442bc37924d8d962da21953837ef47044256d19d9a26202083e6e77c150fc696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554028, "uuid": "63bbb813-e135-4d80-9c45-0dbb74b5cc22", "comment": "Malware payload (Vidar)", "value": "632bac3daba9786f0d2c8fcf2ecac6bd45817dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554028, "uuid": "b0ad9208-71ad-45b5-a329-674c2228849d", "comment": "Malware payload (Vidar)", "value": "6916cfa8718c0231ccfb9af0c5830cf150224754dd871f79390e91f75fe2e661bdc3476af127826500bd8b9613420d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554028, "uuid": "4aade9d2-0c58-4abe-acfb-4767827122b1", "value": "T1B064F1117AF0CCA6D46389398864C1F4BA7FB8539B65E6B337483F5F6C31281D9AA350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554028, "uuid": "892587ac-4e7d-4212-bade-986b7dd5e2b1", "value": "cef248a5f7f51291a488c3a64841460c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554028, "uuid": "617c3a64-93f1-4bd0-95f2-f5f6c9872acb", "value": "6144:IRjS8YPuYVdFbbbT4c3PS8m7Rn1VTBPT5:Mu80Xhm11lBb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554028, "uuid": "fc5980ef-85ee-4ceb-8b63-5cf5f7a893ab", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554028, "uuid": "7b0d41cc-7693-4661-9259-d096a0cb42be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554028, "uuid": "f64a8bf6-12b9-4d48-85e0-2e9775c6f44d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc8c188-e4bd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1682574020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574020, "uuid": "6c4a48b8-9171-4783-b28f-cbabf9d860bc", "comment": "Malware payload (RecordBreaker)", "value": "2b2aeaef6cd3a1df47c938fc4f92a12a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574020, "uuid": "f77f13a2-a6cf-41b9-b6bc-8731bb8ca894", "comment": "Malware payload (RecordBreaker)", "value": "4495f2d6e7ca19027474aa32cae50c81ade7b543afb2393b2c81455c4d72a12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574020, "uuid": "7cac9c28-c9af-4631-a879-afc72ab3123c", "comment": "Malware payload (RecordBreaker)", "value": "c78c70bbe30545d0cff4cbb6b290f2e5c6f0f5df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574020, "uuid": "2ac35f2f-64ab-4d44-9d7b-23ec415a0e9c", "comment": "Malware payload (RecordBreaker)", "value": "6a6e52fd9c94273dff7e667fcfb9e3a381ca6e60463f8f89422848f9478350683a9fc0445ac631165acc5bcd7c66293f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574020, "uuid": "b57f2efe-6112-49ee-8438-8307b57b7031", "value": "T14B64BF223654C136F47AE4354DD9D6B9D3BC747127AF18C7FBC41B5A4702BE1AA3820A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574020, "uuid": "25efbf7e-fc0a-4c31-9be0-18fdf1a12f3d", "value": "3ad594570c1b191fe2c6f5dfa23638cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574020, "uuid": "34027b20-13fc-4dc7-8d8b-9ac78690a6b1", "value": "6144:aN/me8XvaFYs6m0parpdELFcdOcWmwSeQOthAZ:aN/zEvhsx0parpLdsSdOTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682574020, "uuid": "42eb36e4-9074-4d29-9768-a49e266dfbf1", "value": 318288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682574020, "uuid": "88bfc783-85bf-4cbc-9880-ea1fb42cdc16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574020, "uuid": "71b566bc-039a-41f4-88df-fb6c587669bc", "value": "2b2aeaef6cd3a1df47c938fc4f92a12a.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7225b4c6-e4aa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1682565622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682565622, "uuid": "d0c6595d-4f65-4ecd-9c5a-eac89d4b3e93", "comment": "Malware payload (NanoCore)", "value": "641a5504b45632aa8a16837745e2e41d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682565622, "uuid": "1eaf34cf-3d4e-4675-ba61-7c2302472010", "comment": "Malware payload (NanoCore)", "value": "44d0710850cd8f690c4114c9668d234244bdf5b39b6db75f1f06fc083b06d8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682565622, "uuid": "9c889a1e-f54d-4851-8366-9d947f5959b0", "comment": "Malware payload (NanoCore)", "value": "94c8019eb7d80fe8de35a25fd893d7557dedb9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682565622, "uuid": "656e1662-4f2b-4a1d-9a5c-fe01501d83c2", "comment": "Malware payload (NanoCore)", "value": "d4909a02b48bd4493ef866446f3d41ee6fb655cf27b7dd6221fdafb05eb4d944af2572d40ae2f513702bcc172f38bc7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682565622, "uuid": "0981fed3-bb96-4980-8255-307f16084968", "value": "T19D15881A2EC4693FE6BCA6F68422C0C9F498590D5CFCD386A9127CF1B4D179D39F9248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682565622, "uuid": "e35bf76a-fd69-4b66-888f-1f48ab48c822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682565622, "uuid": "98e67680-fc8f-4baf-93f4-2102ec43b75d", "value": "6144:/gE1Baaptvr8JQu9PLkVNvIokCMYAlf2n81+lMfPKkR63eyM7hicNCp5UrcoUwtk:/gE/aithvIojgDttKg7dIKRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682565622, "uuid": "abb9d45f-f44d-4776-863b-9573cec30580", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682565622, "uuid": "3d6394fe-0cbc-46ea-b907-e5ebee90c03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682565622, "uuid": "4eeb84b2-3e29-4cd8-b7aa-cb4992ea4b8e", "value": "44D0710850CD8F690C4114C9668D234244BDF5B39B6DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef15e5f0-e4c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682577858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577858, "uuid": "9bbc58af-e575-4807-a2ea-9bed4e458aef", "comment": "Malware payload (AgentTesla)", "value": "82dc32e9d717c3afd827eb19ff45dd21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577858, "uuid": "5144592a-18f4-45b9-82a3-9476f30bfd54", "comment": "Malware payload (AgentTesla)", "value": "45198abf5a1bc65474fd9905a689238304737b7407040a5045e99ea0912b5f94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577858, "uuid": "a64b2c2e-8d07-449c-ba54-de5c18a9647a", "comment": "Malware payload (AgentTesla)", "value": "5a3c4ac90b15e348c1792cdfbe80c4f7db1e0b4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577858, "uuid": "f83ff199-29fa-4b01-92aa-42e03c3fec91", "comment": "Malware payload (AgentTesla)", "value": "649fbc2fd486d6e25b4df74b6b73139c403041be4583480cde7b6f0e15b3ccf5bcfb1d9ad5acdc2e3ec6c15f9d9e1a39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577858, "uuid": "c7bdb1d2-d442-4eeb-a41e-318e9763d4d2", "value": "T115351202BEC1D8B3C1A21C325A69A721697DBD602F76C9CF37D0495EDA325C1D7327A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577858, "uuid": "173d0a7f-0ff3-4090-aef3-0400ddc3af59", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577858, "uuid": "c46d85d9-bf01-4050-8dd3-01fc68989ad7", "value": "24576:7TbBv5rUD8T2faxMmhU00pUUBQjqfYTfz7V2EggiVEAM5:lB+SxMmhU0sUUZ8V2EgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682577858, "uuid": "cd079bca-6c0e-4ba8-8134-bc16ab0addd6", "value": 1161984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682577858, "uuid": "ebac1c92-b1c1-455f-88d1-6a54f59db6ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577858, "uuid": "7da7925c-f081-4568-a97b-736c0ab784f4", "value": "PO#1135 - \u88d5\u5049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cddf10-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597197, "uuid": "c7322f4b-8942-4e68-bab4-e3453ea2e625", "comment": "Malware payload (Mirai)", "value": "92e838319c926d49195a87180d228bb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597197, "uuid": "db8fc309-bbfe-4006-a64e-5cf51aa639d5", "comment": "Malware payload (Mirai)", "value": "4591303bae9991d32669e87996d0a51fdf755eb842a577ff51aa12865c780937", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597197, "uuid": "ac1614a1-d0e4-4a61-a56e-bb3586ae8975", "comment": "Malware payload (Mirai)", "value": "f34545ec3754297db73ce715421427e704e62560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597197, "uuid": "3ead01e6-8a5b-4c2c-a7b1-480614cb00c5", "comment": "Malware payload (Mirai)", "value": "8120cbe3572f060bff829ebeba0917bca7450036e3a2cabe88621dc0a05f57d55f460e83fff0cdcf2c7d0e5101307fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597197, "uuid": "3719cab2-394c-416b-97de-013f218f1eb7", "value": "T132E3E7BFA7180383D4FB45F13D6737F98F6DADA312951289921AFA9007329B02921F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597197, "uuid": "be5cd72e-3abb-41fb-8a86-fec0792610a7", "value": "3072:D7qhMqH/Vh6iupXKBrQBYTipD9DdYR4APQTagbh:D7qh1H/Vh6ieSrQyTiF9DdYR4APQTag9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597197, "uuid": "0fc32e86-a1b4-461d-af60-7c64115041ec", "value": 153302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597197, "uuid": "a3a522ed-efd7-4e58-b09e-6b59e6a72bfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597197, "uuid": "0e446704-30b6-4b06-b666-4c225689b90f", "value": "92e838319c926d49195a87180d228bb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8515938-e4d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682582490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582490, "uuid": "ab6aae2c-d043-4ed4-80d9-7fad6d3bd6d0", "comment": "Malware payload (Gafgyt)", "value": "f5b0d0a7bcab12955ff1b895276dd080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582490, "uuid": "e739e548-1b89-48af-addb-fa57d7c509c2", "comment": "Malware payload (Gafgyt)", "value": "45e100c35fb7f48c4a50530f08bdfdde0af56eef090986a8c3765228ef0f941d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582490, "uuid": "7c6e8996-8787-4120-916f-ea28e2cf68f8", "comment": "Malware payload (Gafgyt)", "value": "6821c16954b50ec3a93d02d5e41c9ab13fb6af85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582490, "uuid": "78395e74-d5ec-48bb-baf4-4c0a94402d9a", "comment": "Malware payload (Gafgyt)", "value": "7500a22dcef24df6b597c07cb0bfca3e44e442cb4f4673f9f1cbb4ee5a116fed7f8da5bed5502e835965b210c5546f97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582490, "uuid": "2781eb1a-cf50-4211-bfc2-afa4916f050d", "value": "T185B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582490, "uuid": "083905a4-a0d2-4c09-bd25-7f8e6a27210a", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aPoJmDk1c8xF6KjW:zfO8IBRJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682582490, "uuid": "8d1ae112-26ab-46c2-93db-61ac15590156", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682582490, "uuid": "39298d48-15b4-4cc9-88a2-89b429c4660c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582490, "uuid": "63819dfc-b576-4105-aa5c-319cfaa67f76", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c41f4c8-e4c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682578524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578524, "uuid": "75b0dcfe-9e75-4081-b314-76a5b948b689", "comment": "Malware payload (GCleaner)", "value": "e6bc348d924a84b0b2ae77791b71ef9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578524, "uuid": "aecc063f-7508-470d-ba53-04c8fce21e8e", "comment": "Malware payload (GCleaner)", "value": "464441b9353005e4a1b065a8bd428a4b8ef2a88890b3de8443d5022389abb037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578524, "uuid": "e97f0ef5-e901-4333-bb1d-35a1211ba191", "comment": "Malware payload (GCleaner)", "value": "4fe8414af17b6193f3277659ad85d4aa818e2146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578524, "uuid": "383aca3f-abf6-4446-9eb9-7ab4f03d80da", "comment": "Malware payload (GCleaner)", "value": "351354e0de40c90f9e364eac27bf7e3b094a0065aac88cc9ff04dfcfa2b3b474aebbeb5d6dc01e738da9ed0433fc0a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578524, "uuid": "3fc8b4e9-1867-4015-bb09-5c0cd0346a35", "value": "T1C5E5330E93C75579C5E44DB29C0BCED2A771ED6A8638540BB6BC09FDEF63AC20948742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578524, "uuid": "3b8f5697-8d30-4cb8-aae7-843f19635099", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578524, "uuid": "c85c1bd3-cda8-4a42-ae2b-ea0922ca2bff", "value": "49152:EGlJfsqYb1hbav4R0DIUjKuTvJZmlA02la2k99Xt/bXTKC9sF+aQyUKW5/Dt7cJD:5cjav3yuTJsAKnjjKC9jyUKWBZ7WAsp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682578524, "uuid": "a9ece4b6-2a61-4883-9312-3342940d74eb", "value": 3090746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682578524, "uuid": "110b5123-6320-474f-ba2a-add1b5a8bbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578524, "uuid": "66266316-90c3-4770-bf35-343a6889ab77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2031c6ee-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584812, "uuid": "fa3804d8-27ac-4c51-9d07-8e2b2045ef6c", "comment": "Malware payload (Gafgyt)", "value": "999ba8e56eb5e17070a7a309299aed1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584812, "uuid": "7e5735d5-1d79-46b0-b6ab-98fe6299b23e", "comment": "Malware payload (Gafgyt)", "value": "46d479d487f9b622f4afad7490e4f4600ce55e396886d539719b9ee5564c5960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584812, "uuid": "011e5bfb-5abc-4773-a989-b3ceb2b5a1bb", "comment": "Malware payload (Gafgyt)", "value": "3847e43ab9233fc5d67fd0895ee952d0430b3535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584812, "uuid": "812840fa-cf5d-401c-b471-06be0650374e", "comment": "Malware payload (Gafgyt)", "value": "b60492da8b32b4e68856ab7fc4300912adf0ece97c01f629e772ce02e087523dc2bfd5a78bf5dc3044cfb0189f57e356", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584812, "uuid": "085a4671-ed71-44ae-bea7-3b2182998354", "value": "T139A35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584812, "uuid": "a70eedc9-6cf7-4084-a59b-965b20a01d5f", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr7n/CEgmqAgcVyZIcBI:4f5EdTbpr7nWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584812, "uuid": "ced84d9c-dd89-4a33-adcf-c2e2f1a8cdd9", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584812, "uuid": "6155e193-1e1e-44ee-81e4-0301952e2247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584812, "uuid": "0b6d66e5-20ac-42f7-a029-3c5c3bb2a56e", "value": "999ba8e56eb5e17070a7a309299aed1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93cfbec-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682585176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585176, "uuid": "b4ee9a2e-f9ae-497a-a2a2-cbcb56010eeb", "comment": "Malware payload (GCleaner)", "value": "881f2afd4341c9045eb5112297d867b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585176, "uuid": "b6ccfa3e-1747-42c2-b7e6-7e6981e788c4", "comment": "Malware payload (GCleaner)", "value": "475a57f0af58c2edb7909ff79018596fb242e90a619cdac5116accc33049de38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585176, "uuid": "11b78f13-2db9-4c2c-abe2-78316366fce6", "comment": "Malware payload (GCleaner)", "value": "6830f0c5d269a77742d8ff91a16cec6c9a4fbfcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585176, "uuid": "6bcd0cea-6502-4346-8b5f-68c7833d6818", "comment": "Malware payload (GCleaner)", "value": "79ad3018aeaece00ba34145baf1b7a4515cdd1f314d6211a1ea77024515655403927a0c6fa1391dce93e136977fb65d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585176, "uuid": "0412e2b4-cb38-4009-a282-dcde73f78fc1", "value": "T188E53346D2B24DB1D0A57BF12C25D400D63678E2A774B51036FC9E2C2B77EC6E6B2B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585176, "uuid": "0273ab65-29c5-4d4c-a5cb-9479eeabeca3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585176, "uuid": "9b3ba5dc-94d5-4e13-ac20-cb2114257adc", "value": "49152:EGlJfs/5r4j7AhYo5cJaqatC0YbMsnfWGyKIdSby6EdGHDbKnkr/H2JA+HgEfdVN:5gajkn5cAC0YbMsnYSUd2DOk72a+Hga9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585176, "uuid": "e7393411-dda0-4af1-a7e4-e558579adce9", "value": 3087111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585176, "uuid": "73b8a688-15f9-4e1d-ae92-628c7d30b3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585176, "uuid": "b301e0f9-ac56-441c-85dd-64f83b590e4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a9fb16-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597174, "uuid": "6e820a8e-82fd-415d-b34d-5aa8dc9cd371", "comment": "Malware payload (Mirai)", "value": "d8d288b2cdf67c91104a70b2b6608d6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597174, "uuid": "8e907b9a-c3a7-4814-81b9-1e30d4f05fdb", "comment": "Malware payload (Mirai)", "value": "497b4df8e92b96c08a8abe2e37542e6c9d2a60cb26744b30eac64ffa53419e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597174, "uuid": "816d2762-f438-4d47-892e-c847153d7ab0", "comment": "Malware payload (Mirai)", "value": "de18722492bc868931be3c548149f6d4c5149b5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597174, "uuid": "dadb5947-a6ca-48bb-86a1-d57af804168d", "comment": "Malware payload (Mirai)", "value": "a2f7618777a1eae27e1d47ee66a6865ba73b425af70cf5757589ba0b0fc30759b55d529e9d853309cadf0d4b4ade18d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597174, "uuid": "bb123546-62df-4172-8d3b-63c523cdea6c", "value": "T1A093B419BB611FF7D89FCD3746AC0B02388C958622A83BB67574D428F64B24F55E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597174, "uuid": "857c9935-085e-43d1-8512-5c2568cc9b5b", "value": "1536:NUYh3642HG6+QdBqWnywY/hn5ZHpFBw3wJfwbZnL:NUYh3n2INwY/55eIfwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597174, "uuid": "307adf0e-f686-4763-87fe-676a2b27c822", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597174, "uuid": "2475f0fd-e75f-456c-bd32-98d9ba987832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597174, "uuid": "6fa0c25d-4123-4049-ab61-ea1f3bb28ac2", "value": "d8d288b2cdf67c91104a70b2b6608d6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff94744-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598341, "uuid": "21e01259-a084-4463-a9e9-e9ac3f7a3a95", "comment": "Malware payload (Mirai)", "value": "386bdcccba6645b811f4be840d290a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598341, "uuid": "8630ac3f-888a-4211-8e0c-671a72e606e8", "comment": "Malware payload (Mirai)", "value": "4c17cfc1e080c92c83368a46515ca0f64c5b738881c9699fe9e192c0f937aada", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598341, "uuid": "cbc262ea-4ecb-4bbe-93d9-6c817b5b21d3", "comment": "Malware payload (Mirai)", "value": "f29ecdd56800334c00c7b213ec359bd1349dd8db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598341, "uuid": "5c9c4553-a8b3-48ae-b67a-f39d3dfeab71", "comment": "Malware payload (Mirai)", "value": "75f8706c6a6741cccb75c8c08d8d3666937fdbe8b7a89c26f4d00f1d764a4b67b42387dc6c3f6bf9f88a668422f11bc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598341, "uuid": "e738ad0a-8193-4c78-85f9-e39111ecfc1e", "value": "T1B483095AB9814F12C5C612BAFE1E018D331357E8E3EFB2139D206F60B7C792B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598341, "uuid": "839320a1-b94a-40eb-afe4-274b5e1acfb1", "value": "1536:bFn4UQXOGgHrmAyfifK7n/WPBaLs60EIdivuEGufHj6as5HYo+wbZnJ:XQ+GrnDKBa5uPufHj6aspB+wbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598341, "uuid": "7ebc1f28-cbf0-45fa-9f14-398344665bcf", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598341, "uuid": "8d99fe7d-7deb-4a95-82cf-7c40bebb1bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598341, "uuid": "d22665a7-8e68-4c00-a696-932ca615ff6d", "value": "386bdcccba6645b811f4be840d290a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6aa14e-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598305, "uuid": "bf11fb3d-a555-4f8b-9bb3-34f82eb56e65", "comment": "Malware payload (Mirai)", "value": "5ab5c1fda3c88e422a305654883fd3a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598305, "uuid": "305db115-cef7-4a96-8127-c5c6c874b550", "comment": "Malware payload (Mirai)", "value": "4c357bfee3738bf1fa5a01b37b90163a4f490926f1856ab33213249e6ac1dc37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598305, "uuid": "3cbb5385-e849-44e1-89c2-01fbe81821a9", "comment": "Malware payload (Mirai)", "value": "04df29389892a554ea80ac3b54d813a2968befce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598305, "uuid": "3922e7be-2a45-4c18-9375-00d416871a82", "comment": "Malware payload (Mirai)", "value": "2d7cd7cb24bb698b06ea0e40058bcd0829192b50ee0c651126e35ac5fa2eeb7d47ac2cfad38f4be69bc7af6e40037dc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598305, "uuid": "541720ed-d39e-4243-83ce-f984b3ae40dc", "value": "T16A634B95F9815A13C6C61277FA6E428C3B2553E8D2DF7203CD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598305, "uuid": "7beeec80-a328-4ede-ba81-4411d637cb48", "value": "1536:8jao/64CeIvqUDdxQziaSfH+4hYroOvnwwbZnN:8jwCUJVaSfH+NnnwwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598305, "uuid": "65ec1a1a-97b5-47ca-8748-7c29f51273b7", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598305, "uuid": "2398fb63-6d0d-48a2-99a0-4a91480faf57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598305, "uuid": "c81119d9-6304-45df-a7cc-a11779baf4b7", "value": "5ab5c1fda3c88e422a305654883fd3a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c673fc-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682585411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585411, "uuid": "930c5ab6-9af5-4eb3-9557-b924d88db5c1", "comment": "Malware payload (Gafgyt)", "value": "d37987d99c0a2b5c828806cbf6cd702d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585411, "uuid": "039d2a08-6176-4b5b-af49-e7c20831569a", "comment": "Malware payload (Gafgyt)", "value": "4edc96cd690d2fe1da016967ef724188fdac1b0cd50481249de40de1156f0ab2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585411, "uuid": "e043f2d2-fd5b-4663-a8ea-9ff7457dd93e", "comment": "Malware payload (Gafgyt)", "value": "a7ddb3b6baf9619f1e061d207d79b26d47634ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585411, "uuid": "0a57f0db-455b-41ca-83d7-58b116f5b421", "comment": "Malware payload (Gafgyt)", "value": "54143d84234571e17300b13e528117024cce55806fd87190aae2b20b500bff5cb1c61eb9f0bea4546f326e8e5da62368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585411, "uuid": "5c03b5ea-a964-4448-9209-1b3aa9176bbe", "value": "T1AAB33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585411, "uuid": "0a6424c8-aa2e-4cb7-92dc-b41d284f8edb", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCNB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mju0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585411, "uuid": "e9e7ac5c-ba06-4973-ba6b-b013153914db", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585411, "uuid": "6e00b0e8-a203-49ec-84aa-8ccc1cf08813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585411, "uuid": "1d20c609-e03f-4642-b48a-c30931cd6933", "value": "d37987d99c0a2b5c828806cbf6cd702d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0baec6f-e536-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682625937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625937, "uuid": "e1d1fb93-3ee1-401a-9b1f-c48dc98ea630", "comment": "Malware payload", "value": "64bd22085850287f94ef6f0ba7cdb702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625937, "uuid": "80e336e4-213a-48f6-a833-1695da4e97f8", "comment": "Malware payload", "value": "4fdf0fb564edb856ac373c36cd37017bb0b5a84dd33c55dc2ec15abc44ff7f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625937, "uuid": "99998641-060d-4959-b73a-bf6990cefea3", "comment": "Malware payload", "value": "96af09951ddbad98666c7f3065f1dc7be999b86c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625937, "uuid": "6a01880c-f0b9-4b56-9585-1e52c702138e", "comment": "Malware payload", "value": "4163a2c24a0475152a971c800dfc366ec5ac056924c9ab20aa81a2eb306d1f7d13a992a085176bbca07c36d204f300de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625937, "uuid": "5e01a177-b1f2-4709-a239-1956c6a3fe8e", "value": "T156748D03B24DCE30E032B0359D8E9D6467ACB4712BBF65E7B7C85A14CA1A6F1257D623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625937, "uuid": "a85215f3-97f5-4dac-8a97-705e262bb65a", "value": "3ad594570c1b191fe2c6f5dfa23638cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625937, "uuid": "13e2afca-8d09-4e7a-96e5-76e14d928145", "value": "6144:yiUVxvu15NqlwfyZlshdWdG4CjZSm/7D5zsqhdd:0nvkslwqZlsgtCjvjD5z9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625937, "uuid": "4ad7d4a4-e7b2-4901-a03f-29637937d5da", "value": 354128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625937, "uuid": "e36b06d2-439a-423d-afab-6710c358828a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625937, "uuid": "dffef27e-3a58-4dd7-b933-b40da12dd40a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf8d617-e49e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682560326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682560326, "uuid": "dbc1e6bd-664d-4a5c-9635-f6bb4203ffc9", "comment": "Malware payload", "value": "346db50686cd8d30f0cfb4b3a49921e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682560326, "uuid": "4c4675d4-9c54-40a7-b102-a12125c10d80", "comment": "Malware payload", "value": "5241a9473fc4bf3281cf6699aa8344a5d0b2d277b2b0ab71b96edc3f9b3ec898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682560326, "uuid": "6fdf0a2e-77fe-4c98-9287-f5d3431c9921", "comment": "Malware payload", "value": "2ba8d0a14c8d6c8089803dd2234ba1b77c3085df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682560326, "uuid": "ba0ea2f8-58d8-40a2-932f-0fece037dfec", "comment": "Malware payload", "value": "1df3957d6af8485d845f801b2b66624a7610463326d72fa3aedcb6844d4f137b08f1625fcfdde393ab1e57b1dff399dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682560326, "uuid": "f9ec5a93-6478-4796-97e3-140f901fd6da", "value": "T145E4E64132DAC632EEFF9A355411059A76B3A60E6838F65D0D8EE1EC7FA37C18540B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682560326, "uuid": "67493990-909b-4739-8924-ecf3e7861934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682560326, "uuid": "d00487b3-a903-4f60-95fa-2e8801a2056b", "value": "6144:4PBGgEztwbfC/lXn5pPgwPZaH1LBaculhcDZgx1KJ+S4Ed98WPkIS9WaxhAa76hM:LP5agl+DZM1MW9Isxh6JrVFjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682560326, "uuid": "696766c1-46f2-4243-bd4a-1864dda71bb3", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682560326, "uuid": "3c50b669-d769-424b-bbef-cca9b9541b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682560326, "uuid": "4277ed43-a391-4cc5-8406-0a0074db9bd6", "value": "f_018bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1278e4-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597101, "uuid": "129dca59-485e-4bc0-8b5b-0cb2f9c3a37f", "comment": "Malware payload (Mirai)", "value": "5eb4ce193f65493d51312e827038fa7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597101, "uuid": "3294f89a-f2b5-482f-8be3-f56c4d2359e1", "comment": "Malware payload (Mirai)", "value": "52e1b5e4852d1fc0db7f1e414f22d2a03aa36582cd8e644efdefc7e3a122cec6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597101, "uuid": "0403f344-9ccb-4d5f-a569-bfc2febf458e", "comment": "Malware payload (Mirai)", "value": "98b173e8fcb7825df480a5e121912e8d0ef562e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597101, "uuid": "e40fe61b-b45a-44c9-8186-343205a45b79", "comment": "Malware payload (Mirai)", "value": "2a084d5fd0547e2b6c8cd1cc7e2e5964b19f16a4ff8924a17d926c5d4a5cadf31fec52e93ab5913edae95e363d2915e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597101, "uuid": "b49df9b7-9c04-44e7-b994-ccc4ec0443d6", "value": "T160131856F8824E26C2D413BBB67E5A8D3370A7D8C3DFB213CC546B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597101, "uuid": "63bd0944-689b-4182-94ea-c1504c07dc45", "value": "768:hcQDF22vG5lMFz/7m8PaNjAf89eLJjmtbORfe/8otpjV4PzOeKofsqw8wbZn:qo2yG5y97m80j9ntbofe/zVQzOeG8wb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597101, "uuid": "df9572ea-b00e-4daf-b55f-89c1afba2294", "value": 44600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597101, "uuid": "239d5d49-d5b3-44a5-b78b-ab6f91d0077f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597101, "uuid": "8c4e4175-c455-4a79-b975-c2f161d02789", "value": "5eb4ce193f65493d51312e827038fa7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a8393c-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554211, "uuid": "6870f068-9e57-4cf6-afa0-8a953451a87c", "comment": "Malware payload (Vidar)", "value": "26c56abcc3bc4af8a08859805c0e6cb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554211, "uuid": "29acdabe-3c8a-40b8-a64b-82ff699ab350", "comment": "Malware payload (Vidar)", "value": "54fe4ead4f5851ffdd4ee657632740a6095f362a34d593b04dbf0a2b339fc4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554211, "uuid": "55e15ac2-f5b5-4752-9c28-5481bd96101a", "comment": "Malware payload (Vidar)", "value": "9308503e9adc9b45dc31bb0ad0fa63c6bcb09349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554211, "uuid": "fceb8fac-70ea-408d-86ac-4aa983dc9671", "comment": "Malware payload (Vidar)", "value": "3f6cb9633a1f974d8cd09ffe0203e681521683d3ea9b0a4cdd9d7e87a8d5dd4844c4b490ee5bd06cb6ac4add7efef9f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554211, "uuid": "019f1abb-c7cb-4754-af6c-3df02e3319a2", "value": "T11564F132B991F876C84784344514C6F9AE7EBC609A598AB373083F6F2D313C19BB6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554211, "uuid": "7947ffa0-1213-4a55-8bc1-eb55343b13cc", "value": "2bb96128a9c5a88b5545cc9c23fd1150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554211, "uuid": "c0bdafe3-a805-4a64-87b4-5f5d0cd1e452", "value": "6144:Ki6VzKWnpwkG6fD3IyIbPELlNHxM6CavRD:1WzKWnpFGtyIwL3Hxhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554211, "uuid": "c9838c8c-798e-46d4-8e7b-e87f65da6145", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554211, "uuid": "da7fb237-4ad3-4480-a15b-02c5927fcc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554211, "uuid": "061db93b-f189-4eb7-b478-c591c35b557a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cae02d0-e4ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682595114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595114, "uuid": "9a781465-8936-4d72-b9c4-f9b82b0d4a3e", "comment": "Malware payload (Mirai)", "value": "db24332345bb0f42cfa889610ad283c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595114, "uuid": "271dec40-cbdc-4880-b51d-33317534c8e5", "comment": "Malware payload (Mirai)", "value": "552fe3d9b79ec62bce5e1d003b70d61402b359ac57fe91032dbaaed114fa693a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595114, "uuid": "6b02b000-d7aa-40d1-b57f-a3baddeb5cf3", "comment": "Malware payload (Mirai)", "value": "917f76c1f0beb9dd2c43fc37214bf43c3aec30b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595114, "uuid": "ee2c5d29-8713-4e29-9fa4-95df24b0610b", "comment": "Malware payload (Mirai)", "value": "203f36032d88c119719829b3492f48797d50b32478fad1d7198a6ed4ad18d5d3667d754423cf72631ac8e55c464ecd69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595114, "uuid": "727291f8-6728-4eea-811d-d6119e68e78b", "value": "T19E436BC4E643DCB2D8171630147BAF37BA76E6E91224E746E3A8A636EC51702D017EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595114, "uuid": "05133e47-7e80-43bc-9ef6-f04dd2d6e2b7", "value": "1536:BF14yTUx6Ahc/IOROP13EqRaSblcMUiBVFrVJwbZnm:B/4yTUxd2IOgP10qRt5cMlrHJwbZnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682595114, "uuid": "5dc8b3da-72ba-4aab-b35b-286d23b36e47", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682595114, "uuid": "b2d077db-3027-4021-8d21-1bf77118494d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595114, "uuid": "d959b385-17a5-491f-84c6-b7a12d17243d", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4e9fe1-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682593022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593022, "uuid": "56fe7f7f-905a-43c2-85bb-d4c6fec5e793", "comment": "Malware payload", "value": "5b47098a17ecd534de15df03b12beacb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593022, "uuid": "675de09b-aacc-4436-a421-7b1a3248c61c", "comment": "Malware payload", "value": "59df7ebde2f9db5aae9ac2d7db37e0d6e278ddb1cfa7512edd61f233df0ff33a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593022, "uuid": "435e0874-9017-47a5-8aaa-b7cc2250ca0c", "comment": "Malware payload", "value": "a4dbe70e2448e497fa783a00a3f5eebfa4dac85d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593022, "uuid": "ea92fbf8-fa58-40ff-840f-9ec72773fe10", "comment": "Malware payload", "value": "4fa26e61ecf887fe4c73ce3c9da3d9eb4d0fceec7bee46a4eea7172a3f17496edd7de1e7ad2404447bc4918ee26bf94f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593022, "uuid": "175c93a8-95f7-439f-b74b-13f6f7743c4a", "value": "T16235330299921BDD52873DFFC2033BABBC1C3D491E338F8C9AC5B59E398559B26CA051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593022, "uuid": "558205b4-2775-4bb1-9db5-543a90253b01", "value": "24576:/rnOGkxcI1nmyXyJawTbeYl1uJnJeY2Rpiev+rirtqG2k:/TOGkN1XXyZbeYlsJQLRoeSMYGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593022, "uuid": "988f0bbb-63f1-4ecb-b2c1-3dbdd2e9db1f", "value": 1067838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593022, "uuid": "b4e606a6-25ba-4356-bd1e-7ef8c0240785", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593022, "uuid": "8378d166-80a8-4926-ae51-bea4b1846fdc", "value": "RFQ_B11584_SAL R1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ea5e15-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598371, "uuid": "5cea55f1-6192-4145-abd0-9964ecf1803a", "comment": "Malware payload (Mirai)", "value": "d5dcd537a62cafd6358f8fea61a0beed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598371, "uuid": "1639f271-d3d4-413f-bebb-3ac09a2e9c3a", "comment": "Malware payload (Mirai)", "value": "5afdb3e8cdf07121279be19cfdb8276f1b856ab42e5674b9599a746db81871ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598371, "uuid": "5687b808-6334-45d8-843e-f55ded90b866", "comment": "Malware payload (Mirai)", "value": "bf2fdefd71cce4686e74de6c77babf546494e473", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598371, "uuid": "efd321ea-6d3b-46d6-abdd-6b70d8a8c558", "comment": "Malware payload (Mirai)", "value": "da626941378839dd002ea6b76d15963afad6db8f251b3bcd363750485e05acbe174ab30fc1946772b8b37696e1062961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598371, "uuid": "de7a4237-cc99-434e-8fc5-e0f1ede2087a", "value": "T1A914423A7E21AB7ED2A841310BFA6F74CF5529D337A19241E27CE6185E7128C0C5EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598371, "uuid": "3dd6526b-b2e1-44b7-bd67-907ae018dffe", "value": "3072:YhwZRg8tuqYWwXxy9rb+33tFetC+4/ROw1JNV8UM6lhcHQGKvqco1yF79RFprT3v:/YphogFDf+HJSnDDTlPWDyaejZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598371, "uuid": "3ea00e20-5721-43bb-b4ed-aadc4b14bc65", "value": 204676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598371, "uuid": "40b9b4b0-ab30-4e22-b83b-cedeafafde46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598371, "uuid": "84eeeb8e-19a5-4156-94fc-6a6fe3731dda", "value": "d5dcd537a62cafd6358f8fea61a0beed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77da712f-e4c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575940, "uuid": "1211aaf8-be98-4e32-988d-d66975c7bc63", "comment": "Malware payload (AgentTesla)", "value": "e679a1c9af73d604e0d87aa2d527fa42", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575940, "uuid": "e6f1a604-52ca-4830-b7c6-494383cd5844", "comment": "Malware payload (AgentTesla)", "value": "5d488ff0d4e196c44f22064885738cbf8ab09c772786c9f946228e4167fdef36", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575940, "uuid": "d81add3f-15bc-4584-9fb7-6f7bfba07633", "comment": "Malware payload (AgentTesla)", "value": "cea644e4f2ca8d478e6853bddcf2879279a24278", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575940, "uuid": "6aa1ed0c-dc10-44e0-8aa1-775b09d78add", "comment": "Malware payload (AgentTesla)", "value": "8d4f76497e7288e4ef49b88f4b5c74e9fc52c01b1958b4dafe28bf52eb10c75f8bab69159e52c5b606185948a8ec5c3a", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575940, "uuid": "04dd210e-6e3b-4c64-8216-287e8661e4ec", "value": "T19E8423910BE2340F07A8132CF15F89EEF9AD6F9C4DF6D2CA69AC41840DF985E95EE141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575940, "uuid": "9c094b51-8b0d-4386-8450-b8f8f13a25d8", "value": "12288:SvRIJEOgjehTvEy5z32/xVIoLyYKVme40NEnu:CRIJeeFE+72/PrLyYUcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575940, "uuid": "d7555119-1c56-4bf9-8e9f-bc74fde2a9a5", "value": 393556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575940, "uuid": "1b155b88-ac24-4a8e-aae1-587ff361b571", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575940, "uuid": "7f4bc3ab-8685-4c3c-ac71-fefcb8bc58b9", "value": "Urgent Request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e85c9c-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682593162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593162, "uuid": "bd2c23f1-8842-416b-8d82-00ca9002022d", "comment": "Malware payload", "value": "09a31f5231503b461debc41727b052f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593162, "uuid": "b58dde40-8c2f-43ae-a303-b8e9d9830b21", "comment": "Malware payload", "value": "5ef7d4f9de3d3c8818c1e3d63951d3bfe4f67e0c3695190ec946fed625eca74c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593162, "uuid": "1faa780a-0b41-47aa-86df-c6e2858cfb4d", "comment": "Malware payload", "value": "25585e07eb8673c59a678a123adfae67aba77f5f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593162, "uuid": "2cd69d3a-e22d-457a-b715-e7eb3464215f", "comment": "Malware payload", "value": "1b0b7add5204cc6a043370f04c313be670b89946b340d072f52e470a1f527317f3de0723e57d63dd358e265a53d7203d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593162, "uuid": "b24fb780-dd4a-43fa-b419-24ea3b00c1e7", "value": "T1A551296CBB6CAEC3D2514DE795B1FDBE0362B7A19BCE04D911A84CC63D943264C03803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593162, "uuid": "a345040d-8162-42b5-b2dc-bfe58baa6f9d", "value": "96:vtu4LxBBGX6bvMz5QSucqZ1cz855rj+NDPuUV:vs4TBrbkz5QB5r4uUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593162, "uuid": "89b3c14b-6409-4da2-8147-a9e50cf64b0e", "value": 3167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593162, "uuid": "13e6ec31-bb79-4bac-929d-af045ad2df7d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593162, "uuid": "c88b55f7-ea1e-4eef-a020-a03caa7beaa8", "value": "PO no. 5909121522.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fd0371-e50a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682606855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606855, "uuid": "f224891f-f594-405d-9940-7835ee9592e1", "comment": "Malware payload", "value": "8b7cf90dc98754bb111e33c4c4836e90", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606855, "uuid": "200ae6fb-797c-4e3b-933c-bce39501cd0c", "comment": "Malware payload", "value": "61b6d3b5f0d62b5ae6d2f20b4965acb9c95eb9d88b01adb83aea58f03736d078", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606855, "uuid": "f5404d65-0ff5-481e-a2f5-f8d68b9c26d6", "comment": "Malware payload", "value": "2f9c456dd34708400903a07051a003609ecde19f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606855, "uuid": "a6660874-9231-45b5-a5bd-2b47078fb8cf", "comment": "Malware payload", "value": "70a09a5a62ad1be549ccab99af8117f4494fa38e74e8d6e3320e1881e16c0bc90fd5d82b2e5a1a093b92810549226b59", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606855, "uuid": "f35f24ea-d988-454e-b79a-93a7352eeada", "value": "T16504FA027BDA4663E2FA9FBA9CF111805FF8A706A509EF7D545510FC84A3B088947F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606855, "uuid": "3104e395-9bd0-4daf-bda1-b5d5da4d65f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606855, "uuid": "46e11d86-073a-4d38-a275-9077ca540e9f", "value": "3072:IRwSAb5oUQ4BIc8gbggFGqW9BZIJNKDBWiSLfGBj8T8PIZ7i6hr/rMF:v76UlBz8gbgg4qWez4WiS7Gajl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682606855, "uuid": "3ae5b334-4790-40f9-8ec6-bc0c2602a12e", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682606855, "uuid": "5a3adf83-6f30-4e33-b2c7-8a6c66ac17d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606855, "uuid": "3689c6db-a3ff-4588-a1eb-53157e24c18b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2f1ce3-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682554690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554690, "uuid": "0b572a0c-fdbc-494f-af1b-405d254e05ec", "comment": "Malware payload", "value": "24c94559b2c3b1a22b0b8a4b6447df2d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554690, "uuid": "338a1280-0096-4213-945d-7611215d05b5", "comment": "Malware payload", "value": "625eb6a18a881aa33b7acdd0463bf5c20ac4294374745dc257f9924cad78a49a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554690, "uuid": "b2cb46f9-cfc6-4a6c-838c-7cff4a698f2c", "comment": "Malware payload", "value": "47f2c7b881f2859795249f5e5b48902c2c876f29", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554690, "uuid": "91063a91-45e0-4aef-bacc-dbe3c59c3eaf", "comment": "Malware payload", "value": "d7b2199ca7eaeca96d75fe946fa374ed5a93e94aaf93204520ffd8a40fe1bfd0869c58e106146952405f13b653341207", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554690, "uuid": "4d7ea955-e3ca-4c05-9b55-426a8a31e800", "value": "T1B824D0E65E1CD91B3D9DC75AE1056F83E614809F60650CAABB87664ED0FCF12F34EA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554690, "uuid": "b2e3ca89-53ac-442d-8a13-af2db034dfc4", "value": "3072:xTPTwLhFrOBsc4VsTKkcU/DNv9O9dFOZefrRJvzMV:VwLKpKkcUbNv9ORO8frRVzMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554690, "uuid": "2e835a99-2ebf-47c7-8083-ca499dbaef6b", "value": 217437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554690, "uuid": "cb02ade8-31d0-4ecf-8388-30167d484a25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554690, "uuid": "a53681d0-3987-4b85-b0eb-3ce9f41a1e83", "value": "ddata.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d9624a-e503-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682603765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603765, "uuid": "cbce716c-c647-49eb-aba7-6e510fa8509b", "comment": "Malware payload", "value": "30423ab6b1851cce90725fcccd856470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603765, "uuid": "5db021e4-63c4-4d39-b11f-805eb774a108", "comment": "Malware payload", "value": "62b5561c513232a33e817d7d0e4f51564c953d9d851de3d1f77a86fb8608f006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603765, "uuid": "0aacf6d5-12c4-472e-9fe5-f05583731122", "comment": "Malware payload", "value": "c3287d79bf119462bdc66d38d8d492eebb4a2975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603765, "uuid": "1e78c248-6601-43a6-b0cc-822f049d946f", "comment": "Malware payload", "value": "948ab79b11ec357188f1c7efee243ee8e406f6cf312b6d4779be654cb6f6e695c8a95049c2b4c2bbba1d126f9a5c512e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603765, "uuid": "bc94e356-0dea-47ca-a639-9e4e6706305f", "value": "T151359B2B714A6721C7F6333ACEB2C56092D164DDF729FD452B74B24F2952230A877A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603765, "uuid": "51b95115-048e-4c6a-b932-0142c4311bab", "value": "24576:2qcjAEPZkgNGhYFJXTKm2yTLxzxYDTpNDhifi9996:2ZRPqkLPNZxYDz8+99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682603765, "uuid": "da6b5660-67dc-438f-af3f-1d22f6c3a9ce", "value": 1139200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682603765, "uuid": "c5d3f6a6-4328-460a-9884-a29a9f45c420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603765, "uuid": "2fea1c0f-3164-489c-ad3d-b805db943b35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21368e24-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682586102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586102, "uuid": "1566d65d-6054-4b9c-b285-5a8dafbfc6f9", "comment": "Malware payload (Formbook)", "value": "2ddb72f65c3ca1cb07288e5ba073b66b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586102, "uuid": "6a3c0771-5a54-4495-aaed-3c385fa8b2fc", "comment": "Malware payload (Formbook)", "value": "6509f0bbb3f2cb5331e100d31aa02f24e6568642173fa2a8fa824db36c0c0743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586102, "uuid": "3708f411-859a-4b3f-a90b-1b4d7772efe3", "comment": "Malware payload (Formbook)", "value": "e687e0e34cfd7a1d57df7dbb7cc42dbb003cfd51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586102, "uuid": "6a3ab941-236e-4936-85e7-0df21a2e5778", "comment": "Malware payload (Formbook)", "value": "c4c3adc69037f603f500e5d4689ff30c6c12015938229facb85afeb92d02fb7c98de9cb77a66e415878f87c3d29012b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586102, "uuid": "adaa0514-f3b4-4170-9883-67128aebecf0", "value": "T12D120C14B7D45232CAF90B3BE96367911774B7E6AC82CB6E48C822576F027050DB27F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586102, "uuid": "2b6a40f6-3e47-44bf-9ef6-289d39c12bca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586102, "uuid": "b89a6a96-0bb6-455b-a189-2b2e09a3c266", "value": "192:Qkxl3T4TLuBihQ5zWWz4r7fx6GYMK8MnwhYGvMAHo7rd:hlcTLuBihQg9rEMKtkj07r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586102, "uuid": "1d541542-c728-449b-8e5a-9a54e8a3d071", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586102, "uuid": "325afe0f-ef3c-4401-b86a-abf07e60522e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586102, "uuid": "7ddf272b-9702-4cd1-acec-cc36cda72389", "value": "alloy_steel_pipe_accessories_specificaion1_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c53aaa-e535-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682625322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625322, "uuid": "d2834956-5f1d-4110-849c-ce597c7cd0ae", "comment": "Malware payload", "value": "cb021251a6cf6317a61b976f0a285a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625322, "uuid": "c7c51247-1b58-4629-bae0-3222fb927443", "comment": "Malware payload", "value": "66fea9a5b695e66e0a6a2e1e6ff6f3303e854bde55983b93051a09617227f133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625322, "uuid": "2451b5d3-031d-46b1-bc53-219867bbd36e", "comment": "Malware payload", "value": "4395ccfca60b9655afb1a0f10fd541f32baa6ca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625322, "uuid": "5235f6f3-99d8-4497-8480-620ffdddc193", "comment": "Malware payload", "value": "9b787488e78d6cce21c941354178a3b0f7f7442c5b918cae10a76625810a73808b312ab4d9563c70819fbe9f40ae9444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625322, "uuid": "6a3d9d2c-3fd5-4523-bc28-d30f7f2a8a03", "value": "T1D354F81392E17D44EA264BBA9F2FC6E8770EF2508F097B6D11199E5F08B2172C273B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625322, "uuid": "5cfb05c2-8fe6-4b9a-b25f-96ddede3892a", "value": "f021aa83c78590c8e9b0414e5514d473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625322, "uuid": "21590898-e2cd-4f2e-b33e-f3a411d0b14a", "value": "3072:4tgkhSBr/lDKz0w+Fc7dppVHZeBlmZcxp76k7vyMwztf5W5ildNu22HdXM:MxSFlK0w+Fc7d79oBlm+6kxwHZldNy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625322, "uuid": "d95fa6db-29df-43fa-98b8-dd83f1d4a92d", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625322, "uuid": "58dca347-271e-4ea8-a204-54ba8d56ee2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625322, "uuid": "d83eafd0-d9f4-40b1-aeff-6427eaf7fb0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be962a81-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554154, "uuid": "0fcf496b-cb90-42e2-948c-85271ad2a45b", "comment": "Malware payload (Vidar)", "value": "b316e2ac6668b35bd30898273f7a0846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554154, "uuid": "4b8cf0a4-696a-4557-b17f-b6474ee817ca", "comment": "Malware payload (Vidar)", "value": "67770d3ab80bd1d5d9c2be66f5bb8084f61c15a3060f84cdba21852e9609eb64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554154, "uuid": "cd6f921b-e39c-4fd9-8bb2-99ac81adca9f", "comment": "Malware payload (Vidar)", "value": "002c02a3d5d6c1435e1ec073fb6563b7220d5a40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554154, "uuid": "881035fe-6508-42ef-8ecf-067dfd653c04", "comment": "Malware payload (Vidar)", "value": "00be56de68244e81cf9ae3db42cb892f9526da4a8b453fade5cfe6da4251f5118e2ce94e2faaf8cfb53b40806d5e2519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554154, "uuid": "d09047da-892e-4ebc-b279-032b9f8a9a28", "value": "T1AC74F1117896D8B2C42688394054CFF4E9797861979AC69733583F7F3E303EA6677B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554154, "uuid": "ce621cbb-0dd8-4f76-9b2e-2d4be8d38855", "value": "2bb96128a9c5a88b5545cc9c23fd1150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554154, "uuid": "cd7af9c2-18af-41ed-ae84-f44fefdc4cc1", "value": "6144:dw1twTaGAIOxpYjQ/FxvcyMVt6qHGEpHC3E4cE5aT:i1TGAIcYE/bcymt6xEHEEeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554154, "uuid": "13c2a29b-925f-4e51-bb5e-6541e01df065", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554154, "uuid": "1c8bb667-5aa5-4211-a35f-ba426486b0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554154, "uuid": "a6901239-9090-4b96-b3e9-f8149c95d7b4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a25b3eb-e493-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682555596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682555596, "uuid": "11b3a2f0-265a-4f41-b9ee-39ac9be4b3d9", "comment": "Malware payload", "value": "52fdb2d82f18a93830cc98e12d8a008f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682555596, "uuid": "9b041fdf-3dab-48c4-b1bf-182c64ee7e18", "comment": "Malware payload", "value": "67d5060f11d9fb3beaabc0236cf75a41822b9e258474c112de9e0db0df76ce00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682555596, "uuid": "c9b8104b-afc2-4e88-b02d-b1f7ec1825f2", "comment": "Malware payload", "value": "e0e241c8e485b6f81bd7810a272a9c2f594cfd92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682555596, "uuid": "dffd8807-8b60-4b54-bdf6-f43f6ae72b55", "comment": "Malware payload", "value": "cf0003cf447dc6ddd2d076c45827832319065e30aba25b4d2718943dd5120bff890a832d897ae15be215762ec65b44bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682555596, "uuid": "cbf510a2-ccaf-4c3d-b537-ede9ca0606d2", "value": "T1C553BF5737A87A08F4A3D67A478143EE5076FF12F21D774B68983A1C227B0119E11EFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682555596, "uuid": "38102a55-8b04-49f5-8c39-1e3e7768a17e", "value": "1536:GQcxuiVQVirblgX3Eu/CRjfCZWAK4lxCS6m:inVvNgHE3RjfCUAPxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682555596, "uuid": "25626948-5721-4f3b-9060-ddf67f979712", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682555596, "uuid": "af365773-9795-4643-96cb-5df95ba8fc81", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682555596, "uuid": "52174b4d-ab21-4823-bdf0-98371d978990", "value": "52fdb2d82f18a93830cc98e12d8a008f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de62da3c-e4d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1682582125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582125, "uuid": "a1d16f0f-d387-40ad-a672-109cd19ed0dd", "comment": "Malware payload (CobaltStrike)", "value": "0bf0aa9d22f06bdeb43d10e033fb3645", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582125, "uuid": "c399b9b4-a3c7-46a1-af0b-31cc2de2626c", "comment": "Malware payload (CobaltStrike)", "value": "6814b1a19a671a9e76b114d1d64105ab65e2ce991f466ecfb5c1f2e8d96fa532", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582125, "uuid": "9fdd776c-3da2-4447-be9c-9f194b4cb54a", "comment": "Malware payload (CobaltStrike)", "value": "cc36bcf402c1bd4c00cff3a3856ab3c08de92725", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682582125, "uuid": "1a9b4e8e-a024-4496-800d-3c5cb8f4b625", "comment": "Malware payload (CobaltStrike)", "value": "20fefc89a34381175830019a518def54f2d1bf2b8eb5a053a4dbc9674bf9fbbcaab4e02f343977ccb012bdd311b30e75", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582125, "uuid": "2a344c8c-83d8-4ab6-bf9d-e12f82496a1f", "value": "T1EE353A8B7CD010B9D5BAA2318CA652917B31F8991B3227D72F51B2F82F72BD41E35364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582125, "uuid": "ece7ebca-0c2f-46b4-9fd5-823a79e09252", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582125, "uuid": "385e796e-09eb-4efe-a2b3-5323d7a2903b", "value": "12288:MngRnVaArLA9N6gx3BBoQfJfRpDo/naEZK8y13cxYg3+5iVgMdRg7940K1:MgRVaTn3roQRjCgcxYg3+IfUe0K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682582125, "uuid": "fccad2ab-6a7c-4504-8d7f-81ff525ceda4", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682582125, "uuid": "1970357c-7d5b-45d5-a80e-e217d55155da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682582125, "uuid": "ab2db90a-e553-43b4-9796-41d08fa7176d", "value": "0bf0aa9d22f06bdeb43d10e033fb3645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e20b9da-e48e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682553670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553670, "uuid": "36514af6-76ef-4b5a-8f86-19570168259a", "comment": "Malware payload (CoinMiner)", "value": "64680606044ae7b36f969dbf81e7b4c8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553670, "uuid": "c88ce80e-e55f-4b8e-9955-033360ef48e0", "comment": "Malware payload (CoinMiner)", "value": "6958b67fa4b8e6b4cb8a503cb6199b81c6df7491a97ec8edf51662e350078fda", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553670, "uuid": "3c01fa74-705f-4471-9127-4302e2da6aa8", "comment": "Malware payload (CoinMiner)", "value": "0912383575a2b4c3b999984265718be89d069bb4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553670, "uuid": "198293d1-7734-4c4a-a620-aedf490f3813", "comment": "Malware payload (CoinMiner)", "value": "e202978ce007ac27415407e48f0ba8b7798ce8fce538d4708748d511477d45f15f7ec96b7b085467168be9e082e2ffea", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553670, "uuid": "bae6f8cd-b49c-4c5a-aa47-d9ca622f9100", "value": "T158A501311AA37DEEE2BD0EB8D49211480D9868AFA31CD7B8B8C411DE52F27149DB3D75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553670, "uuid": "8d9a45fb-662b-4175-bb05-ccb18c9d60d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553670, "uuid": "65f1fb05-9122-409a-a2f3-0be1f3c32d1c", "value": "49152:ED1+W8fbdZexBBi3anWhIkT4Npqf068+MddudCSdddd22ksdxMdfnBiRd2H2ldjJ:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553670, "uuid": "3b36bbe8-cd64-46be-9866-31e1b7f696a9", "value": 2186752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553670, "uuid": "c26b3417-2902-49b4-8cea-616d0719af3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553670, "uuid": "054f3806-6f85-4c6e-85a1-fc7e94622d32", "value": "MSBuild.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed21e59e-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597182, "uuid": "dea96504-7030-4bf5-8b5f-feb8aa0fb8bc", "comment": "Malware payload (Mirai)", "value": "9e5817f6162f3e16fd55fe4f84987de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597182, "uuid": "b4d6dc4c-eba4-4865-812a-40140c1a2da0", "comment": "Malware payload (Mirai)", "value": "6af7ac39ed464550bc1f5a29f7d9df2426668c3fe750f77a2669374f471385bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597182, "uuid": "643085fe-a944-46c0-8494-09e02668b560", "comment": "Malware payload (Mirai)", "value": "6a403c0b3ebe4ac9f45917ce47d9afaa61af6d92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597182, "uuid": "503833f2-3877-4593-bfbf-8628893ecbba", "comment": "Malware payload (Mirai)", "value": "6f84fa390dd17a931b2fa5e9abd4fbef80309a88eb6fbe33d00de83145bc3807e71b0c0cdf74c63d90945aebb54d2c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597182, "uuid": "6de47899-8513-4499-bc62-e10f4dbf516b", "value": "T1F8632902B3080D03D1A70EB02A3F1BD1B7AAD9C122E4F685795FAB96C575E734585FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597182, "uuid": "e795f301-44db-4527-ab06-bada42b6518e", "value": "1536:wut7qIpnNyhRwJ5qe7y9QNrgGTLywbZnlh5:wKqIpIOpy9QNrgcywbZnlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597182, "uuid": "476c3242-9139-46fe-842a-6a38e8df7d4b", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597182, "uuid": "82f82585-332f-4e75-bf36-e7f4917e9d24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597182, "uuid": "c39db504-f2e2-4d9e-9c7f-1d4f073ecdb4", "value": "9e5817f6162f3e16fd55fe4f84987de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaadefb-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682585400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585400, "uuid": "e749ab7b-c7d7-4756-85ad-64c5baf89bb7", "comment": "Malware payload (Gafgyt)", "value": "e9ff27c95249f46cba129c9e1921db03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585400, "uuid": "b60e1de3-8360-4f7a-b453-3e29f708c259", "comment": "Malware payload (Gafgyt)", "value": "6b5fa97b164ab33413b2557004539ee0b9785f05cf1c61f9543cf70558d92e13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585400, "uuid": "41ddb139-8787-4c4a-b538-3f169b016c9b", "comment": "Malware payload (Gafgyt)", "value": "843c80bfb1e6766e28e0fed5636d1d088a2ab92c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585400, "uuid": "044abf91-78d5-4561-a0e4-4095451bf945", "comment": "Malware payload (Gafgyt)", "value": "37adf2dac3b73721a9c66b70637169962c940c20cee929c91698abe9f838a5adb446b49c26c02765947c3e98f1fb9232", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585400, "uuid": "9819b274-240d-4c0f-a5f8-6d3fd6b8d56a", "value": "T1E6E3866E3E21ABBEE16886310BF76F70C39529D636A19342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585400, "uuid": "39a279ef-0e7f-4e09-94ec-f818a2c6c771", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hN:vY01ZkXAQT4NA9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585400, "uuid": "4b674b82-949d-417e-a0d7-175fc1f0db32", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585400, "uuid": "3e4687ee-9902-42c7-95e1-b570e29d85dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585400, "uuid": "39f19307-4da8-4613-be37-31364051b186", "value": "e9ff27c95249f46cba129c9e1921db03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc08cd33-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598388, "uuid": "2b052a37-873f-44d6-9c28-dd5a1a348ffb", "comment": "Malware payload (Mirai)", "value": "ae4ae14ce2c0a345a41def301bfb2742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598388, "uuid": "f56225de-7f7d-4607-97dc-b5645c8f701c", "comment": "Malware payload (Mirai)", "value": "6cfbf7a2073d24a0de9e7ebb7c4bd605095a7056a15e8fb275e451381369ce27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598388, "uuid": "333475f5-92c5-432c-aa4d-4e0ea0ad58eb", "comment": "Malware payload (Mirai)", "value": "1f34ec8f00fe5c3f277589732902ba3fa525cbb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598388, "uuid": "2bae1d5d-3c64-4037-8bfe-5df9e4be83e8", "comment": "Malware payload (Mirai)", "value": "826819dfcf62a749b7649cc93000f56a283871c6760cbc53dbf1ae6bdda49fbf30382d57790959d211b08e21d1162240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598388, "uuid": "0705c662-8e31-410f-b80e-10715dd23e9f", "value": "T119D33B46EB418B13C0D61779B6EF4246332397A493D773069928BFF43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598388, "uuid": "9718b8c4-f3a8-4340-997d-c0c94824c6af", "value": "3072:TNyTMSxpFWd5JaOvJJpDYrcn8zlp2ipn2GH4s5KM/9aWY+744b:TNyTMepYfJaOvJJpcIn8ian2GH4IKM/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598388, "uuid": "66e51c86-8388-41c6-a33e-c62ddb33c45a", "value": 139944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598388, "uuid": "b145e39e-bea1-4b29-a36f-71a85bf10892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598388, "uuid": "a4fa5094-add8-4b77-907b-87e7d633e691", "value": "ae4ae14ce2c0a345a41def301bfb2742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba81e7d-e534-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682625016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625016, "uuid": "07839a05-fee8-40ba-abfd-193d993efe7e", "comment": "Malware payload (RedLineStealer)", "value": "40ce035dd0567f745df3ca67e4db7d33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625016, "uuid": "766c9c31-358f-4bfc-a97d-2337a170d7f7", "comment": "Malware payload (RedLineStealer)", "value": "6e91e17b970a66bbe42c0c69eae182d55a97bc56a01a21fafb0aad5b6428fd9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625016, "uuid": "821b0a5e-2d0a-4d97-adcd-9809f0644fb3", "comment": "Malware payload (RedLineStealer)", "value": "b3b03f882358543710be0ec4b39e80a48058ed28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625016, "uuid": "ca7645c7-eb77-4616-8484-4d3cf10035bd", "comment": "Malware payload (RedLineStealer)", "value": "079e45339a64ec86930be3d4ae210af1cffbddaad9db4e71b9e101507e5dc5006f3a39851664267e1d2737f872538fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625016, "uuid": "43c91da6-c77c-4dda-8a27-83fbff7e66e3", "value": "T14EE41217BAD88077EC7007F058F613C30A31FCE19A65A2AB6748D5D54CB3A94A87672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625016, "uuid": "1919112a-825c-4a80-957f-96f95c9717de", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625016, "uuid": "cf52418e-477c-42cc-86e0-d4788fd587a9", "value": "12288:yy90gmWWaltJoPOxVU0gUAPFZKsacP9OP7atxzEioMy:yytJltJoPMf/EFZK/OtxzE2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625016, "uuid": "7f72e2a1-9563-4914-8de2-204adbc5a27f", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625016, "uuid": "50fa1867-c44b-4d98-8035-6e0c02d66378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625016, "uuid": "f673101c-087a-42d5-91ca-99f02e343a7f", "value": "40ce035dd0567f745df3ca67e4db7d33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2ce1af-e4cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682580594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580594, "uuid": "0f991b5b-61ea-41c2-bf98-eb3a96709b5c", "comment": "Malware payload (AgentTesla)", "value": "0f42dfe51b23e058bf75dc1b4d379b1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580594, "uuid": "c388c769-b51d-4105-b39e-c2bef30e7cb6", "comment": "Malware payload (AgentTesla)", "value": "6fe8c589727c61797e7f1be599e1b8d19d5ba37bd71d7223f866c6d94dfbaf1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580594, "uuid": "3222645e-2ea0-42d7-aa6d-df9017611b56", "comment": "Malware payload (AgentTesla)", "value": "ba5997be98773a3107979420b8cdfa66684c186c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580594, "uuid": "4bff1f26-6ffc-44e7-92b1-9f6401dcbec1", "comment": "Malware payload (AgentTesla)", "value": "1371a992bc3de51317538399e512717aced0656cee305bc8f6052155588165291c26f29021a0ea5aab9bd3e4b56bf664", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580594, "uuid": "e7ad1b5e-a7e3-4b4c-a3e5-9a07c2917bfa", "value": "T15764236C79A5C953D5E11E315E3A2733A7FABA023464430F93E8238C3C67AC4DE29765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580594, "uuid": "7079d3ed-21f3-4b7d-9bb8-5708a4478854", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580594, "uuid": "d4f56fe2-7d68-43de-871f-ae07e8e86140", "value": "6144:vYa66ab/df9lROm5jO0rRlv70gNTb0Ui0o4T9eZ+:vY0gvlAm5rPz08TDi0Vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682580594, "uuid": "61894468-0edf-4f05-93d0-71735a8aa28c", "value": 322276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682580594, "uuid": "95c7e492-66cb-47f8-a8f2-27b30ebfbaf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580594, "uuid": "2e5e5816-b45e-4061-b4bb-24f215fe2903", "value": "factuur_rapport_22307104_B1552146_m64_docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a14ae87-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584829, "uuid": "a38d3c35-cb6f-4e41-8aaf-179b5c9c4e91", "comment": "Malware payload (Gafgyt)", "value": "a6e3ab33958a9a5eac413f1e787f5c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584829, "uuid": "389d47fe-f4f4-42ce-8d07-236b0af210db", "comment": "Malware payload (Gafgyt)", "value": "72a930a6197394894f271a97cf17825b3d8fa0903bddf4ded82a58c2153e796a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584829, "uuid": "8c16fdec-3700-4d14-aae8-b97d0f969360", "comment": "Malware payload (Gafgyt)", "value": "f8b8de1659d5b1f39952a93bc38cf9f6725a1cb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584829, "uuid": "97311e18-5fa6-4607-b2d2-a15d4af14613", "comment": "Malware payload (Gafgyt)", "value": "d4122a90e4ea191d1406ffd4a9119173477c310c3de077a315923105f013a2dc03254923a2514c936b615826a7a1a1bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584829, "uuid": "38c59c1f-8651-4ee0-a528-446a9f376dc2", "value": "T12FB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584829, "uuid": "81803629-b784-47fe-bda2-c669ccf21280", "value": "3072:WD3l+XQzPeV91310pWudQKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCQypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584829, "uuid": "c5ae2bff-dcf9-4e7b-bc8d-4f7091cc9e9e", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584829, "uuid": "ca297b46-dedc-455a-946c-f241594354c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584829, "uuid": "295c66df-62ed-4287-b4aa-6d78c2637496", "value": "a6e3ab33958a9a5eac413f1e787f5c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6683ed9-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682585521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585521, "uuid": "23f4da6b-ff46-4508-8ba7-8da4d009feb0", "comment": "Malware payload (RedLineStealer)", "value": "c73b19c6309a5551a6f9cba261c7819a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585521, "uuid": "920d9004-af43-4e6d-bd60-e61d82113527", "comment": "Malware payload (RedLineStealer)", "value": "72dc7b41e8958e28b7b715edb7b6d0d12962c8c492eb856db5d2659df5472b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585521, "uuid": "1b040701-f385-4913-aac6-63332ef3132b", "comment": "Malware payload (RedLineStealer)", "value": "4b604ccc87740d877dade5b982aa7e4658c17f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585521, "uuid": "d3de574e-be20-46f4-9297-3f118c873832", "comment": "Malware payload (RedLineStealer)", "value": "9bba1356b2ec531b936ee871f7e0a43dc146720a88a2b7c40df07778fc7acd982a68fac33a5eb5ac0a0aaf7d56a5f4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585521, "uuid": "1dbbcc6b-bd2f-4794-9713-171f1f8e3bc0", "value": "T13D352317B7F588A3D9B4337088FB93872331BCE19E6446D72705989A6CF26C0A536367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585521, "uuid": "3ba204a1-b10a-488c-95fa-b3e6844f6a63", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585521, "uuid": "3d0da577-507f-471e-a518-bcba6c2c673e", "value": "24576:xydeXmAXzV1PyZ5orGSmqgEtIq+cAM9tOElziDrKv5E2OcnpbtDXwNLxTiDk:kde2g3PyLwRhgECK9tVNCKBnOcnlNXiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585521, "uuid": "a7ec751f-e597-4ad0-9bfd-7a17c72fee5d", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585521, "uuid": "28362d7a-681f-4abc-9759-78e67c588d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585521, "uuid": "3e902670-b1ad-48c5-ac1d-34a984b45d5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ddca44-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597143, "uuid": "702b26fc-9fba-4249-ab60-35bec8b913ed", "comment": "Malware payload (Mirai)", "value": "93802a7aa5d3d181b83ad74e2dfed1f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597143, "uuid": "6cbca297-1111-47cb-b13f-5c67471b5bcb", "comment": "Malware payload (Mirai)", "value": "7383fcd551ad889b1569f91ba9d7af480cfaf24cf69477591fff9c1bcfa9dc46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597143, "uuid": "ad7888e5-2aa7-4ecd-ad34-55098233ae5f", "comment": "Malware payload (Mirai)", "value": "1e6e9a6306dda13a3fa22d7b609a0127678b64c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597143, "uuid": "2d98d020-dc65-447b-8100-ae41581945ec", "comment": "Malware payload (Mirai)", "value": "39897ece6dbbd20c682e684d2319a1959b62d72d89dc6c365fef90155955b860a5b9d7e93f24e29dc920e0504c5b9986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597143, "uuid": "69113d03-1c78-4851-b96e-e97fa31b73b9", "value": "T195338C77E46A5E94C08605B075649F705F23A0C493C31EBB29EAC2B56493DACF909FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597143, "uuid": "d6e0438a-95d6-4cdf-9a19-8884441c0516", "value": "768:I4aHfAe7YyVfMBNLr/ylS2DECjG7K0et3yayouxo0jCi9C1sfnrdUwnaI:na/Ai/BMBV2twjK0et31Fu/jCinr7na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597143, "uuid": "77bf3b6a-6cdf-4650-9104-c178bd5e6672", "value": 50484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597143, "uuid": "b3273b59-b036-456c-8f48-3d050fe9c34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597143, "uuid": "49914958-b81c-4d50-a141-f189da572192", "value": "93802a7aa5d3d181b83ad74e2dfed1f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad27a3b-e540-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682630035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630035, "uuid": "9d1ad44d-7aa0-4767-9caa-335292c00140", "comment": "Malware payload", "value": "d72a27fce7c891880f72fb43643aef83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630035, "uuid": "4f7d6b85-aa62-463e-a6f2-bcbe23a4d9f7", "comment": "Malware payload", "value": "7469fd4132bdc905d640a74ac96b6d2d8eb4d6a6f1ef056b4e66003f86f67236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630035, "uuid": "34116e9e-c701-44bb-b8a3-52a8da1ce22d", "comment": "Malware payload", "value": "c14f8df41fed816b516aa536ea4cc4ab6043529a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682630035, "uuid": "1235bdcc-ecdb-46a5-90d0-e6aebc38e075", "comment": "Malware payload", "value": "bf7212010d4dfdf603f4b4821aa6d0aaf03a78ca82c421eee303792adc690edf9efde4a17fbc3800156008168a3ceaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630035, "uuid": "7c67a2e6-f75d-478d-b998-0613a2a06a55", "value": "T134945C4393E13D48EA268BBA9F2FC6E8771DF6508F593B6D11199E5F04B10B2C263B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630035, "uuid": "f252d4d2-bf07-45e4-9d4e-9d3438b1ecfc", "value": "0301c97692eb66d40eb60ddb80bc0b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630035, "uuid": "e8aaa50e-91e0-4188-8193-43e415906ad8", "value": "6144:JQ9ofn9GbBCDSc0PqyMmplBUFWZWG1H4Vtt6TdN+m1:u9olGOn0Pq2DJZW9VMdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682630035, "uuid": "140a5a95-e462-4f3f-b2ae-f2c795c6bf57", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682630035, "uuid": "13ebabf8-5564-4702-83d8-98e132fc95bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682630035, "uuid": "b8510ba7-25b4-4f79-ac04-31f03dfbf445", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25d3dbe-e48e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553785, "uuid": "d7b403d3-fc1f-43e9-992a-a3f89f502311", "comment": "Malware payload (Vidar)", "value": "01a752ac625937eab82b167d79e85126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553785, "uuid": "876d54fe-a625-46d1-8675-ffeb6e4d1596", "comment": "Malware payload (Vidar)", "value": "7564e44c0b07a0f161c5a245ba8f2029ea70a297a5f9944c4c786a75f1e8524a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553785, "uuid": "d94a8996-e329-4041-b196-f7ae2cec9890", "comment": "Malware payload (Vidar)", "value": "1ec10d6c0476f7c3d2d02fb4f9836709f16c598e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553785, "uuid": "d75a8cf9-f668-4db4-977c-c3a34b07b497", "comment": "Malware payload (Vidar)", "value": "adc4a33dad3b08d6ee86b629871769a88e7d8170039256432d15d56f5c5054f876f7212ca7534753d2ed2a6366892bd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553785, "uuid": "7e189893-dfe1-4dbc-bece-9fbfa403139c", "value": "T1F0648D4392E13D54FA26AB729E2FC2E8771EF6518E5D776921189F1B04F21B2D1B3B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553785, "uuid": "c38d87b1-52aa-4eca-ba8c-75cc5857b26c", "value": "f0a1adf2f5b7a4f0da06f0ae432d3dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553785, "uuid": "1c30d51f-5df2-4a40-84e9-59b77cebc9d4", "value": "6144:1O2nZ+uLCWAhFAMFo/cMt0/eoaeh3funfdfqxVs:0a4uLbAMp5iKeUfiVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553785, "uuid": "77d08721-2e88-4bea-8174-4bd0c46b717d", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553785, "uuid": "dc0a4648-30e1-446b-9c58-20e33534389a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553785, "uuid": "85f8700a-96cb-48ae-bc7b-3e4709a5d970", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f1ee25-e4a8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682564719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682564719, "uuid": "6d9e7812-7b3e-4b4f-af65-93a5ab7b40a0", "comment": "Malware payload (njrat)", "value": "514543862851f465f14f5922f2ba518e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682564719, "uuid": "9b95f1db-7813-4c27-bb49-0f97c6918978", "comment": "Malware payload (njrat)", "value": "7601074a1bc8c6281950742dd2ebe1e7706a17df3fb9a06bcac7936b17a611cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682564719, "uuid": "390581db-0e4b-4404-825f-8703ed8ca2ac", "comment": "Malware payload (njrat)", "value": "648fd164ba2a3acc9c55d44fb7c89a46080db815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682564719, "uuid": "7d55a5a2-3085-499d-8d06-449cba6daceb", "comment": "Malware payload (njrat)", "value": "86bfbaf6190964151bdf1643baea12c1cc282e74766f6c414e689a6cc4b6fad08469ce5d4b6cf83d7684becb9a18e6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682564719, "uuid": "38a2a60c-ebb3-4b7a-88a1-6bc369f82100", "value": "T190E21B6DFBE64466D2BD0AB50571950013B4E103E523F67E4ECB24D62B2B7D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682564719, "uuid": "f905d919-9735-42d5-bd04-7614e540c0c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682564719, "uuid": "543162e3-321f-4682-ad3c-601bba47fd2f", "value": "768:BHU7YZxTDezxp+By9av0Z3vUJQmIDUu0tiKHj:Asaxh8QVkpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682564719, "uuid": "d22ac235-b3a8-48bc-a251-602162736749", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682564719, "uuid": "12287b97-2132-47b0-b934-e180058b89b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682564719, "uuid": "70426722-ef32-4e6b-a83f-2b1e2d605214", "value": "7601074A1BC8C6281950742DD2EBE1E7706A17DF3FB9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fc15ee-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597042, "uuid": "01335a80-f635-4b75-bdce-ac562fe925af", "comment": "Malware payload (Mirai)", "value": "a5f46ca5c7a2c7d379caab1f69dff96e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597042, "uuid": "828dd2bd-c78d-42b0-8d7e-b16b963bb7b0", "comment": "Malware payload (Mirai)", "value": "7608fafa2c01506f8937b4f366ec17428f9fd133c575b1ba62a5b8e74df003c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597042, "uuid": "42977179-a36a-4fca-b971-603b00fb1163", "comment": "Malware payload (Mirai)", "value": "c659c18ed84bc437d853c7a3d926a6e32e16198f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597042, "uuid": "dc4ea252-04ba-4faf-a5fa-66c92a64060e", "comment": "Malware payload (Mirai)", "value": "61c7980d83a6826105143fbe8242a94dc785004524fab3296d8309d20cb6b19a6153e4dd9b7389e397987d096c6464eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597042, "uuid": "89a65045-952f-4169-9042-8af494667968", "value": "T1B2F2D752F8825627C2E4237AB6AE5A8D373077ECD2CBB21BD9614B207B8151F1D23F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597042, "uuid": "c93f6a21-4ec8-4b69-9f5e-00deb18d5ca3", "value": "768:0LzdVtJX5qy4G5yqdZYX/jy2QGP2k6V3Gf9UQMGtq+5mslbnoXlwn:mzpq5G5yki/jyH2sEvMeq0NFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597042, "uuid": "76cf9b7b-dc1c-4344-8502-562a92def643", "value": 34472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597042, "uuid": "ca8c53a0-63a6-4bd8-86eb-39b1c2fe6b9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597042, "uuid": "913c3195-de7c-42d8-82ec-e6d3c97029cd", "value": "a5f46ca5c7a2c7d379caab1f69dff96e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c51220-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597057, "uuid": "03f1fbdb-9814-423a-be31-daa752e0b183", "comment": "Malware payload (Mirai)", "value": "893a76965f181dbc910b926cf3b7329e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597057, "uuid": "fb86696f-1093-466d-a96b-05b6b119b938", "comment": "Malware payload (Mirai)", "value": "77595a13417aa5f55dbdbfa9a04c7bda2fb8fb39836e02f1d6cfa65948fdafb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597057, "uuid": "eff0e7e7-da03-4f85-997f-e7215480cad4", "comment": "Malware payload (Mirai)", "value": "74b520696c2fe3c068cf683f01580d15653d6aef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597057, "uuid": "a35a1a8d-e322-4b84-9739-18ceab019977", "comment": "Malware payload (Mirai)", "value": "09fb3fcb4694abee464ef3216ec9808950a2d70b1e063a0495cc632225e5c8953c0244ea5422cebc59212091f2133f04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597057, "uuid": "aeb03073-e205-4906-a110-07f1bd634a13", "value": "T18FE34A46FB814F13C0D61776BAAF4245332397A493EB730699287FB43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597057, "uuid": "0900a572-9667-4de0-9427-16d6301d8a92", "value": "3072:mhhtnvxh386caQTWSn84iSSE+Hk95fwbZnIiXmjWM/9eWsj4IdIC:ehtn3VcaQTWSn8jSSmjfwRIiXmqM/9eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597057, "uuid": "10d7db7c-0a79-4f1b-a6fd-739656b30844", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597057, "uuid": "50f7e29e-cb4e-4b7b-aa03-ad7332c3da0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597057, "uuid": "4ec248a5-9b2d-4b90-9231-0c1308788263", "value": "893a76965f181dbc910b926cf3b7329e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec75e3-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584790, "uuid": "9a1e691c-f6cc-41a4-bc41-fd7292bee860", "comment": "Malware payload (Gafgyt)", "value": "d70e30364d0e482309d3d9aa895a2ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584790, "uuid": "58e1d129-5f76-41c3-9fef-5fc6504e1f02", "comment": "Malware payload (Gafgyt)", "value": "77f759be52538085ddb87760d674f88cf5aa2f957ebd88c7547152c420d8afed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584790, "uuid": "da9d7f29-f3e1-48d4-b692-81b725314bc6", "comment": "Malware payload (Gafgyt)", "value": "f2007b0a75ca3014480a9f0f3028690b5b2a79fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584790, "uuid": "268f9d96-573c-4bd0-897b-bcf76b46274c", "comment": "Malware payload (Gafgyt)", "value": "ffc78886683dab4a09690a368837a2a127bb314cdead1a862609151721b6bde5375ae7fdd6bc1226128d154652f66e1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584790, "uuid": "2e78ad72-df06-4cb0-b664-3dcb35f61d07", "value": "T166933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584790, "uuid": "78ffd239-c863-4b9f-8895-c9f785f273d0", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emlGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8r/eLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584790, "uuid": "f3510892-3582-4c0e-bc23-0e59b837f135", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584790, "uuid": "05ccc249-c0b3-407d-afc1-6629878585c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584790, "uuid": "d463b395-d1e8-46b0-b745-c9e5d618dc37", "value": "d70e30364d0e482309d3d9aa895a2ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0baad8db-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584778, "uuid": "fbde4475-1e08-4dd3-8201-8a95d0056163", "comment": "Malware payload (Gafgyt)", "value": "95dc895ae289d38fd99156dc87b2d747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584778, "uuid": "7aff4069-ef2a-454e-9ec4-6bcc96334969", "comment": "Malware payload (Gafgyt)", "value": "79fcbc0bb95d7f24588074602b0ed9f06e1de62eb85007cf21c92cf9261dad36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584778, "uuid": "00569868-2252-42de-b5bd-323e214b49db", "comment": "Malware payload (Gafgyt)", "value": "19a6a2233d728cfb961dfe29a136134697c25bd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584778, "uuid": "e298a4a5-8463-4609-b8d2-23ca10adc28c", "comment": "Malware payload (Gafgyt)", "value": "65b35d105e2e96de4a011efd53133bf9bd4174fe1f335d045b38e6489ccbbde4b84dfdc7bb2d85bf41a9aed831c8c90b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584778, "uuid": "84ae8b21-dd2d-41d1-919b-a52515fa636b", "value": "T113D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584778, "uuid": "ee575189-9e61-4769-9b5f-8e0d49063a73", "value": "3072:Sdf+fvEqa9FazYA7IboRhMe391CErktmCQA9FX9aH:ifWEqa9FaNhMe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584778, "uuid": "ccdf3cfb-7306-4c26-9832-7a6224c2eb8d", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584778, "uuid": "67c2f80b-cffa-4f69-8e50-9defa37aa24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584778, "uuid": "1a45d223-8b0f-4082-87f7-d872d8f03756", "value": "95dc895ae289d38fd99156dc87b2d747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ee1ba9-e509-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682606406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606406, "uuid": "f6c22afe-b139-45ec-80e6-4aba90c07474", "comment": "Malware payload (DCRat)", "value": "1aa3c497aeb9ac70c236bd4d8eb75389", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606406, "uuid": "a765ddbf-ace3-45d9-8672-9f278695cf42", "comment": "Malware payload (DCRat)", "value": "7c69d5ef985215819db582998e6885d9d2ae11a3d0d950cc16a0174aa31dcfdf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606406, "uuid": "e1f92f51-4b51-4256-903c-20789707962e", "comment": "Malware payload (DCRat)", "value": "29ad18b11dafa29a344201ba37195554f6c39c39", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606406, "uuid": "f4ed0350-85e0-4a33-8bb5-807780a76b82", "comment": "Malware payload (DCRat)", "value": "7f092152cac520507676ba80fc0d9451eec9487d8ff0650b61a80a6ab88ce69cc2738c1fc6e52e7a919550b638d56271", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606406, "uuid": "d32c8214-0e7c-4737-a941-db7c1b6901ba", "value": "T1C6759D017E81CA11F0182633C2FF451847B4AD512AA7E72B7EBA3B6D55123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606406, "uuid": "2278ac0e-e7fd-4bbd-a96d-d3a03f1da096", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606406, "uuid": "e9a12be2-0107-452c-8265-35a6f542b759", "value": "24576:u2G/nvxW3WieCAH6e+HwcHaYXz6lvSdX15aHf/Agu6BuBN1JGjvvwuhVzEO:ubA3jAh+HLaHvkCHf/VuC7JVzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682606406, "uuid": "d111a8be-0262-4809-be4c-0b6b1a2d590a", "value": 1660149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682606406, "uuid": "ac9a11be-2bec-4536-a824-850d2e81a9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606406, "uuid": "56b19fda-ac0f-4685-97ee-960789c2832e", "value": "7C69D5EF985215819DB582998E6885D9D2AE11A3D0D95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b869c7f-e4ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682581073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581073, "uuid": "c3ba7fd7-735e-47c9-8219-661a8f79b044", "comment": "Malware payload", "value": "ce2ab7b0768a650a5d73f702eec4aacd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581073, "uuid": "1fca9e18-bb75-4caa-a741-5e6c3cb07cfa", "comment": "Malware payload", "value": "7c9e32142b6a8d830ea4ccedf2121820bc05fbd481947cac5d7124b12cfdbc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581073, "uuid": "6bbce7cf-7b3e-4d15-9ed6-460871f436a9", "comment": "Malware payload", "value": "1174808a27f029d7e99897eaeef1d2ea9fcb5bd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581073, "uuid": "232474f9-bf30-473e-8054-70b842ccfbb2", "comment": "Malware payload", "value": "ec74955772140c0d61b9253cc38c6fd6be616fe5aab00f2f2cc7e3c38645a72f3d9db1bf51110c63d54029b1b56ea679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581073, "uuid": "11254b85-4c17-4eae-9bf2-e79f2582b6c1", "value": "T1E4C4BE24BBF41DE4F2B2CE30597950B5A7A5BD5A2520F66E0800480F0EB277A54DFF7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581073, "uuid": "5b5420c2-c3a4-48fd-b649-d59631584092", "value": "12288:W6RQWEYExE3NoN0/IgoCtpYvor+pEWUxtwM:Wr8ExE9oN0/qCrYvophxtwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682581073, "uuid": "a9f1c257-6c9d-40f0-ac45-82798fa12ccb", "value": 587128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682581073, "uuid": "4843538a-88cc-460e-87a3-e9f1b4cb5ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581073, "uuid": "8565e1db-fe78-44d5-9c99-a5cba7e62862", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8c8f6c-e4e5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682590928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590928, "uuid": "b8e02ac1-96f0-4903-8bb4-244f986e626e", "comment": "Malware payload (Smoke Loader)", "value": "26d0aa135898f141e6cdcf3b56786412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590928, "uuid": "b02674ad-8f4f-4ce4-b9e2-323152b8cb2d", "comment": "Malware payload (Smoke Loader)", "value": "7ed6f14261acedfbd1154ad17cd277422c532ac159beeb35ee333a14931cd146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590928, "uuid": "c5d2fca0-6be9-445c-baad-02d4119030e5", "comment": "Malware payload (Smoke Loader)", "value": "01ef282205a15cf2b1482f8626f81f20901d8ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590928, "uuid": "935d3542-4364-4fcd-804c-06b9a8216b3b", "comment": "Malware payload (Smoke Loader)", "value": "5e241b12fa2695c52b09d234a6e0373b3868f1284fc43d397a9f94a2d8e0dd9a645a1345e68283ad664c0f091b49d648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590928, "uuid": "8be95742-5a78-4058-9e0a-7e7b04f01529", "value": "T1D5243A0392F03D45EA668BBE9E2EC2E8761FF6504F597B6D21199E1F08B20B2C173751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590928, "uuid": "c194b5d1-0507-49f4-8e5d-a117cc58c266", "value": "aaf91e6cab5976c3af4756e59b45ffc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590928, "uuid": "105b1b7c-2bfa-4a8d-8c7b-36a5273d9440", "value": "3072:snRhgdkN/z+gZR9iQ2Gre2kjLV2+u4w5gV5RAjbnz5KelNvcJ:YL8kJasrSj53uEA34elNvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682590928, "uuid": "5a32e88d-5aef-4778-8188-3998baa77b1a", "value": 222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682590928, "uuid": "495732bb-5c50-4096-baf7-9095386e24fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590928, "uuid": "ac8ec529-dbba-4904-a969-fbbbea562720", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10377ccb-e4a2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682562022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562022, "uuid": "29757f65-e0ea-4bfc-9eea-801837ac3e99", "comment": "Malware payload", "value": "66dbf575a35c9e2dcf993341b98b920b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562022, "uuid": "f78ac3f7-ee32-464a-9cdd-071bf3dd2999", "comment": "Malware payload", "value": "7efa674b2a18fb7a62dea72b133a3f8892b419205852122be3b13f5a9b90f33e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562022, "uuid": "1108d073-d9c7-469a-a0b2-6879bc3167bc", "comment": "Malware payload", "value": "bb6cc75684c3b146657231f203356d9d8422f401", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562022, "uuid": "6a97a5ed-60ea-4a08-82e2-553fff8d30b0", "comment": "Malware payload", "value": "6334db974bc923d3884470ffa96813b7a6d7d10b5e089fd8ea765eee9c42727df000677207e4ccf1b22b51b662673ddd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562022, "uuid": "2658d7db-e6bd-4868-8b5d-731c3424d020", "value": "T12FD61286F768EA2FC873207248996335565B4D168F829787694C3F1C38BB6E40F5DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562022, "uuid": "cb744194-1b02-4681-aacc-3717620eaa96", "value": "393216:mG0I4PTFnBXIxy9J58zHhlhZydtzKfZeQf:XapnBX9587zX4tEEQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682562022, "uuid": "c8b256b5-3b69-4b91-91b4-5313cfec5e52", "value": 12664114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682562022, "uuid": "3ee35308-5198-4115-9f86-d2e25507e097", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562022, "uuid": "0d6c34bc-fa6b-4984-b651-a98beb042abe", "value": "new-update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e89468-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682554547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554547, "uuid": "0dd96e14-24ff-4cf7-a7f6-17f42996c436", "comment": "Malware payload (Amadey)", "value": "f8fdbc9ea254fec2eec1dc148d3c1fc9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554547, "uuid": "88005f65-97d5-469f-aaa0-11f968a11219", "comment": "Malware payload (Amadey)", "value": "7f02d0bb42962b382ef7d6f5c3d647fa199311a586b5f0fd6c5e266759211967", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554547, "uuid": "97cab83a-e076-4514-bc4a-7b3db1275462", "comment": "Malware payload (Amadey)", "value": "affe5b1980998a1d199562e370875c4262d83e56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554547, "uuid": "24b69554-03ae-4c2c-a961-ff2d5594acf2", "comment": "Malware payload (Amadey)", "value": "08f394cb6f4b16b9be8fe2adaa0210a4610778819f1dc2ce00a5fbe019ac7afa82a08de2ccf7071dc92b4cc7bea0c28e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554547, "uuid": "31e48a4b-98ab-4154-bf23-f6d0acf76710", "value": "T17E243D8392E13D51F9266B729F2F82E8761EF651CF59776931289A1F04F20B2C273B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554547, "uuid": "033474a9-3dd6-41d1-81dc-ecb0ad068d91", "value": "f0a1adf2f5b7a4f0da06f0ae432d3dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554547, "uuid": "f360eade-74b2-4e28-87b6-081445e680ba", "value": "3072:IXFY0LsfDyOnzlE8GjIJ2QivAO/0IhKhsLrlX7d5qJ0k0o:qBLsf+One8i7Qi/0IhKyNWJ0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554547, "uuid": "99031471-2474-4e22-8513-e8cd10aa7a5a", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554547, "uuid": "0270f399-6374-4d39-afd3-8eb684f5eacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554547, "uuid": "d78b8142-62c5-4d7b-94df-5a0d615bc6a9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f203566-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586126, "uuid": "813d12a9-21cc-4388-a1c7-b70fdcb9d1df", "comment": "Malware payload", "value": "a3ac8935c4feb0eef726668c1bd88498", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586126, "uuid": "d4ea26c1-c2c5-4b04-bb8e-c545c047a339", "comment": "Malware payload", "value": "7f5418868f6f347af4a7c7652e0d96b8fd2a1be9cd5c53b33265769e6210844f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586126, "uuid": "6f3005b7-6f43-4c30-b7d1-72e49f91cb80", "comment": "Malware payload", "value": "dd43d61cfdc0bcbd12c5ea4094edf8afb623b4ac", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586126, "uuid": "b38c75ca-cf97-4688-936b-7ae89f4e572c", "comment": "Malware payload", "value": "6a3fe7f6830ac59a309a5a67e6ffca706b63a50df75dd27be34775d30a766e3e0535eecd0751bc393a4a7e5aadea0a36", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586126, "uuid": "3aaa32a7-1a0a-4f72-baea-7af7d50caac0", "value": "T1E263F10A3BEAE4ECE82FC87E3180C54578DC46DCD8B8CD5714EF5DC820A98586792F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586126, "uuid": "adfb5f0e-af88-42f6-aecf-f9e4fe9544c6", "value": "1536:N1v9xQj4jxuA1gtPVfoySqawKXJ3zyse7isCW:T9G8jngt9HdqbeWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586126, "uuid": "f406d832-9eb7-4e5f-9bce-3296c0d95565", "value": 72301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586126, "uuid": "8c959a55-a0ab-4e14-b1ba-ebf46939721f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586126, "uuid": "9a84988e-5d61-49dd-8093-5e19e7e3a671", "value": "ORDER-230278.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8366cf50-e502-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682603447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603447, "uuid": "9de4daa4-0c78-4337-9b36-b376747c94d2", "comment": "Malware payload (RedLineStealer)", "value": "b287d9adf7a007d89ad55a6d9a61d952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603447, "uuid": "6a457f01-01c0-4f40-8686-a05caf5c4deb", "comment": "Malware payload (RedLineStealer)", "value": "7f7d395998d3047790aa064644f3f6f97e28c6d1e70c42a5497a1c72fdb0352c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603447, "uuid": "869ca60f-0cfc-4ae7-bff9-ad4c0a3b3fba", "comment": "Malware payload (RedLineStealer)", "value": "e4f5bbbf64f00928019b0154870d2e80e2cd39bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682603447, "uuid": "7d1cbe39-08e9-4d94-a6e7-039a8d8b49dd", "comment": "Malware payload (RedLineStealer)", "value": "79226c57fd4a0fb0eaf4d2ac80bf72dd7d198527c9119e4e0e68ef21a504749904fed40ccd9ff6e02abc52660f9ebea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603447, "uuid": "a6c9f4ac-70e9-4562-a6fb-d44e23d7bce7", "value": "T1D1352313BBC89036C8F617F155FF4243063AFCE34F68969B125A5A6B0CB2694A07573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603447, "uuid": "af089641-49e8-4ff2-ad55-ba00682e2243", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603447, "uuid": "6bbd1d36-177a-4a53-b677-e4979f2d32bd", "value": "24576:ayI4ZJbkL9SsLQkq5/j4zRNUFmeLIPLtfeijmWEkv:hI4ZJC0IRq5MzRNcmeL4BfeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682603447, "uuid": "1028e90f-1da7-4160-ad2a-6de71c4051f7", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682603447, "uuid": "4716d360-2c11-4360-81dc-b55cae6997cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682603447, "uuid": "4ccbf4dd-e2f5-44c2-8dba-e2c2fe01d16b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23239a86-e4cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682581381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581381, "uuid": "6cb9ef7f-de15-4954-ad27-9a70e96774b6", "comment": "Malware payload (RedLineStealer)", "value": "c800c64061a847ddbde1d9589e04bb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581381, "uuid": "afe4cfd0-1feb-49d9-b7b8-b57df6da7d68", "comment": "Malware payload (RedLineStealer)", "value": "81bda8dea8c23a2d316dcd54f9a3088875582fb36d887929a9b3046a56c38bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581381, "uuid": "57bb1101-220f-4794-94ac-76b604c9a593", "comment": "Malware payload (RedLineStealer)", "value": "cad5bb43f5a710a2cae296d1c4a74abdf7402a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682581381, "uuid": "e5b23155-397f-433b-a764-7f9153eb949e", "comment": "Malware payload (RedLineStealer)", "value": "c298f7a6597b9d50d7bd989ffc4a8a8f99a2e2c5c04062b91b95d671d4a6c3bf95b6f56c159525999e66288b03890e64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581381, "uuid": "f1a19154-627f-40e2-8121-3844a30fb2ea", "value": "T171649F03A7549271F529C9781DD45664BAB954303BEF91EF3388075A093E3E1EEBA30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581381, "uuid": "8814731e-5dd8-4722-bf30-64a588b5730b", "value": "ca3c8c0417494123b8ed0ceb29fdd52f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581381, "uuid": "9807194c-cde5-4752-b07e-97338ce7a7b6", "value": "6144:6QaQhpNA/utAZtSrlN0mxkYAYo0GwMhOnKq:6QtNAmtAZtylqVYAYoHwbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682581381, "uuid": "f49e86b1-2c63-47cd-ad61-17b7b6752430", "value": 321872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682581381, "uuid": "dff8dfa7-8097-4b32-865d-d83ae4444bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682581381, "uuid": "731cf5b4-95c0-4646-a583-5b64ac0afcee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eafd466-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682593024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593024, "uuid": "258f518f-57da-4fa2-82e2-954ca02c5c99", "comment": "Malware payload", "value": "b290974ea154fed50d030bed518804e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593024, "uuid": "c74ffb70-db99-4346-b9a7-2c5097a66a81", "comment": "Malware payload", "value": "86dcc7e6f6823b793907989be56679cbd0e40cf78353601b001548311be0434b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593024, "uuid": "3919780e-f7ce-42eb-a0f5-153a74fb824c", "comment": "Malware payload", "value": "2977d5ee168ba42870c49ea8cc31fcf8fbb6364c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593024, "uuid": "619bf7ac-debf-41d9-aba2-000f737bf701", "comment": "Malware payload", "value": "c85d2fbd58ae63cd9b7db7ce2fbfa68642882046db1befe490e2574d7221207d8d82e31aca8eab504bf0e9a106e72879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593024, "uuid": "a95827c6-c184-4440-8cc7-3847fa661a07", "value": "T14815E6B8A478C46BD47AC6B19EE69433F291AD6F305045D86DDA771613B370230CBE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593024, "uuid": "58970733-1d33-4601-9e00-9702a9b2e388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593024, "uuid": "22f8cbc1-eeba-43c7-a1c0-96d47e96be88", "value": "12288:Pv+9SLteS7rNmn6q+0HhBD2PI3/Ym1KOlB:X+9sr7rc6uBBSA3/tDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593024, "uuid": "cbc7260e-8c3a-467c-b456-94e147fa8367", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593024, "uuid": "542eab0c-f127-4ee9-9d78-d3b814b8aac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593024, "uuid": "3bedc8bf-622f-42e1-9888-d527306128bb", "value": "BANKA BELGELER\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bb4b3b-e507-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682605390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605390, "uuid": "72e11382-6f67-4e0a-ae35-6c78cb66681f", "comment": "Malware payload", "value": "9fc1787b914c1943f2581c4a497aef8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605390, "uuid": "5d18775c-14bd-43a4-92b8-e49a6a396cb0", "comment": "Malware payload", "value": "88777c5f1d707c8e51f78c7bac08425673a48d01d875c20dec83d9ab9a58b66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605390, "uuid": "90293274-597b-4320-abf4-9757be180c6f", "comment": "Malware payload", "value": "00550786eaed8c2f4628c6933375ab8fa7dc9011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605390, "uuid": "4a9f543e-ee5d-4b7c-ad3d-aecd577ae78b", "comment": "Malware payload", "value": "328afd87dcc46addb68df990d67de488085ec841bba0161213ec188a4ca6420344354b2bd40b6c4d0c038c05927048a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605390, "uuid": "71f78099-7be0-42ef-842f-d4fe666e15d8", "value": "T11E65AE0E77AA923AD9B36534CB7582256E6BBD400B1587D3E3D03A494F34DE17D322A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605390, "uuid": "e46909c3-4a99-4428-a11d-fb5441b87723", "value": "547ad02314534f2e74315cc85352825c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605390, "uuid": "ebaf1d2c-baf7-4bdc-ab58-8ba6ea906a8f", "value": "24576:bD1YS7FpyUxT3DC2a1zj1SqdAGFQZIx2C45UJoeXD:CQ5xT3DDCzjYq+ZIQL5UJoeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682605390, "uuid": "5febd0cf-7ef9-4d8e-abb6-72c2ae2f54e6", "value": 1524456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682605390, "uuid": "2d5ce2d7-327f-4eaa-9a73-da4c7bffb138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605390, "uuid": "25f1d6fc-f8d4-4038-bb4e-dddd10425bc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81037a4-e536-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682625842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625842, "uuid": "35b93aa6-035f-4ec0-b9b5-37834497b73e", "comment": "Malware payload", "value": "a287fba637786a3527c9230bc9d2a3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625842, "uuid": "beb1d30f-6f7f-474d-a16c-b04ec56a0866", "comment": "Malware payload", "value": "889b24667e2fc486d9937feddd8c44ab87d7d498831c58b6f635c59b67e022b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625842, "uuid": "e40aa1de-531e-4d71-bd27-e158e31e314a", "comment": "Malware payload", "value": "a0ec08c80a88e10618078faa7d2a07ebff46e900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625842, "uuid": "7774bec8-6374-4af2-b96f-8561cc86b788", "comment": "Malware payload", "value": "fb5054a8432f55ad39b0210890b6c6e388c576f012979557981fe0121c7b1fa4eb4ecf6d33aad4eae4a4971a56a3ceb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625842, "uuid": "d925e067-4a33-4f76-93ee-6706472b80c7", "value": "T176554A2527F56F06F67D47B4A2A41012C3BA79012A2BF7DF4DC1A0D668F67108F46BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625842, "uuid": "030f0d97-6300-427c-90fe-c1d9615153ce", "value": "12288:Iv0SpjIz1xScZyinb2dlYdkY3YiMlOmtix5UBIYhWz9OUM3T+OI8W8JfL136meOh:Iv0x3i2pvvhOoWsyofBm6HcSPLz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625842, "uuid": "f28f06e1-e8be-41fc-b6d8-aa94c112d208", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625842, "uuid": "fcfce713-d0bd-4e65-aa77-22008dcfbc18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625842, "uuid": "18c66898-adc6-4509-9714-6dd8b7f0826c", "value": "ConfirmacionEnvioTransferencia8863137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4338871-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682554593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554593, "uuid": "db983536-a885-4df6-ba29-d81c22249d57", "comment": "Malware payload (Amadey)", "value": "7d6ebd7d6cc9941b375cdb8f3d894b51", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554593, "uuid": "c76c8c76-76ff-40af-ac05-443d690cb921", "comment": "Malware payload (Amadey)", "value": "89f8dacb6a13d048d3410102403a77a17fc681fa30c56974c9fbc2f23758575a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554593, "uuid": "2a9b6a0f-38b2-4500-bd28-3867380ef77f", "comment": "Malware payload (Amadey)", "value": "d0607c679a910f0ae94913472cf640b04c59876e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554593, "uuid": "e70f088b-c6e8-4bef-a46f-c349621bc043", "comment": "Malware payload (Amadey)", "value": "1392eccd27fd8c90ce516f58dd0e354422fe506a5a21c0e61dceb6d7e07ac6c84f983293bee435f79924bb7b85695a8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554593, "uuid": "1047a4ec-b320-4f47-bdd1-87af8a17ae64", "value": "T11F243B4392E13D41FA26AB729E2FC2F8761EF6518F59776932189A1F04F21B2C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554593, "uuid": "48184f98-ce56-4ef6-b16e-b9114c58209b", "value": "f0a1adf2f5b7a4f0da06f0ae432d3dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554593, "uuid": "692f269e-b40e-4769-9d9d-c8f0121f8f87", "value": "3072:4HFYqMrlXVStm9stG3NXQP3Pr7geXlO75ufq5qXE3k0I:6nO4G9mrUeXlO10xXE3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554593, "uuid": "e20eaa18-b5bc-44e4-8a14-6bab88a05e7e", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554593, "uuid": "f7ac960e-3bee-4631-b980-a86175dce1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554593, "uuid": "4ee601ae-e1eb-4ecc-b5e4-81def7da7351", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fac2b1-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597120, "uuid": "00bea447-7aed-48d2-97f2-301d9f357f99", "comment": "Malware payload (Mirai)", "value": "d51dc797d8b75cf768058e6e637c4682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597120, "uuid": "e2154640-4286-4241-a0bc-0a598a33f730", "comment": "Malware payload (Mirai)", "value": "8aa515d81c9da298db50d09066d81242950707a8ce4bd07c9a8a0ada453bfb27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597120, "uuid": "2f741c04-0563-4aa0-8244-f5d4ef86c5ee", "comment": "Malware payload (Mirai)", "value": "b71034fc7f2243bab836b5c0cbc55740245044ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597120, "uuid": "ff360a29-3c66-4519-896c-2b64528f609b", "comment": "Malware payload (Mirai)", "value": "e6c8b7e5cbeb3e5e7a03402843fce6a8a6f81053ab5ff76ba03d943a84c545d78e959934fd0e4353fa9b7958d0bcac02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597120, "uuid": "c6786b03-090f-4692-a447-515a8b072ce9", "value": "T15483B50E7E218FADF79D823547F74E21B65833C527E1D285E1ACE9015EA024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597120, "uuid": "86751bdf-d5cc-405c-b356-ea38bad24083", "value": "1536:cR/CsX6jK7Dr3LiUsc4e/BeyrMMKenkXLwbZnrJ:cRqsXoK7Dr3xsc4e/BeyrMXXLwbZnrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597120, "uuid": "820a64de-c64e-47e1-a9f0-ef45b386dd0b", "value": 85660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597120, "uuid": "77d08cc2-6972-4e6b-835c-01ede262de9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597120, "uuid": "bab600b7-f58f-493b-afab-d265196904ea", "value": "d51dc797d8b75cf768058e6e637c4682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0b4636-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597150, "uuid": "e1391d0e-a8c3-456e-aabd-7312b5b0c0aa", "comment": "Malware payload (Mirai)", "value": "ec0f038a1d47948e2486caf34e47edec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597150, "uuid": "682de47b-38d5-4bec-b72e-517ece5712b3", "comment": "Malware payload (Mirai)", "value": "8c32a85c1e9bdaa54132f05d20e8ce12bccd3735ecd01cfa6d1336ee77f892d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597150, "uuid": "58a27384-9768-4a75-9d05-6017b45652a7", "comment": "Malware payload (Mirai)", "value": "1a3802d63b7f158f86f83b1a4aa020a69b59e87c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597150, "uuid": "7c046b98-63a5-4ef5-8d07-19ba176deaf4", "comment": "Malware payload (Mirai)", "value": "fe1517b2f52b4a7b27743d906375913c31dff4295fe4ef208fbcc4de7f561167cb5313423f484696489256797bb4b687", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597150, "uuid": "df8f4c63-876a-4973-9045-452fe73ff45a", "value": "T1B063A61A6E628FEDF659833447B78E21AB5823D527D1D681E26CD6002F6034E241FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597150, "uuid": "7a97a4ee-50ff-4c9a-b917-4e89b75dbe99", "value": "768:YaDrpAYA0od2i+mbpFd0gPG4Xom7QaQyCt4HtJWsbrH7IX1y/uFe3fCdwnmIG1:Y/GG/NPQDmHtVbPgVevCWnmd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597150, "uuid": "dab9e591-6180-4b6c-9731-202d37ed2cbe", "value": 72284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597150, "uuid": "a0ce5408-0855-482a-9ff0-423caef6dd02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597150, "uuid": "2e2334a7-e450-4c8e-9575-cc48aedb53c9", "value": "ec0f038a1d47948e2486caf34e47edec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2cd5b3-e50a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682606842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606842, "uuid": "13ef37b9-6fa1-4c40-b35a-e5060ef58d31", "comment": "Malware payload (RedLineStealer)", "value": "65a9aa9882acc9c11ca797644dad40a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606842, "uuid": "29067eb2-ebca-42ba-b588-a2790aae1d0a", "comment": "Malware payload (RedLineStealer)", "value": "8ea0c44ed3959725b46042f77d0bf0fbb57f8cafc0197e0a77a3cb81bc734b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606842, "uuid": "e33255a7-2995-44db-bd34-fb6920e29ec4", "comment": "Malware payload (RedLineStealer)", "value": "8d49ef029379df9bda0238b4666bcce2a5525c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606842, "uuid": "134ddeda-fca7-46b5-9aa7-5694fe8f5a5f", "comment": "Malware payload (RedLineStealer)", "value": "f1019a1a96fd1ee37c1f12e92533dfe605bb4d39d8162df8a0d364ac9826024766a1630deaf20b36c41226c27c5a7b30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606842, "uuid": "d1e1b5f8-66df-4492-9415-47f03cbc61f8", "value": "T1CB945B4392E13D44EB668BBA9F2FC6E8761DF2508F4A776D122D9E5F04B10B2C163B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606842, "uuid": "38e39657-0374-48d8-aab6-0f478b0a0954", "value": "3b1217408d4bba412a22718d3068dd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606842, "uuid": "a7b42a3b-8660-4742-8d18-e745f65ab34e", "value": "6144:kCMNEf0nkWZXEYbsZmAtbTf6IvB3eYV3dCUHrdB1zbDdNJ1:kAf0n9XHKd3JeBcdfdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682606842, "uuid": "52f4a572-cc76-4ddb-9535-813f4ae37358", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682606842, "uuid": "ff4d9253-b7df-4e63-ae17-42d396e956af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606842, "uuid": "6d36346b-6754-4ac3-acf3-adec1b1e7485", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223c95f6-e4e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682592547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592547, "uuid": "de6a7444-2f13-4e25-bf47-5c900e1c0cac", "comment": "Malware payload", "value": "5d0e6b60347b4816ddbe59c583387d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592547, "uuid": "2ce28cf4-ef72-49e7-a618-ab3d5ba00afd", "comment": "Malware payload", "value": "9142931e43055d6363ee826270edf47ada8acc56ebca1084ca9ee2fcca579536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592547, "uuid": "c7b9c4cf-883d-4a5d-8865-2cc14baff58e", "comment": "Malware payload", "value": "a1c853babc202a972a115f18522d145e3467a7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592547, "uuid": "3d4a00ea-273f-4597-8a07-eda172edd66b", "comment": "Malware payload", "value": "24a46a50f1503e4f478c4edf985dafef60744d0f20632a8eaeead5350994f194e46872b8127b70cf84dddfaa7d0cb249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592547, "uuid": "5ca52c5f-139a-4f46-8b4e-581a0d757a22", "value": "T153A5017B7E83FDE96B750C94D4C605254C80A8BB831C60E4B8E4F7AE93F5854EA56CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592547, "uuid": "ee4ed3a9-d0b1-41b0-8e47-435fc48f14b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592547, "uuid": "e3460e90-da3c-4e9d-9655-0ea571c46555", "value": "24576:4rsUxXDsKyVTAUGyHbFcwuqTJFMHgBKV8ZW4psRIHNRB8nPeM2zypUrIQdzBI3VT:Esg2++MQZRmmHNRyPdB1BVJtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682592547, "uuid": "6c8edc6a-f05e-4161-9d1a-3d6f6b1823a7", "value": 2178048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682592547, "uuid": "df0157c4-dd7a-4b80-904a-e80b09cbb08f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592547, "uuid": "f83240fa-4ac8-4f85-a615-780cf4b37abe", "value": "PO7535522.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38607b8-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597166, "uuid": "c7fd8e28-e3ad-476a-8eac-cb2b106c649e", "comment": "Malware payload (Mirai)", "value": "2f570a6741a22f61df54f6f78319f14f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597166, "uuid": "e24914c6-d0dc-41aa-beb7-b0f1c57c6785", "comment": "Malware payload (Mirai)", "value": "93d865f386250673f1cf87bd46e7628a10ea26383544f83018b73632c2e3dde2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597166, "uuid": "089c7eb6-d74c-4fb0-a576-12b213f021ea", "comment": "Malware payload (Mirai)", "value": "9807b2357652999be971d83a4a17be2202660ce4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597166, "uuid": "f836fa5c-1aad-4928-ba66-21da33d42ad7", "comment": "Malware payload (Mirai)", "value": "d9ea6cd2bff6971013e977e5b3fdfbf712397b52d6dade4ce444bf501cce20346a7545db49e8a0b9e48d907e5d52a9ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597166, "uuid": "6ad0accb-7d31-4cb8-b01f-637b4171476e", "value": "T1F0334B02B31C0E57C0A35AB0253F5BD097BEEAD022E4F689351E979A9671E375482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597166, "uuid": "4086633c-5b10-4014-8c7b-ad2da60ec93b", "value": "768:pO7HKtChgliRuLR/QPNIHGs12oCSylNEks9am0oLojItAgOYIFRxtKSownWIo0:89c7GYdl0m7amLTtAgz8xgMnW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597166, "uuid": "b2fde9cf-78a7-428e-8081-db4b652c4ed4", "value": 54792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597166, "uuid": "4522b00f-13d0-4848-a499-ed51e6f292d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597166, "uuid": "dc5fccb5-87bc-4f9a-b8e9-d6c23b3c1a49", "value": "2f570a6741a22f61df54f6f78319f14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34382f94-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682586134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586134, "uuid": "0c3dc42e-a2cb-45db-a86c-e61199eeedf6", "comment": "Malware payload (AgentTesla)", "value": "19608a8e12e95bf9c023d5c330cf6bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586134, "uuid": "04b851dc-91ee-4c75-8c03-083be0a4e8c1", "comment": "Malware payload (AgentTesla)", "value": "96590369d3cd31df52e4ccaee6d98f9957fdfb048e811a134dbff8ef141a5d6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586134, "uuid": "2843f4fb-0212-45db-9342-b94f509582c6", "comment": "Malware payload (AgentTesla)", "value": "4698d11e0c28505d1d1259ae5311231fffa29800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586134, "uuid": "68faf812-ba39-422c-8c43-c92bdeaf70a4", "comment": "Malware payload (AgentTesla)", "value": "3fcfb7cea642d88cccbb03d60107f33b46ae13275072189c7e5469f729f8413713681c521cc78e449ffe6b382a8399d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586134, "uuid": "6dd56daa-ed60-4037-bc62-e1296b608696", "value": "T117B42369C1874CB4958438D286058B1E216D27B1193BF4B9CAFE63CB2ED9F472C8F598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586134, "uuid": "b9e50026-81ed-478d-95b6-e4bba6b60626", "value": "12288:F0cpSLq8WkrGZo9r47PfPQ2V9jtlqrDGAtzhUTUzQ:mcpSPuPfI69jtlqrDNzhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586134, "uuid": "964f183d-b06d-438f-8e74-52d5c381f57d", "value": 535697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586134, "uuid": "135031ef-1c8e-486e-9308-a88fb7639cb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586134, "uuid": "f9119726-8cf6-4f70-a810-61cea8c679fe", "value": "Proforma Invoice#77634364366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d00f892-e50a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682606845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606845, "uuid": "2c882e73-5e58-4b38-8955-de633947dd21", "comment": "Malware payload", "value": "fae3f6557181a9608d911796be67401c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606845, "uuid": "c4f0278e-882a-4afa-8439-45dafb4aa7eb", "comment": "Malware payload", "value": "96a0b9d9b197fdf8ff5573d1b8b1e0c8691374f25bcee9820dadf28bdbf9b02d", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606845, "uuid": "775e447b-3c4a-4dc1-b3b1-2423fede0346", "comment": "Malware payload", "value": "0170519b66ed77459f03bbbcb3da890ecc02d5a0", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682606845, "uuid": "73d8fb95-1b88-44a0-993c-38c889f6923e", "comment": "Malware payload", "value": "2e6f1bdde33f818c9a27629ce222f25f6cb60af6efd185ba5ff1f9705a34291005590f2ffe8c55f012602939d4233da4", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606845, "uuid": "cfb3b936-37cb-4600-b4cc-abc3a4a717bc", "value": "T1CDA2F822BB57D731C5292F32C8A612440375E3876677DE1F389D222EEF5339B0B96690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606845, "uuid": "d29e47d7-9794-4f77-a2d4-64f66ddd9244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606845, "uuid": "548f07d8-caa3-4f98-b5c0-3fde96c45eb4", "value": "384:A7FVq7JuQqlbnDyZDHwqcf9vwEG9/XwJwq6uJfq2GSLwq3eV:A27JgbeDHwqF2GzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682606845, "uuid": "2a170dd4-624d-487d-a611-eed7485c9f95", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682606845, "uuid": "ffbb0a99-7706-40c9-9d2e-d4bdb0f80b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682606845, "uuid": "2e8abab8-013d-4903-b501-ab36749f5a48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24971caf-e52f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682622615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682622615, "uuid": "9a7963ff-b874-41c9-a8fc-6eb367f38500", "comment": "Malware payload (RedLineStealer)", "value": "01243b19b382f171b1166b656d2eb67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682622615, "uuid": "42efb79d-973d-4fdb-ad15-095db9825bab", "comment": "Malware payload (RedLineStealer)", "value": "970f26d5353900c3a2aa72e844c0d2a2525fc9ba3ed23f16c5645ef60b98354d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682622615, "uuid": "d3768956-8193-4dc8-be9e-95dac2db79fe", "comment": "Malware payload (RedLineStealer)", "value": "9065fbd5c01718b89debbeed06b06d211e60a190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682622615, "uuid": "6aa02ec6-e756-426c-a626-63e4e85d4de0", "comment": "Malware payload (RedLineStealer)", "value": "4a86b09737735a0180e6ee1c134323b39be0c2fd22e9287dcda7931150801f54696cf2cacfd675f58f3a585e8dccf964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682622615, "uuid": "0ce778f1-2ab1-4c6e-88ba-3baabc64eade", "value": "T1DD649E03AA944370EA25C9B91DD447A075B974343BAF92DF7348134A096E3E1DEBE31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682622615, "uuid": "7feea3f3-bf47-4a88-b962-d732a9dcc2a3", "value": "0b842ba84a23cfa3e4f1f5c8100257f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682622615, "uuid": "d0753221-ca10-495a-8216-5f8ca2090592", "value": "6144:JdSj/Ep91amD/3aJ4LjBBVJhiGyCyFgOGi3Ew:J8j8p91NTaJ4LjVJhiGfdvIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682622615, "uuid": "c7e505e8-ebcb-4c3d-8db7-2212ff5cc4bb", "value": 309408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682622615, "uuid": "c6f334ad-6fb1-46fa-ac64-af98dd8dc00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682622615, "uuid": "6e95ade7-2e38-4e0b-ba8a-dc8896438424", "value": "01243b19b382f171b1166b656d2eb67f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46d5168-e53f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682629729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629729, "uuid": "6f04c621-c9fc-408d-be52-c539dc5bcf09", "comment": "Malware payload", "value": "a0b9bf20b8491348e21136b4b007dfe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629729, "uuid": "417d6096-aa20-4b0e-b296-b4730dbeb969", "comment": "Malware payload", "value": "9aa89befbe2e1a4b57d0bb75021c856801435fb5945d5943a37be8db9bbd404c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629729, "uuid": "2647c53e-f141-4eec-a55b-a389866b6f06", "comment": "Malware payload", "value": "414893101c2287cea2210b70853b2d466eede691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629729, "uuid": "ae2ed7b6-92af-43c4-b833-be5b25ffeb2c", "comment": "Malware payload", "value": "d480b0704c73284ffa3fe1048bf6cb7e19b62a53a39c04553c38b01465f2b7f5e4492ce486183d5ae62bb4214e5dc5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629729, "uuid": "54965581-72a7-48ba-bfdf-3a26190327ec", "value": "T10E54191392E13E44EA268BBA9F2FC6E8774DF2508F497B7D22189E5F08B1076C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629729, "uuid": "c703c587-b588-4250-be77-4380062d9261", "value": "0301c97692eb66d40eb60ddb80bc0b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629729, "uuid": "61f3bf85-66d5-4f31-81f7-9482f6f208c6", "value": "3072:8xQVOMBbDV3NWCn3I6J8aBAUR1KWF5DvlbcO53M5R36QdN/HdXM:ZhxIOhPFKWFZlx3g36QdN/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682629729, "uuid": "c98e67ba-3a35-4ab6-bde0-9f7257f65018", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682629729, "uuid": "3a9f7fa7-a170-49a1-b2d3-653947999b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629729, "uuid": "ff17fc69-17bc-4a2c-9f5f-f8ef6f120da5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fa0046-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554356, "uuid": "581e8b2a-92b6-48fc-b021-6e08afbc15c2", "comment": "Malware payload (Vidar)", "value": "564af6cc967eccd7e407a7e267fc3d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554356, "uuid": "e6f72fbc-cd60-46ce-82be-491a77bc982f", "comment": "Malware payload (Vidar)", "value": "9b18f5731f338a90ca3a226572e21c2c958c345d6adfa40f8b012a79f412dae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554356, "uuid": "db69d6db-dd1f-40a1-8148-b5e9f35ea69f", "comment": "Malware payload (Vidar)", "value": "1374638b9443a2f229e20815b425e21c65491b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554356, "uuid": "6d3ff3c2-af2a-49ce-a432-928cb3cdf454", "comment": "Malware payload (Vidar)", "value": "052dacb78b9a5a0e3506cd334bf6064914aaa9601706b6adcf49dfc3c9ead24a2feed94d1dd3605346cfbfa3d5a7c2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554356, "uuid": "380ae7bb-798a-4463-90e4-e80cd0dae493", "value": "T18264F112B6D1DCA3C8178D348414DAF0B67FBC606A464AD3F3983FAF6E70681479B265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554356, "uuid": "b80971e3-2d7b-4b0e-a6eb-49be239994c3", "value": "4b07758d5b167b27106e05a1732f0848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554356, "uuid": "e8745a8f-1cea-47d8-9508-272bb37a88c4", "value": "6144:8rdl4ZxeLf5Zsnr9pe2JQSG41qXnDGd53mYpG:8rdl4ZILBGnpo1d6qXDw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554356, "uuid": "813fa733-5121-4909-8c1b-7f22eaff27ef", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554356, "uuid": "f1f5dba0-9a85-46ce-b742-beb67793610f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554356, "uuid": "e59a040e-57c8-4956-bcc4-34058b2a8e46", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956a8477-e4c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682577707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577707, "uuid": "3e6730c4-dc92-44fd-a859-49a49299cabb", "comment": "Malware payload", "value": "db4c49c6e6473624800717dc06ae0f69", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577707, "uuid": "4f70e4ad-bcb7-4e54-b349-2c3475270375", "comment": "Malware payload", "value": "9d37ae0d30d1d53c95c58ef83c5f5e8e33de056f97e64cde6a68f6464d2e79ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577707, "uuid": "342e6b06-de5f-43ed-9100-90a6dbf172ae", "comment": "Malware payload", "value": "408dc3f93670c64d14325994cb8edc8b0b3027bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577707, "uuid": "70786afc-7823-4dd3-aeb3-769f1e23d261", "comment": "Malware payload", "value": "3e4663b781b63c724382674449716621ad3257a6f3bb295bb1aa874591471bd0688213eabb3e6594581bf0bda24ac21d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577707, "uuid": "923135d6-4b05-49c1-aaf3-18295e9fc730", "value": "T15C74239FFEA4817AD567D6C0DAC40502B78C2442BCB93EA9753E788BC4E15CCAB0B561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577707, "uuid": "e0ec696a-b2fc-480f-aeb6-16fe00095232", "value": "6144:ZaMuKSoNvKaeaLneTSaHm/+ewmPJTLzDeKUVKKhEyfS4A+lrHdtt1hhtA/4IF:ZaTIv7eTvG/+VqJH/e/VPhEqA+dHPt1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682577707, "uuid": "784bf0f2-0d38-4739-8573-ab899bc4cda1", "value": 354223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682577707, "uuid": "d6749096-d83a-494f-8e66-e6c0325a6d02", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577707, "uuid": "7f42a433-75f0-4594-b0ca-aaf66ee30b99", "value": "Ticketnummer.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6947240d-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682593095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593095, "uuid": "f7e618cd-a7ca-4e1b-a5c6-4f78b43f6df8", "comment": "Malware payload (AgentTesla)", "value": "0558114e5a19d5a278da42412228def8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593095, "uuid": "b640a7f7-942b-4a45-8596-3f1677011d76", "comment": "Malware payload (AgentTesla)", "value": "9e9271e281e82549c613d3aba4a0603536a63c960bf42c16302f6b7668de0d78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593095, "uuid": "746618a3-5e62-492c-84fe-5feb7217f6b4", "comment": "Malware payload (AgentTesla)", "value": "8be4fade5b39c8a53b69e83d2714bc4ec2c70fc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593095, "uuid": "046a39cf-723c-4126-adad-e43a2180594a", "comment": "Malware payload (AgentTesla)", "value": "13b1a8178c6ce5666a33a4df2a4f9280e0dc93751bd5fc9af9b77f624a452751e290f46c2f11758801b70e74887b3993", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593095, "uuid": "a57ad265-a093-4159-bf87-1addb6f1a58d", "value": "T167E4043C09BDE23B91B8DAA58FD1842BF710E56B3115AEE6ACD747558316E0234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593095, "uuid": "d060f943-f7d1-45e0-be2a-66f515dc3fdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593095, "uuid": "4a5b6df8-9e4e-4172-90fd-0f6cbd63012f", "value": "12288:CkrcHD2rnMEbg439qBad09sWxq9HRwHLsCl:7AHD0M+gKqBai9/xaRoL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593095, "uuid": "57be0e3b-ab86-4adf-8947-394f200202c2", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593095, "uuid": "d2c35f56-dbea-4c52-8eca-4ce482760f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593095, "uuid": "7f972d22-8fdc-49df-963b-91568cde2c29", "value": "RFQ 080323(MECH)NBIAP-23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d5d034-e4c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682575371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575371, "uuid": "87b15054-ce4b-4f0a-85c3-f75e532d132b", "comment": "Malware payload", "value": "4176fb75fcf372c8d4536a320347027f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575371, "uuid": "8989cc73-b609-4810-9d0b-52d533bb1ce5", "comment": "Malware payload", "value": "9ef84ae9de3616e74a58e95e22c7e67d3295762ff65c92cd3b6e04f74d30990c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575371, "uuid": "f09c3c42-cc85-443b-8a8f-6e176467a11d", "comment": "Malware payload", "value": "60fb97d3d3de44c7b6c34b5eec9b9d5bf744630f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575371, "uuid": "66aeb43d-08a8-46cd-8452-970d04dcfe82", "comment": "Malware payload", "value": "eed6fcdd855a6c593686589c9c8ce30cd5aa05241432c9f01fc1074ff22629b7789d9a55036d22fbad809b9308fa0994", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575371, "uuid": "402ecd35-c3c0-4998-a1fe-7a1b302018d4", "value": "T14B13E02EE601B51CD787BCFCC32444F2F7992442D621286D7A123EE6C08171B4B2FB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575371, "uuid": "29855195-09a6-4b38-b35e-24581c860bc7", "value": "768:Ad3RupirUjSoskMqoaX9WtA8BfZ9du0DSzpMWAH3D373KYsGIMr:p4rUzsA8BRr6+LbAG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575371, "uuid": "104b79de-80c0-47f8-9ad8-31b3f0367a25", "value": 42080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575371, "uuid": "f9bdbf4b-0a72-4883-9b19-bd47e314bbb9", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575371, "uuid": "ca25feae-1f4c-4f41-be8b-ee4b527ae729", "value": "SICF April 2023 Agenda.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecc04fe-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682585427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585427, "uuid": "8eb0ddac-1797-4590-ae02-9760693d97a6", "comment": "Malware payload (Gafgyt)", "value": "6c54642e47c20282fbf80e3006929f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585427, "uuid": "27b957ae-c243-4fca-a955-599ae628a243", "comment": "Malware payload (Gafgyt)", "value": "9f6d007d665e4438a2d86fa44fe0623836638fed8e2346b98049a67138ed2eef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585427, "uuid": "c00e97db-f75d-45d6-94a1-0f9f60a51322", "comment": "Malware payload (Gafgyt)", "value": "46e4332c3f3203b02a16a8806cfc946d551486c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585427, "uuid": "68725540-f118-47c4-b24e-870cd1b0a321", "comment": "Malware payload (Gafgyt)", "value": "f3bbb3b067ebf733f02ab6edf6cf6d260e1db8e9b4dd2c5f3804dcf5ff51cd0f19749ab3baaf4976b4eff9b00864cb89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585427, "uuid": "1fc06170-4db5-486c-b468-68554c6f1552", "value": "T123C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585427, "uuid": "fc900df6-58c1-4bc8-9682-d3f6fb07fc7c", "value": "3072:hQrFRNfuLrGhEPOD0mg3gNlmBoHQuQekQnYW:IFzuaEGQmg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585427, "uuid": "56d8abee-7a8c-4738-8767-710bfa54d8bf", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585427, "uuid": "4e72eed8-fcac-424e-b1b4-131f923312e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585427, "uuid": "cbb172ef-e6d5-4144-9023-185c33e3a371", "value": "6c54642e47c20282fbf80e3006929f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a827e7a-e536-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682625632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625632, "uuid": "1ddc485e-3b16-463c-aead-d0f9f93122c9", "comment": "Malware payload", "value": "5900f5f0f927efa50499673db9c73fec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625632, "uuid": "f58412ed-af3c-4bf7-937c-7b9d763d7284", "comment": "Malware payload", "value": "a09208efb58a21811e6c9e0d245b4c6280045ae3fe34da4d3731e5fd2de3fdfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625632, "uuid": "0dfc0799-1edd-4782-a973-ad66b0ecafad", "comment": "Malware payload", "value": "d622be19bbdf12887b27ee0e2e86002c6fbeb6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625632, "uuid": "d6167ef7-1ce5-4b80-8e03-9fe91738bc46", "comment": "Malware payload", "value": "00e028b9fe2e6a0b8aa97e092a779feedf0792b9b4cce3c8560539e34285e26aee4a9368a628b00c8022f3091f1f793b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625632, "uuid": "b92baa68-38a9-4ce7-83bf-3fe48f06ab92", "value": "T1AC945B4392F13D44EA268BBA9F2FC6E8771EF2508F497B6D22189E5F04B1172C263751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625632, "uuid": "df41183c-8877-4dcc-86b0-dee715c60ad5", "value": "0301c97692eb66d40eb60ddb80bc0b65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625632, "uuid": "dbfc21eb-d48a-4a99-91f2-93def8a22d09", "value": "6144:fdWjdc9SHDSvcL9GEqK8QNLsl3JbygDMFP2JHHmjit6RdNFz51:1WjSSjS0Jr8QNLsl5bbD8enmjJdNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625632, "uuid": "2ddf1382-288e-41da-b2ee-967c356f6719", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625632, "uuid": "29ed51c9-6b07-437d-8872-cb1a9512b01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625632, "uuid": "63058fb4-b7f6-4b68-bb46-4da1c06b33b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75e3267-e53e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682629411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629411, "uuid": "4469eff2-66d4-4f79-81b4-7b5175caeb00", "comment": "Malware payload", "value": "85b8e92dbb509b21605ea78bec0bbb50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629411, "uuid": "ddbd6ecf-657e-4d25-ba6d-70172f2f5bca", "comment": "Malware payload", "value": "a315dca1b81350c606e7c3f7b5a0b46aa74829fa32de1f6ae4b4fa7c6d4ad7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629411, "uuid": "b58bde78-2a62-49af-b4cc-916b0a3bcbd5", "comment": "Malware payload", "value": "344d6fb0ca6749f02e45039005d4c776ff4e184d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682629411, "uuid": "a05ea92f-e79f-463d-99db-4548014a49ae", "comment": "Malware payload", "value": "5a7f8aa4e38533cb51cfead139e87947acc6c689e65cec974ec69b14e06ccf490dcb4086ea661b0c5207f5aa65435c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629411, "uuid": "6f38cebe-39dc-4626-9a23-f01cfda12715", "value": "T14E4523637AFC8172E8F007B05CFA52931B35FC924F68D28B1686968D4DB2684E572377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629411, "uuid": "28905266-a6d3-4925-a9b1-bb6d4c899a60", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629411, "uuid": "b69f77ca-4d70-4256-9ad4-5b5a1cfb1e87", "value": "24576:WyCsnzv7EIxQbfMj063wbIa2sumqCYJJm5D:l+oU0Q63IIa2suJfJg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682629411, "uuid": "38715821-2eb0-4d45-b0e1-0d14d7227bc0", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682629411, "uuid": "bd54b4bd-2a0d-4334-939a-5c4f3e0ecc85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682629411, "uuid": "a9f0f6c4-a72a-4eab-a83b-8e203687ddca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3361f9a0-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682586133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586133, "uuid": "3a8b1a89-45e9-4fe8-b6c8-65da0299ed6e", "comment": "Malware payload (AgentTesla)", "value": "408a69f67a416c4f5945796a93bb9f36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586133, "uuid": "d2619c7c-2099-49af-b5ff-0e7e6d2c1fa3", "comment": "Malware payload (AgentTesla)", "value": "a4101ed91c9c07c3814605532429c9aab06431d50f0e79cb2e57737bc8d96d8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586133, "uuid": "875a3055-8b5c-422a-a3a9-8a1e67d14eb9", "comment": "Malware payload (AgentTesla)", "value": "bff54dcebdda0e19b51a786ed999483d1a183741", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586133, "uuid": "fe255f2e-db12-4377-9270-9dc38d4cc51a", "comment": "Malware payload (AgentTesla)", "value": "4209bc26c0e1dbf5c24790e03835748e9618eb27e66ac6eaa1af811715cec530c3b5d048f44a014c771e05267bde24b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586133, "uuid": "b10d3bfa-11e6-48a7-b3fe-bbedf802631a", "value": "T174F4F53C28BD1627C57AD7E58FD08427B664956B7121EE24ACC7A3E60306F1269C363F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586133, "uuid": "1408edf8-b6f2-4eb6-8abc-02e8690e1ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586133, "uuid": "1974bef7-8533-43bd-ab1e-688e51c2b863", "value": "12288:g/SIkq8h3WubAzaTIbigxDnQ2VtjtluHDGxHO+ZU+1Fx:WS4ubAzaTEBQ6tjtluHDAHz6+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586133, "uuid": "96314bf6-7f08-4b2c-9038-8a408db2f362", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586133, "uuid": "35cdebac-878d-4a5f-9c97-5a4af7a9aaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586133, "uuid": "b55b6e65-ceb9-4306-ad28-b6b7777e1b44", "value": "Proforma Invoice#77634364366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85ba8cb-e4d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682583323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682583323, "uuid": "941d37a1-917e-4d08-a768-05aafba6f1f6", "comment": "Malware payload (DCRat)", "value": "0d8ef6d15966eb940b00e078b0ae0bb1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682583323, "uuid": "6e8420d7-2a82-433a-88a7-86565a14d4e5", "comment": "Malware payload (DCRat)", "value": "a468384b275c437d13c05d8433a2223910db37b9251fe0602752a7dc7664253c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682583323, "uuid": "8246e704-93a9-413a-be8a-81241093b7c8", "comment": "Malware payload (DCRat)", "value": "dca3c3572947d17576f1530c9dc342bf0d9a70d8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682583323, "uuid": "f604b975-7984-4d61-80a1-c9869a1473dd", "comment": "Malware payload (DCRat)", "value": "2298c09ec6971d65bad2dc621e7cb6490c6dc9e511417a1c8e877f0af7dd03edd3ff973b44e668d0d079e10406395417", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682583323, "uuid": "897180a1-00e7-4bf0-ae3c-0395af965d16", "value": "T11275339FB89269CED1AD5239027AA2AF6A7AF70021560CDF5347282DC50FDECC54391F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682583323, "uuid": "4d0892d1-7aee-4f01-9f95-5c3a645b2b00", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682583323, "uuid": "01c30cb2-f4d4-4653-81af-7290319a114d", "value": "24576:Yv3+VeXk/DmHMhtQ6pmnQ4+LGddwLRjd4wbvla4ESuu2k9hs:K+JysLQ6pmaayjddb9VrQkzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682583323, "uuid": "514c1344-1970-4c61-a842-e4c753b3bc1e", "value": 1628672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682583323, "uuid": "07fd8846-029a-4eb1-8bb6-3131ad205d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682583323, "uuid": "d8df8640-a7d7-48d2-9871-dc58760104e3", "value": "0d8ef6d15966eb940b00e078b0ae0bb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11e34fa-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682554669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554669, "uuid": "88343ba4-90bb-4f43-87c6-7d05c682f9c9", "comment": "Malware payload (AsyncRAT)", "value": "81a166a8d3d5bf9a2af76ea3f01a6ea3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554669, "uuid": "fdab359e-21a2-4d84-a0e7-b3976c68e26c", "comment": "Malware payload (AsyncRAT)", "value": "a4f67d290d86a0b24ead37817e07b9fad19cddbc63951f3b37cb6dcaa57a1572", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554669, "uuid": "2a6e2592-fa51-48df-aad9-1d7d12aacf7d", "comment": "Malware payload (AsyncRAT)", "value": "7da2a2eb2d202f5953bfcfd158fabc360a3caba4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554669, "uuid": "55666360-57d3-4556-893e-71a1477c74f0", "comment": "Malware payload (AsyncRAT)", "value": "12ce0abd95dffd262388729cf0f573eae6f7c7b910189be4c3a628c4ca963c2d24aa69347f735210166f6d3ccd5cc93a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554669, "uuid": "1e3adb4e-79ae-49f9-9d43-f31e7befebb9", "value": "T197533C443FE9812AF1BD8EB0A9F3664545B9B1577A02E90E1CD412CA06337C6D943BEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554669, "uuid": "aaf18914-bd4d-421f-8636-3be607720a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554669, "uuid": "e70a2a74-1d52-454f-8380-c8a794a7d97e", "value": "1536:nirY101ZSB5khtYJJMeb4wuPVXT8q75x:nirS01ZSB5khWJMeb4jlT8qdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554669, "uuid": "39b17755-9ad9-4c94-abb1-d253b483f041", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554669, "uuid": "c1a12aad-fd97-47cf-9627-9b0c64543897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554669, "uuid": "ef4b0e54-31aa-4a68-bf03-ef0d6eaeb6e4", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd04de7-e534-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682625020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625020, "uuid": "26b46f62-40a0-4c91-8048-30ed2bf336f6", "comment": "Malware payload (RedLineStealer)", "value": "8e0c02531f370f8791f43aeda131dfdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625020, "uuid": "cc89ced1-491e-49b7-b1dc-9a9ee18f6e8f", "comment": "Malware payload (RedLineStealer)", "value": "a52e218226bff60e603fed0cb553f08c12819536564d9e010927af3a52c53161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625020, "uuid": "6f9c5c1d-0d03-4faa-8ae8-f7b08cacc7b0", "comment": "Malware payload (RedLineStealer)", "value": "78c34c305c096d9a0b38f7159a44ada96a911113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625020, "uuid": "3c252ce8-78b2-4f2f-9077-1da0869a22da", "comment": "Malware payload (RedLineStealer)", "value": "5bfea6b76c294e93739bbf538c5608b2cc0391f68bad08c98bf82147323bf032b0f5e7cb5acc7d93723e69d3d53a2a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625020, "uuid": "d8681881-b074-46a3-ba0b-94eff7db3568", "value": "T15E452316BACCD072DC7027F15CFA53832E31FDA5BFB2D6971688196A4CA36D454303AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625020, "uuid": "9a5bb050-b02e-44c4-999d-39ffed44c55a", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625020, "uuid": "359ba1bf-b769-4361-a375-77b25fb69598", "value": "24576:IytVKmAywEfOknHXCgOheu/PRqTDH+PKE2I5p:P3DgEfxHSHvHRGDE75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625020, "uuid": "7b20781d-41ea-4423-b91b-6c5baf5e03fa", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625020, "uuid": "2ade17a3-9861-49bd-b96a-a559f723300c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625020, "uuid": "9a0a7d7e-1651-4bdf-8eb3-27f7b78df5dd", "value": "8e0c02531f370f8791f43aeda131dfdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50102470-e506-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682605079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605079, "uuid": "e4e4ab82-6a8f-48b8-8532-4ea1341d6bad", "comment": "Malware payload (RedLineStealer)", "value": "b317fb6b46563373296f98e143c45707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605079, "uuid": "e67f5b88-b67b-4e94-9698-c576719fa63b", "comment": "Malware payload (RedLineStealer)", "value": "a598c0a14858aea9421f53cd70c2ee5bc626de143247ce885640fadf27229987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605079, "uuid": "2f4e2b41-3cac-4ff7-b8b4-a6954a35eba8", "comment": "Malware payload (RedLineStealer)", "value": "eb985c0625681d59a53806d68da6ed99e9198d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682605079, "uuid": "e57d1fd4-3363-485a-8edd-736441b73632", "comment": "Malware payload (RedLineStealer)", "value": "069dc01219983f33f1899c8546d9967ba2a98cd94a8c5d96d485e0475a3a651462d1371516f750acdbfa2760edb55718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605079, "uuid": "73f1498b-a79c-45e7-8178-2f71502234ae", "value": "T15C648C03B28DCE30E032B4345E8E9965A7ADB4723B7F66E7B7C85615CA066F1253D213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605079, "uuid": "0f789a4f-b6d2-464d-b1fc-1b513009d45b", "value": "3ad594570c1b191fe2c6f5dfa23638cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605079, "uuid": "f887bc58-92d9-422f-956c-2b19ec86fc3e", "value": "6144:IXoYE4vs1sP4pJgmRMb0CO1Mkq8GqnyZkA+L:2NfvbQpJZ5MNNmyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682605079, "uuid": "8ea8445f-68e7-41be-9be6-b81415cc9f42", "value": 321872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682605079, "uuid": "011a0a10-7a5d-4b85-b7d4-365a3891a71a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682605079, "uuid": "2624e1d1-b007-4e19-8374-c4b608003783", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6574cc9e-e505-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682604685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604685, "uuid": "1e7ecbf5-3358-46df-8baa-eae40be2812b", "comment": "Malware payload (RedLineStealer)", "value": "985d060f38212cced5bfa1f3f939cc55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604685, "uuid": "05f6107e-e06b-4c6e-be89-a5de6dd371d2", "comment": "Malware payload (RedLineStealer)", "value": "a6a9242b6f3d800d516217eb8f6ffc40a34a49da2b2c62fc151d5a3efcfbeac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604685, "uuid": "eaa6d550-d78f-441b-8f42-0825e6556d2e", "comment": "Malware payload (RedLineStealer)", "value": "6ba2c89cbe60582af4f60a9ccd9b89623bf1a02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604685, "uuid": "168e616a-7495-4e5e-ac0a-fd704c4fede5", "comment": "Malware payload (RedLineStealer)", "value": "5626a7134ad3f8b66bdbcdf1ef1a1e1d69984c6c41a38e3fc00383497fc8e91ecf9652e60ba1acf5f564dd52edf82dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604685, "uuid": "6d7d0790-0bb3-48d3-bcff-1fc28a871d9a", "value": "T1D9748D03B28DCF30E032B4359D8E5D6567ACB4712BBFA5E7B3C81A149A065F1257E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604685, "uuid": "38d92b14-cc25-48da-9b78-6aace470fa17", "value": "3ad594570c1b191fe2c6f5dfa23638cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604685, "uuid": "b32d5e17-a7b9-4ec8-96f4-656835cb2e44", "value": "6144:HQ7HI5QXvk1L8+jjR4ydlphbtZ5my/4yR75yR6bcsv6Y:OgwvEvjjRTdlplPUO5ijWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682604685, "uuid": "d37556ef-245d-4bff-bad8-0c65dc2f7b98", "value": 353616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682604685, "uuid": "7f136dd3-123f-46c6-886b-ca16a181307c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604685, "uuid": "607d22b1-c1e8-4f6f-a9f3-9e4179d3f2ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716df5a4-e4c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575500, "uuid": "83b1da6b-3024-48bc-90ca-c67bc93bf07d", "comment": "Malware payload (AgentTesla)", "value": "a48bef79914bca27ddaeb5d585fd3369", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575500, "uuid": "194d6a19-093d-4081-9aff-da58e4c702b7", "comment": "Malware payload (AgentTesla)", "value": "a72176380176559f94125aa5c27423b2beb4a388cb3439bae8c238aa02175797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575500, "uuid": "d6d96285-69d9-4dcd-a3d3-99c45e99b176", "comment": "Malware payload (AgentTesla)", "value": "acd5b19795fb64b4a2ce7a08fac0da09f7197cd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575500, "uuid": "9fcd3fb7-057b-49bd-b8ac-f53e0b41cec6", "comment": "Malware payload (AgentTesla)", "value": "5c6cc267fb93032b336e5b0d95db8b4985473f67814dab2ed06dc7a2eb18a7355907f3e1937fa89fbf033569b2d78dba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575500, "uuid": "9fa47ecd-1e3d-4e1b-b94a-3646099c525a", "value": "T180842328E7A380CDC2B02015233AE7DA9DF31BE9353447241B658B3E6BD5A66F1CE741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575500, "uuid": "f8535825-61ca-4cbe-b491-c5f3c402bc68", "value": "6144:jHANprmqeN1vv65nqoDgsZJbWC+IHpxXcnvG2xVDacNFgwFZe2SYK1hAPr70wnD:jgnmqebvvtoDPtHp5ZAGM/wLHcr70KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575500, "uuid": "ce3fd1d5-d71e-49b6-bcce-a8267a4382fb", "value": 381012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575500, "uuid": "6199f8b8-17b1-4bbe-8a8c-d5cae86e612b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575500, "uuid": "0b498e2e-f9c2-45d0-bb1c-4a1aaabd77cc", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4322af-e4f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682596218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596218, "uuid": "d9e4c028-064d-456d-9f0a-38974535a332", "comment": "Malware payload (Mirai)", "value": "07204dbfd61869cad2148090ce55da79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596218, "uuid": "2b4d92dc-e2b3-467a-b248-885fa077a347", "comment": "Malware payload (Mirai)", "value": "a73d8b194be12f7cf12e817ab9b30c1f3b971d4d0788b9a92706bea8635d7333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596218, "uuid": "b38f0595-66ee-4334-b468-51cbdff119d5", "comment": "Malware payload (Mirai)", "value": "10f5b0721e7bd6a12f107a73ceb333960ae9c63d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682596218, "uuid": "0c3d25e8-9552-423d-9ec2-79bb39bf32ad", "comment": "Malware payload (Mirai)", "value": "2899f8e659322ace4e5adb6786b140e465908bb4e1a790bf6f66cc70796213d0e54e63827ee800c223ac16d11bb4ebbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596218, "uuid": "c87ae69a-bbce-4309-9a70-76ee0eb5e8a0", "value": "T1F6131956F8924E26C2D4137BB67E5A8C3370A3E8C3DFB213DD506B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596218, "uuid": "53d81641-f9c3-4199-b495-b7a28aab8f26", "value": "768:8gkzU2FvG5lMFj/7mMPaNzAT89OLJimty/+PYvotbVMP/OXRfzLEwzwbZn:fd2tG5yN7mM0zZMtyWPYoV8/OXtlzwb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682596218, "uuid": "9a1569bb-c52b-4b12-b925-0dd687957240", "value": 44616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682596218, "uuid": "483ffe14-7446-4ee1-b865-e0309c1f9cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682596218, "uuid": "5d2e76fa-e0d3-4e45-9cf2-e53b31e25cac", "value": "07204dbfd61869cad2148090ce55da79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e57da2-e549-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682633803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682633803, "uuid": "4aad74a3-e143-40f5-bbce-2a53d4425b5a", "comment": "Malware payload", "value": "2046bfd9834302ab4d0ad0f01e14ca68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682633803, "uuid": "8d2747df-724b-4133-a900-32b83221efbd", "comment": "Malware payload", "value": "a8e25eab13524a6a36621323bcaf916fc2f7f6a96ef9acc8ef5e6324f2833199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682633803, "uuid": "ede19677-ba76-49b9-b2fa-2f7214c9505a", "comment": "Malware payload", "value": "5109413420f1fd0cbd5df5be0ece2f663a85f600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682633803, "uuid": "71f95b3b-d1a8-4945-b326-6a2e120b5218", "comment": "Malware payload", "value": "2e5cc4648b1b44f1929de0f93b0b6bd935cd8c03af343a5178f789a985ee64076a7094f51dbe881dd26087ace1b19ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682633803, "uuid": "12027329-3574-4c28-8edd-7b3dd15eed52", "value": "T137452363B2C90036EAF527F194F263871736FD92ABA486CB4344568B98733C495327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682633803, "uuid": "df9e6d6f-4d51-4ae5-9e61-1db60d960ed7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682633803, "uuid": "d0959764-9111-43e4-ba9e-6df4b272d644", "value": "24576:ryyvzGklMD1CgcTnOChtM0sw1aSMSNDrWL2WPwJ6Ns:emZMp0TnnfT8g/WLjP86N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682633803, "uuid": "cdbe6eb8-21e7-433c-b626-32d427a84f38", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682633803, "uuid": "c54a2cce-f147-4c79-b70d-a2c9dea2f313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682633803, "uuid": "e30ca9a8-a90e-4311-995c-ba1cf0017b14", "value": "2046bfd9834302ab4d0ad0f01e14ca68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760b5113-e4c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575507, "uuid": "84e99f7c-6687-45cd-9721-cb95edd58f66", "comment": "Malware payload (AgentTesla)", "value": "d1324751521047e4b32228e6b56e9883", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575507, "uuid": "baa6e3e7-6d70-4f14-b327-9490ef08c8a0", "comment": "Malware payload (AgentTesla)", "value": "a9542c13d752ac30c624fa247b1e9d1ae6a38e84783f9065fc1d8a47f10abab1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575507, "uuid": "f46fb5de-c6ba-4d0e-a041-4a25ece8a488", "comment": "Malware payload (AgentTesla)", "value": "348876fa183d351e2fb1928b146a575c287faaf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575507, "uuid": "7fdad252-16cd-4f1a-a7d9-8660b70ecbf8", "comment": "Malware payload (AgentTesla)", "value": "c6753f038cd013e3099c4382577e71324c2e2af96db671f9a5d22f73ce232cad1cf3a9c383ab40dac3ba5b1548413eef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575507, "uuid": "85f66bab-2b01-434b-abdf-9787fc2d3d8f", "value": "T17BA4592CA9EE49E7C174F1B6CEBA8861F193C56332528D3969DB02545702EC376C42BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575507, "uuid": "9dcc9d50-c69a-4241-9fde-700af59f7603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575507, "uuid": "0ddbcaee-5567-49c5-a748-65a681f7d6c8", "value": "6144:g20O486xYNXvvMXnqoDEsDJbaC+IHpx7cfvG4xVDacNXgwFPe2S2i1DAJr7SwHBN:g2AjxevvXoDpRHpRPaGMNmLPer7SgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575507, "uuid": "ba13bab1-9377-4534-83b5-2d19f63b30bd", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575507, "uuid": "c7b273d7-0308-44c2-8997-15e09d6dc644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575507, "uuid": "ab65ae52-c8fe-4763-a326-e01d9b1bc28f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db30c8-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554405, "uuid": "00051a11-1e9b-4065-a8dc-48dfb967c36d", "comment": "Malware payload (Vidar)", "value": "9480e05f69188e1de340793d85d76169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554405, "uuid": "9aeefdab-5c2e-413d-bf29-1c56c77e068b", "comment": "Malware payload (Vidar)", "value": "aac4be8da4dd61b9c80cdd4fbfd32aca1189947644318a7a3627a502b3f8e128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554405, "uuid": "f18e92e7-a278-453e-b954-b93392bb7ada", "comment": "Malware payload (Vidar)", "value": "196faab04a4dcb3be42de4cf6b1e285f971f0e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554405, "uuid": "917ee15e-5ba5-4269-903d-5eae801390a0", "comment": "Malware payload (Vidar)", "value": "4c9709768eeff9e60d778827fe93d13a7a031b64c1bc47a379fb30066797086f13132d2a8a3b77ec55a0bd7e210c69e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554405, "uuid": "5acb380f-3a7e-4724-91cc-0b4cb6a9e07a", "value": "T1EE64F1217A91DC73C85744F01824E6A49B3DBCA0564945DF13D83FBE6E336828ABB3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554405, "uuid": "20fc57fd-4c9e-4e15-aec8-e15b6b1b7209", "value": "fd12f8d1ea172054b775d38fe9a5aa5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554405, "uuid": "99f58e9f-6032-4e49-973b-2c543aef2b35", "value": "6144:C24oSdb1I9TORmtyqX+2Q/rsNW9aMUuEsbm6ckJC:C24HRmYqX+2Q/oNwaMHBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554405, "uuid": "264e06f7-8d31-4985-8a40-737ad45cd06b", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554405, "uuid": "08e43785-ecfa-4b63-b9bb-fcdb79026748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554405, "uuid": "031faec3-c35b-4de1-a907-750a210f27a6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3515a6ed-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682586136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586136, "uuid": "756b4f2e-45e2-4573-abeb-00eda6aecaaf", "comment": "Malware payload (SnakeKeylogger)", "value": "dfa9b070bf1b33316d52392aab3f8c32", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586136, "uuid": "74080003-d5cf-4d7d-958c-daf740ba5a9c", "comment": "Malware payload (SnakeKeylogger)", "value": "abda4b3aba43afacc8f7c548d0c45e5230c90cbd478f277a1a227a58b3d6582a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586136, "uuid": "e4e0023c-1ebd-4957-b627-dbc8dd5ebde1", "comment": "Malware payload (SnakeKeylogger)", "value": "d77f783188d8663012b9cefed3028998751f8a3b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586136, "uuid": "735cef37-f233-4e36-894e-8cf23904d8c6", "comment": "Malware payload (SnakeKeylogger)", "value": "4e56d23f62477a0bcad14a03aaed8606c4486cd3677eaca4db848edfdf9f50aa3e879e520ce65fd37d08773dc32af211", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586136, "uuid": "20a6c42d-b9a4-432b-91a3-8d7622f44e34", "value": "T137A4232FEE8F9958B20ABA0646184E1AD434CD1D3FFD31EAF1AD7D3895109C068F5167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586136, "uuid": "fe782d30-e082-485a-91b7-d8623f0b4d70", "value": "12288:NGz304qyVhFDG/9uTEIhg2SshFI1dPdXN2ECjw1qpyE3v:G3BqyVhFDYugXRsfID1N36yEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586136, "uuid": "9386fad8-6a32-44c7-8af9-5b6035500993", "value": 476179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586136, "uuid": "6d01d364-653d-498f-808b-1386e01a8d59", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586136, "uuid": "92b178c1-c8f3-4169-ba30-e55cade9e2ed", "value": "Request for Quotation No. HBKMC 54171_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8af697-e4c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575117, "uuid": "df7364f5-b064-42ed-947e-71ef242fd0ef", "comment": "Malware payload (AgentTesla)", "value": "89a5396e1ff59b096539ddbdef9d76f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575117, "uuid": "02c28c5e-7acf-4087-9ce1-42dcb4477462", "comment": "Malware payload (AgentTesla)", "value": "af8ea3391f63a73b7837e03b00ad457846de93a011f1159709d185ad78e5b94b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575117, "uuid": "97cf12f5-f261-459a-84c3-25801dcbb3fd", "comment": "Malware payload (AgentTesla)", "value": "4315194bd8b4f0fceb8c650b61f0ef35ec136b4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575117, "uuid": "03eda3bf-e861-489b-ab95-8bdc0d4fae30", "comment": "Malware payload (AgentTesla)", "value": "f795f4b659b639eaf76afde2c55e9d14d7b00aad61042375ed41be5238fd749dd6fd21a06b5f37d3ee2c39db4fef89b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575117, "uuid": "36911d7d-ce96-414a-8fb1-b4631207d2df", "value": "T1C6D42332918C9EEA435134DF8B77820AF3B24BCB59FC305657EA4CEA12B57744BE8425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575117, "uuid": "912ec05d-313e-4359-b436-1a27c07753c0", "value": "12288:dSjbXw4H/Ediv+vkns/Kf+3QF0nzNf1hKA7+XYwWz8m9UphGj1fKr7:IXXw4H/uhv8s/Kf+gF0nz517wJyxpfKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575117, "uuid": "a3e857e3-d1ed-44cc-9339-dadfc0510ebb", "value": 613653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575117, "uuid": "c88e216f-25dd-4456-811d-206f964efe9e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575117, "uuid": "54f3e1fb-2245-4959-8e18-2dcea67bfdee", "value": "Statement of Accounts.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae41a05-e4c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682577851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577851, "uuid": "5ffe85a1-a9a3-4fc4-88b4-485176ba8d10", "comment": "Malware payload (AgentTesla)", "value": "46db992ee1d94a4f196e6175d8adc2dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577851, "uuid": "cdea4302-bcc3-4a7c-8b83-bd96b3a4abbc", "comment": "Malware payload (AgentTesla)", "value": "afd4fb46c41c41e03682d22196ecdbefe3ecbe012ba929ca3c88187d2c5239ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577851, "uuid": "a51bf8f9-004c-47e4-80f1-31217a48d2ad", "comment": "Malware payload (AgentTesla)", "value": "0008ba9ef17ce966c3b70fc3a1395c9c47b43c38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682577851, "uuid": "0b6f4407-a146-4f86-8cea-df25f86d72a0", "comment": "Malware payload (AgentTesla)", "value": "73ae8d59270b095d0b1c2eceb26ff4f69a1e8007419fc2a4d6263146221f8d9e5bb756de2d9ea89b7c3edcd6013efb78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577851, "uuid": "f513407b-7e31-4881-9bef-8a9c7a9476be", "value": "T1D625331C1E78B7AAD10DB86E2AC710B03CFA4E96EB37554C6771C995827B301FE4626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577851, "uuid": "816c01d5-dde2-4859-a46c-2eb276674493", "value": "24576:ZxdTs85AoOykKOHNup3rgjQfYT2Qoqgi/Ewvo:ZHTkKK+3BfQ1fvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682577851, "uuid": "fec09067-c24c-428b-a40b-2326dcf00b65", "value": 1024945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682577851, "uuid": "b9ce6b1a-75dc-45e4-877a-7581e7dcd664", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682577851, "uuid": "0ae226df-5e27-4586-8ab7-7b51523e8692", "value": "PO#1135 - \u88d5\u5049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0c4c09-e4c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682578417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578417, "uuid": "e152823d-2d74-4b25-be7e-a9d255a55e81", "comment": "Malware payload (Formbook)", "value": "163ab25dd43bd2b4decfa6123cacbcd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578417, "uuid": "50cd196c-18fd-4947-9dc8-683719860d22", "comment": "Malware payload (Formbook)", "value": "b36b113a82b932ee2081484ca969a0fc4008c80199c4c8ab1d3f66f12d9e60f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578417, "uuid": "f29e98ba-b20c-40d3-864c-b9c308d3f134", "comment": "Malware payload (Formbook)", "value": "8f0d46ba2aedf7154bfc06dad8d4c6ee7f45e1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682578417, "uuid": "3930fe4b-8547-4b9c-a1b2-3429b6dc3b5e", "comment": "Malware payload (Formbook)", "value": "c4a590d311732a9747d5818dd50c7bd428aec5ac44b5127ee0904620ea3950cf7247b2243decbb125d6e486de3b9a7be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578417, "uuid": "20d302fe-af98-4e42-8897-140ee879f2f7", "value": "T104542239B281C422F96786F1AE377B2597EDB6121578A75707A0FC0EBE26741C90F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578417, "uuid": "4b1ae540-049d-4598-93b7-d38cb1bd59b6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578417, "uuid": "284d89e5-5023-4492-8497-7f4bea1b3a32", "value": "6144:jYa6XNoP0LAGL7pzamoSwUCLTGrBW0XSx+/jFZfvoAmMJB8:jYprAGL1zzoTUpVW0XljDfwAlP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682578417, "uuid": "39a40d25-8c33-4fcb-b001-0ae92ab5e007", "value": 296257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682578417, "uuid": "0c0e963e-8df1-4648-82bc-6a863c2ede4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682578417, "uuid": "d1a2b19c-0b38-4683-82b7-607edbfc733b", "value": "163ab25dd43bd2b4decfa6123cacbcd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0b0374-e554-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682638494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682638494, "uuid": "d16220b2-b5a3-4920-9452-62df816913a6", "comment": "Malware payload", "value": "5bcb6af4e16d85452dabd6e371ac42b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682638494, "uuid": "207b59ea-76bd-40aa-b3de-3f25bbac18c4", "comment": "Malware payload", "value": "b413ff17b7b0246d7a7d4cb1bb92eaa4cbaf4dee3a9b90076d8eb19b556b2d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682638494, "uuid": "04f1a5b4-e43c-48ce-aca6-85013cc9e354", "comment": "Malware payload", "value": "4293f944efa21f5180c253c4e7b1e36d0a6a8ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682638494, "uuid": "cc68bce3-c9f9-4b61-ab31-68fa3208ae5b", "comment": "Malware payload", "value": "71092af6db0cdc05274582779b664a49328492f0f5f299fde8f1d66d7650d0c64dc4db29b6a9ce46fd6c1ed6722f47c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682638494, "uuid": "873b5da8-fd35-445a-ae58-58a23d49e8fd", "value": "T1F45633FA20DE9805F89DF07F6565DC2663475BDF63098A8DE1E78B020C01B66CD706BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682638494, "uuid": "7e8fda60-9d21-4f9b-ba67-6d9f1d6186b8", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682638494, "uuid": "f03483d8-5b24-4b67-9260-1349a55d44a0", "value": "98304:ANoZpxDg6ykI7zeQXCYp8LvmsQuIS518m/MiBfBTyuJwU5KQl:lN8kIveT16s3rpyYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682638494, "uuid": "9c10d360-fed2-46a3-b51d-e5f6577ffefe", "value": 6430680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682638494, "uuid": "016c1707-e698-4f11-ac7a-7376e0b3f372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682638494, "uuid": "9645acff-782b-4997-ba57-1dec6336f607", "value": "SecuriteInfo.com.Win64.Evo-gen.13129.28887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007dee6c-e4f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597214, "uuid": "9856a135-e066-4cd4-b72d-89f80f2a2d15", "comment": "Malware payload (Mirai)", "value": "87f5e67bf0d773a65d69e2a32be7437f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597214, "uuid": "d8556be8-e02d-4c51-86f6-08cd32dd8d90", "comment": "Malware payload (Mirai)", "value": "b72fdd198a9433958e1c201165cb07de00a7eeddddaaac9b82f513497a0bcf3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597214, "uuid": "8a0fb616-0a95-4700-8b0c-4de2b33ba345", "comment": "Malware payload (Mirai)", "value": "5b646763a50cc269185e47937da76ca6e8596aa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597214, "uuid": "ee33cb03-80d9-4ea2-8db9-5ac27d517c2b", "comment": "Malware payload (Mirai)", "value": "4de79e6182a8d980058191fa531a788c2c54b9366959b1b35e281b6fd404055c4e99c1f0ef4237c4e0cbce5a19e38aac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597214, "uuid": "2bd8c746-0d21-4c4f-a86f-db023e83c281", "value": "T126E33A46FB814F13C0D61776BAAF4249332397A493EB730699187FB43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597214, "uuid": "95c7a194-ffe4-41c3-9b22-efe7a7c406a7", "value": "3072:LVlbRK+R4MXZp1aqbeCn8oyy6pGcUtxZwbZnIcXy0+M/9AYIC:LVlbITMb1aqbeCn8Dy66LZwRIcXyFM/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597214, "uuid": "20263b62-f645-49fc-aa56-f829c736819c", "value": 154960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597214, "uuid": "bb6dcfc0-1be9-48da-9693-af77648933fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597214, "uuid": "0857af67-3468-4b3b-9e8a-292d5345e39f", "value": "87f5e67bf0d773a65d69e2a32be7437f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa491a4d-e4c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682576025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576025, "uuid": "13605992-5754-43f2-955d-c87a34f3a876", "comment": "Malware payload (AgentTesla)", "value": "1985ed683cbdd2b8da176d62f4a251a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576025, "uuid": "276a12e9-9796-40a5-bddc-5065ba629773", "comment": "Malware payload (AgentTesla)", "value": "b745bc8ebf830f3cf97c270231cf1d82f3453ed5d9fed261fdfe7c38ba7713f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576025, "uuid": "dcd27a3a-8cbf-4ef1-ab64-57e46a1bbafe", "comment": "Malware payload (AgentTesla)", "value": "254d02c05c4ff75dffb9effff1acecd535c159cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682576025, "uuid": "fddd4133-eae4-4849-8333-8dfe1bd07125", "comment": "Malware payload (AgentTesla)", "value": "a31c09c073cd2ce3a3026f007389e9d0591fdbf0970938a579316b4057061b0d4a621e91c3e62897516cd8f663f7f0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576025, "uuid": "016ef81b-1c39-47dd-b9bb-e72bbea7bc2e", "value": "T173D42354B39F10962D2AE062B052FBE0C7D903D1F283598D07597E1085ABD0EEEEE97D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576025, "uuid": "eaf413ed-4c24-44ea-b664-1997672fc6b4", "value": "12288:ChftCdNuCTstCCFKGkERsGLaHoyovDfXhS3A8gqNeLRftaH2N:C3sGCCFKGkCffXhz7aHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682576025, "uuid": "7140648b-5c1c-447c-86b3-0a9ea981cfb5", "value": 608082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682576025, "uuid": "8405a6df-8966-4406-9dc0-79c4fe4c6c2e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682576025, "uuid": "82d584ba-52f2-4c2f-8aaf-513fe66fb8e8", "value": "PI 0116710AA.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642e3bbb-e4f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682595664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595664, "uuid": "063c3add-245f-4d60-bce1-b5deddb70dc6", "comment": "Malware payload (Mirai)", "value": "a9711c3aec9c3e2d3abaa4ef32deb351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595664, "uuid": "5e2d91d7-8305-4c28-a23a-95d1df1aeb57", "comment": "Malware payload (Mirai)", "value": "b7ef20f0118971901f9301d69729043278a0f5c5c34e3fd9f27afa6ae3149f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595664, "uuid": "70022504-db3b-404e-ae76-684719c69627", "comment": "Malware payload (Mirai)", "value": "873935384e6d366bc47e873fd822be5b9d1a4c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682595664, "uuid": "26d029eb-2c5e-40b0-80a1-41d6c5ae45e0", "comment": "Malware payload (Mirai)", "value": "086ac3649e34c697ced74e2838575826737ccad6030eac7b54c1171b99de9fbd0537f851e73fcbd6ae36db9538ba1d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595664, "uuid": "2ca170fc-3164-426b-b919-8b5122a12f32", "value": "T171334AC8F543D8F5EC4705B01137FB379A36F5E91229E743D3A8DA32AC52A01A906ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595664, "uuid": "8e61e184-8dae-4f21-9c61-58d2be74e1cd", "value": "1536:XNBX9Z/DtwiLaiAl4zIGVyBSNWb0PyBSLCYI:XNBX9ZbtEVkIiaCccyQCYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682595664, "uuid": "823656a6-49d6-4d6a-8916-32d1cef316d8", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682595664, "uuid": "6b7cb41d-0809-4be6-87c8-726ef57c7f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682595664, "uuid": "fe3e8dd9-5dbb-4d7d-9ed7-1b236b629e67", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4247a7-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598313, "uuid": "7345726b-4ce6-4aff-9b8e-eb8c7cd965e1", "comment": "Malware payload (Mirai)", "value": "0ee0dc5b978efcb0431be0e07b37ef0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598313, "uuid": "275f9766-1644-4d04-8b14-357d395581bb", "comment": "Malware payload (Mirai)", "value": "ba47dbc4864f18196bc9382217feaa0ee58f9fc355dd81d8c57b4cd2ab7aa554", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598313, "uuid": "fefa07b9-a26d-48ae-be7f-ce44e4208ae7", "comment": "Malware payload (Mirai)", "value": "cbf204b52ab6483450af2b502747be60f3b91af4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598313, "uuid": "454f3e1d-540d-4fa4-a13d-0039a5a2f151", "comment": "Malware payload (Mirai)", "value": "dcd77c462358da165596e35a1f7f921d4baf7d82e72237bd4039d0ca140dbe48fb63c6c3c5fe9c70de9e422b9cc69b75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598313, "uuid": "2b736dcf-6d93-4c96-8f7a-afa693066e5a", "value": "T150631956F8814B22C5C5027AF92E118E332317FCE3DEB2229D216F6077C696B0E7AD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598313, "uuid": "9b986305-f40e-468b-b066-0f58a5916ab0", "value": "1536:hpnSzfzQZTJxP0CM9L8qRYC04i18avynAZzKIJoiCfAv+DfPp5mYonP:QfcZFuCo04ajsfAv+DfPp0BnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598313, "uuid": "55bd286d-7f09-4f75-bffa-640fd73241bc", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598313, "uuid": "097c1f53-d370-4207-aadc-7cbe88e839d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598313, "uuid": "37effa25-aa9b-474f-8a1e-1deeeb996270", "value": "0ee0dc5b978efcb0431be0e07b37ef0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e046ca-e522-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682617011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682617011, "uuid": "bc657327-3981-4f84-8be4-2ccdc5a28280", "comment": "Malware payload", "value": "6d283b3094bfe1d5cc78bdecdcb872ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682617011, "uuid": "97ee4802-6e35-4dc4-8788-2f0438e7e912", "comment": "Malware payload", "value": "bb7ac2ba0dea3b0ac95a9f76a8c52df6dac96dbb2c8506e0708524f1b57ac88c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682617011, "uuid": "c1c52c5b-21fb-4d31-b5d1-9033570c4027", "comment": "Malware payload", "value": "318544cab2aa91af4430ca576d29edeceb9ee03f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682617011, "uuid": "5ddc4d2b-584d-4f6a-9c49-6f24672e37f5", "comment": "Malware payload", "value": "836dfcbfbba342303b5fe2010b1ec066e744076f3cbda7b4d1ab19322ca50b47bb82da218437c570da48a353bb34db80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682617011, "uuid": "d325cc68-4cea-49a1-b8a1-ad48de226efa", "value": "T1D4A33A33A753D6BAC09322F417DB9675A823B47C0B32322B33D86DE56B05DE91E5A701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682617011, "uuid": "9aa51184-5506-448d-8c9b-cd6fff38ec58", "value": "3072:2K5ejA4jB4h89HOPQzM9FqVy59W9vmrYuOHy+ZNzX:sHjBzuPQQvk9vmrYuOHy+ZNzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682617011, "uuid": "f28e6380-4ca7-4646-9b44-bafb0e42878f", "value": 99332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682617011, "uuid": "a520b719-5338-4ede-aea8-9e096a4cb3ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682617011, "uuid": "f48c2c82-c890-49df-9dd4-31c48727db8c", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327cf395-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586131, "uuid": "8e34ad7b-1536-452a-999b-efa02490e437", "comment": "Malware payload", "value": "5083c066dfa11ae6eb453a8dc6709548", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586131, "uuid": "0e6ae265-03d3-4ec6-aa88-0ed6dfb8df58", "comment": "Malware payload", "value": "bbcbbf45e21c26514267f753af6bb9be7c0c9e10957deb32cf7b937781a75c22", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586131, "uuid": "792fd90c-bc9c-45f0-b9f4-1d09c92f8011", "comment": "Malware payload", "value": "3f856273ee34637e00c6d444fe931ee60af09f26", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586131, "uuid": "1836efdd-00f9-4278-9c6c-89447befa669", "comment": "Malware payload", "value": "9f3785855bc4cbe194facb89674f70bac22fc766a2bfd36a71b57cb47a24648f39be9053c428cd247b7456acfeceabec", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586131, "uuid": "69c894ea-2a7a-4883-917b-26f7b168eece", "value": "T19BB4238784C088B0EFFFD165900DB6B638621B9D2B16754B1A9AC47F0956060BFEB1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586131, "uuid": "b15b35ad-2ec5-4dc1-95d1-fda80ac93328", "value": "12288:GuZ1IkaEN9T4i+hUORjxeEfJnqtxi11qTVVNN5A+KXZeD:G26ErT4DhUO7ffZuxa+VNXA+KMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586131, "uuid": "58d9b062-2516-4d1a-9529-3cdd496ecd27", "value": 518066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586131, "uuid": "04db369c-6c3c-4a83-af7d-ba11bf3c8076", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586131, "uuid": "71123aed-9db4-407a-b04d-a6fcbe81840e", "value": "Proforma Invoice_7559 2824 And Packing List.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc1f147-e4b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682570205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570205, "uuid": "2dc65ed4-5cb2-4818-afb0-c04265273226", "comment": "Malware payload", "value": "a8ef418e2b5195e436df90c900c28f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570205, "uuid": "90ba35af-be23-40bd-ba95-73aabfb96e5f", "comment": "Malware payload", "value": "bccebaf52c2fab5d555e6ef7f72b1a95e8a7416fa4b6fc83962edb8ab6496c1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570205, "uuid": "3a89e770-f161-48de-9e1a-d7ac018b6181", "comment": "Malware payload", "value": "69ce0ef1fd3a27a71acff4369fe5079f5fd53cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682570205, "uuid": "3765746a-1fe8-4519-ad6e-a9627a4ad6b1", "comment": "Malware payload", "value": "7499d10a70d80abbab2be60771daf30dd9772108cd95881e62879a556dade58b78fab1ba3992902e8c5eb7f54ac160a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570205, "uuid": "5ce7137c-c2ba-4b59-ac36-6e8b03975e97", "value": "T1DAC4120B77829630C1891EB1CAD7809407F0E34ABE33D5443E9E13595C937DF6A8DBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570205, "uuid": "8262f00a-b17f-45dc-a88c-24e588a16f7a", "value": "12288:01xTeX/8Vnj/E4hYe/jKFtBtmjOJUGQfybht:SxTeX0j/xXOLBtvllh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682570205, "uuid": "416c468b-655b-44ec-85dd-74d1c6cbd870", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682570205, "uuid": "4c89577c-c4cb-4b3b-97da-7638653bfa24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682570205, "uuid": "83fa5231-d464-428e-83c6-d5d882792f1f", "value": "a8ef418e2b5195e436df90c900c28f52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10467cbe-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682553862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553862, "uuid": "1a43243e-3971-46af-8a65-9d256f2057a1", "comment": "Malware payload (Vidar)", "value": "2fb16cbfd99cfe4a195c94c1121c2e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553862, "uuid": "8f62b95e-9ea3-489d-b64e-33e606ab2deb", "comment": "Malware payload (Vidar)", "value": "bdcc0932f31bf8478356b9d2df3e6613385dfcd6f1179a70300430d5759298d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553862, "uuid": "87ebf999-6bd9-48a6-9698-1c60c8115a20", "comment": "Malware payload (Vidar)", "value": "3d667f55d15d7939524e50d1720e381ce0f7e814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682553862, "uuid": "cb36c935-d75e-40e7-95e2-82f3c33d84d7", "comment": "Malware payload (Vidar)", "value": "388f0b61f6c74209908341a37cd3d030b6f655c5ef492fc4f411599848f5df25591d66c0deb3809cdba935a828790d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553862, "uuid": "a072c867-4d2a-4728-a73a-11bd67ab7a88", "value": "T155648D4392E13D45FE26AB729E2FC2E87A1EF6518F59776931189E1B04F20B2D173B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553862, "uuid": "8120cd89-e2e9-46d4-9b05-0a0b5310ad9e", "value": "f0a1adf2f5b7a4f0da06f0ae432d3dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553862, "uuid": "b7c93fd0-47d0-4229-b393-cd43f16d9e68", "value": "6144:ljjBebeMSO1hl2oZlzAXVzBk82zrSyaw4CXws:hjBpM2o7zAXdBpyf4Gws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682553862, "uuid": "2ebc4164-070d-4483-8f5e-cac28ae08566", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682553862, "uuid": "fd2f3dd1-aa97-4a24-acf5-d96952610b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682553862, "uuid": "dff9c086-9490-4575-97e3-164816629d1c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8798ae-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554255, "uuid": "83520a37-d4fe-4c23-b323-62402ec46485", "comment": "Malware payload (Vidar)", "value": "9fe0b462a779cff10d328e480332818b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554255, "uuid": "b9ff6d97-7c28-4ad7-8fe6-ab5adb5b45d0", "comment": "Malware payload (Vidar)", "value": "be04801e050f6b11b177a4febcd6daecbbfa6891c0fbc2e053638ff7c1f7cda0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554255, "uuid": "536e9daf-ee66-4e3f-89a6-f00d7cafdcac", "comment": "Malware payload (Vidar)", "value": "c31d10faa53773d17822ee0ad70acf0839bec3d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554255, "uuid": "725c4c87-4fd4-492d-9a38-3dad5e07a4e4", "comment": "Malware payload (Vidar)", "value": "31fdc4b6fc543ef1e385ad257a59d1081b2cb1d8abd745356513b9db4c4a6f9106e10b121b76785322599408acbf31ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554255, "uuid": "eed07fdd-8826-4a14-a7e4-6ed89271c029", "value": "T1E064F112B6E0CDF2F88681355415DEA9A6FABCA29A4582C733D87FAF1D306C05777390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554255, "uuid": "dac1badb-f8c0-494e-a37a-a56b76417b15", "value": "4b07758d5b167b27106e05a1732f0848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554255, "uuid": "ad08ed5d-87ae-41dc-b4a3-6aa22f0c31a4", "value": "6144:vdCM4ZD2dI9UtxTPRcvughcUF6Zxpm2XxdDt5CHx:vdCM4ZD2OATPRaugh+m2XxQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554255, "uuid": "bf8087e6-3f05-4c4d-8154-1377096c622f", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554255, "uuid": "4d465350-8fb4-49c5-82b4-528f4ec560d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554255, "uuid": "b7a948c7-5e64-481f-bfa8-63c763420248", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad7ae76-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682598332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598332, "uuid": "f7a786d5-5147-49dd-9da7-5acbc23513c0", "comment": "Malware payload", "value": "82ef5ea271d2ba5ed792fabfa7b7cbd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598332, "uuid": "ffe0ce3f-8164-4ef1-8751-db83f0dd27f0", "comment": "Malware payload", "value": "be3deaeeb77207fe86d9a1abe3379c36ddbdfeb5f7936e912b7b5c75ddb10e00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598332, "uuid": "18864637-3fa4-4c5f-9875-5697fed14a03", "comment": "Malware payload", "value": "7307657ba5c3e0b2f372edd0d2276f49a40dfc95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598332, "uuid": "5e950afe-fc67-42ba-965c-b34c5e394fa1", "comment": "Malware payload", "value": "2e186b5f8a5345421e61560ef61ffcbfa37cc3e76d39301f267d2d2fe5360d346a500dc49bc5f4a25186692b9ecf54f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598332, "uuid": "b4e6a6ce-3b4f-4a44-84d1-802893394af2", "value": "T1F6532B9AF801CD7DF81BD77B44570909B671B3D152835B3623A7BAA3BC721A81D23E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598332, "uuid": "619c39d0-bec9-41d7-a120-5b46f8ef05bf", "value": "1536:oh9h2SA6FRcih88HEb8++sRU7DHzEpoakj8Y0+:oh9hNAmuihBQ+CUfk48Y0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598332, "uuid": "edcfee42-3e76-4d7c-9882-1026e3012f84", "value": 61276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598332, "uuid": "d20e0ed8-a490-4c92-9f56-19418cfe2581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598332, "uuid": "4fffcf4b-261c-41c0-9b2c-2cdd07642d8d", "value": "82ef5ea271d2ba5ed792fabfa7b7cbd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6294e5c-e4cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682580393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580393, "uuid": "68b5e154-908e-4f2f-b6aa-0df374e9671b", "comment": "Malware payload (RedLineStealer)", "value": "be1560da3df804115fcee91583030e89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580393, "uuid": "277b044e-2cee-4ce8-82bc-c95b2a562bc2", "comment": "Malware payload (RedLineStealer)", "value": "bf9c64bb8e6c8c3cc7c600a3131dce1de7fa7dbd87c4167ed3de8683e673ca18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580393, "uuid": "743122f2-6e24-46f6-b61a-0db90fde11de", "comment": "Malware payload (RedLineStealer)", "value": "ff0d0355948815e1db436e018a530efddb39e462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682580393, "uuid": "8bfdad2d-1605-404f-941e-6426227867d9", "comment": "Malware payload (RedLineStealer)", "value": "58f86466bb182b148e094046e0efd95b109223da98e4ca594cab103a326f84ecf6dc0121f775e9ec261073b4e08da22f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580393, "uuid": "52cec559-27d5-4568-9e8c-4a4a0c95988f", "value": "T185749F5382E13D45F92A6B729E2EC6E8761EF6518F1D776932289E1F04F20B2C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580393, "uuid": "66b1c5d5-87bd-42b7-8371-2b659e93e180", "value": "958f32b2db4437f7a0509a6814224698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580393, "uuid": "b84c3076-55cd-4f99-aa45-76eccf0e2ba9", "value": "6144:fGBZEwqonzbS15b+WU7GPf1ZPJgmmVXaHSam/gdEgS6gDeRS:fS1pzenTUa31ZxgmmVXmm4dM6RS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682580393, "uuid": "f89a2abb-e9f1-45dc-9100-c420d178fd57", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682580393, "uuid": "f1718e41-6b00-4c5f-a27b-bfe365befd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682580393, "uuid": "27ca769c-c3a2-456a-bd73-ec3c78dc2d33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c4cd9d-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597069, "uuid": "84596db7-dc43-4db7-8bd4-03905ae3c3e1", "comment": "Malware payload (Mirai)", "value": "bfe8115de8ca7145c2e07b5f93e30a65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597069, "uuid": "058ea1e4-b5bc-417c-a305-442e8c4553ed", "comment": "Malware payload (Mirai)", "value": "c0e8f49249c8e7fb9ffe98e3375d293a82ac47ad4a52ca5f1caf6935f8d371c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597069, "uuid": "63afd059-6660-4a18-b79b-2377997327fd", "comment": "Malware payload (Mirai)", "value": "9c7898829efb11b7199047275200fd70d019739b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597069, "uuid": "2ba58537-80f8-40b5-838d-0034180c9c8c", "comment": "Malware payload (Mirai)", "value": "95f7907dfa19e5c49b7dc5897c25c2ac3f060e7422b5b821258935a593fa890289c51c98b521d4198a27da4bfcc31770", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597069, "uuid": "a47d4899-f9da-4728-a4cc-3b3300bfea32", "value": "T14763D715FF550FB7DCABCD3746A81B0239CC554A22E87B3A3534D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597069, "uuid": "83632051-1e1a-4b7b-8b52-3bfdbed9288a", "value": "768:ID59zclowooHV6gcKbW4e9JQGOTe9/BekPSl0Sw+uo0iZ5qqXizwX7+e2kWI//wv:I1wogdNeFqA/BTPxq9Z5qO7+BkWbnqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597069, "uuid": "e445b5b5-3c19-4f86-a198-be0e235f7dde", "value": 73228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597069, "uuid": "9e1bd21d-037e-4932-b5d3-cc7dc107302b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597069, "uuid": "3332e572-7684-4fd2-a439-47d11a1b75b6", "value": "bfe8115de8ca7145c2e07b5f93e30a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14faf7d-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597135, "uuid": "bb877e03-364c-4709-bf7c-d47b723f8420", "comment": "Malware payload (Mirai)", "value": "330a7e358ef45ef0a780f8cbd5af776e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597135, "uuid": "ec375e6f-1eac-4ee7-9ae8-2d9fc6af3730", "comment": "Malware payload (Mirai)", "value": "c2a3959ddee726a40a954e8c52b16e42740d9a6c83358de84f9d0db7dd539882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597135, "uuid": "56ca9aa6-49c3-43fb-a916-1130efb5c75f", "comment": "Malware payload (Mirai)", "value": "f9c5e3decf9445229bc9cddf7d233ca6c393cb02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597135, "uuid": "3a38e195-52d1-48fa-ad10-bd13db10d7a0", "comment": "Malware payload (Mirai)", "value": "e007855389da821a6481451e73e2bf44b5345125820966bd4e26699fce96c9ee9a5f246d991521f9ca6d0fb27e391163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597135, "uuid": "f8a8bc70-3247-427b-8515-3a429f892a0a", "value": "T1E8C33A31B785C173D14301BA128B9F151C32FE7B264A995AF3A83CB4BB35185B621FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597135, "uuid": "db7db683-fd42-4456-9eb7-5a02a0654267", "value": "3072:QbqCkOz3UoA0iCHWB+yGe6vxehcDLoY4giAGaJpP:QbqCVpAj53IvxccDLoY4giAGaJpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597135, "uuid": "8ee74b76-afe7-49dc-89e9-655064439bd3", "value": 127274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597135, "uuid": "f3afe4aa-0d54-41d1-b7c5-1044752b0b5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597135, "uuid": "31542271-f38c-49b6-bcf8-7b02b30f37fb", "value": "330a7e358ef45ef0a780f8cbd5af776e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70d6f02-e4e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682590273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590273, "uuid": "45750de8-8594-4c75-a877-e7149cc000e5", "comment": "Malware payload (GCleaner)", "value": "47fc9ba077c5aba79df3ff1d69bd2958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590273, "uuid": "55e2efaa-b1ac-4535-9ac8-e9d86102b5a5", "comment": "Malware payload (GCleaner)", "value": "c5960e76d72474728fe3b445990707f665772cd3d6fe5bfc7637d895943ec8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590273, "uuid": "8b178265-5624-46b3-9f6b-4767613f90a0", "comment": "Malware payload (GCleaner)", "value": "7251f433775f8a92e4255fde6a7715445f81b4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590273, "uuid": "7cfc7705-1676-4f34-a0bc-e59d7f584260", "comment": "Malware payload (GCleaner)", "value": "c678cde736c1cfa76b3cd535cf4a34040f9102fc588310f6595ed808a26de1ea0a58d9d99ea2659cdd2177b5953cada1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590273, "uuid": "e1c8e82f-8bf5-47c5-9edb-d3608669af2f", "value": "T173E5338B95D18536EA809970AD34E3B093B5F432DE2C009836E6DD5CEF67A55E12833F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590273, "uuid": "80b707bc-a131-438d-beca-87b230b5ebbf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590273, "uuid": "b3a6d381-2236-4a18-b174-068e6d21b769", "value": "49152:EGlJfs+HS6fyl1MbjUn5dBRUWrJN3IfyePdrDuQQGxGggVYipobh1ouhqATn3WHw:5XHIf59UEY1drDurGxR71Vqy3WSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682590273, "uuid": "f455afe9-b7f9-47c0-b533-2d4e8e9d0eaa", "value": 3082566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682590273, "uuid": "ba1b6b11-605b-4823-807c-150b474016d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590273, "uuid": "9f34bd2e-4e35-481d-afea-f63c03a04094", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f982f22f-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682593337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593337, "uuid": "c483dd7d-8825-421a-9c93-4ca8156e93ad", "comment": "Malware payload (Mirai)", "value": "c62f9179afbb63e830e2834a65800671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593337, "uuid": "03c19448-e031-42fb-98c0-dfe74f9a2dee", "comment": "Malware payload (Mirai)", "value": "c83ec53767bea1cb34e7f517438cdb4e8ea4a998fd6f39343a5586b756270a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593337, "uuid": "b48143ee-6cb6-4f58-9ac4-fa0f4e02296f", "comment": "Malware payload (Mirai)", "value": "b70c47f1a6ed717f505c6ac761ebe599086b7302", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593337, "uuid": "1d8a5ef9-f5fd-42c0-a114-077ec5e94b64", "comment": "Malware payload (Mirai)", "value": "bfdd3f7a3731561ffd5d273b014ab21dbce2d05225dc086355f1bbb1b3d2001abe5b3f27de3a3ea92cda3bd102259255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593337, "uuid": "963275bf-ee06-4791-b320-e13895b9cdf1", "value": "T1EDE3293372D189ABC09312B82ADBA6A19C21FDBF0735614B33D47E687B398C45D59B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593337, "uuid": "ea971a86-28c1-4d30-a9a3-629706053ce8", "value": "3072:ezwFzskMXc8TfskyCBkIOVPem4MSRzWEyDA6Dcoixgr1TkM3Q:eGMXxJyCbOIdD4Dcoixgr1TkM3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593337, "uuid": "69d52997-f1ea-44d2-a106-8d90346bd401", "value": 143548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593337, "uuid": "19072425-e347-4f86-b089-409d4cf81718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593337, "uuid": "7bd2127c-e4e5-4b78-80b0-e2034fd6e47e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a1f1cf-e534-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682625008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625008, "uuid": "ef0f49d2-dc65-475f-9bee-3a190f40c5c2", "comment": "Malware payload", "value": "97548f32f23d08c29a8d27b6de6378d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625008, "uuid": "de4c8eba-8aa3-4bde-ab1b-80bcaaeaa144", "comment": "Malware payload", "value": "ce1f8bb97ab54c2ad655b2975b137ab7b905d6dae21852204d1df4e1e533601b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625008, "uuid": "fb59ce6f-85fa-4398-8e96-5ef99dcd95a1", "comment": "Malware payload", "value": "55141877323f092c59b780e2295aea056bfea845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625008, "uuid": "f3558975-a670-4b55-9507-102c8656ddab", "comment": "Malware payload", "value": "493fc06f876677abed13a945aa2b1f4b88fa02dda2a76fd66c7c43e9ff0ac428404a7d06410f3e03f15617230bba620d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625008, "uuid": "edc503c0-3897-4175-a0de-60d9c96834d7", "value": "T132452362B7DD9071DAF507B10CBB62DB1B36FD638B3463EB0245992A0DB3284653436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625008, "uuid": "5686858c-3d1a-4909-9a5e-f17c87306566", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625008, "uuid": "b0e33aa6-1512-4455-b22a-68822add5e85", "value": "24576:tyyfeRj1UY7CQ7yaV1FJ9Rwf6O4erbxvPPOh3n7mNBdCSUc+0g/iG700:Ieuj1hGQ7y0Bwf61Cb1PPq37mPdCSUcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625008, "uuid": "28dcfcfe-fb0d-4c11-85d0-bd43cde75589", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625008, "uuid": "4654798e-7f23-41d3-946e-c83a8697d623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625008, "uuid": "bc715551-34d9-4029-abe5-839c47e5b0e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2990fa3b-e4a3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682562494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562494, "uuid": "f8f5e540-e9ce-4a24-8662-f6ba18df1b6d", "comment": "Malware payload (AgentTesla)", "value": "4c23306074730e6359bf84ea3a3b2b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562494, "uuid": "6d49d7f5-61a3-4d66-b03d-3fca65dcb44a", "comment": "Malware payload (AgentTesla)", "value": "cf68a4b1cd111139d6704f1a6773c9c37e766fd04a414898ca79e0a7b8ed8b5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562494, "uuid": "404f448d-d724-418a-8dc8-6e00ca76d78d", "comment": "Malware payload (AgentTesla)", "value": "fab0bc776fdb46fd854ae04e59172e1a5f780ff4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682562494, "uuid": "cc69693d-0604-4a15-ac2d-c6b2909e9113", "comment": "Malware payload (AgentTesla)", "value": "7094cb20d1ffbb0563e72ec14639fa6896366c88f992fec63226d5547aacef4da667f4b147f8f30c674b241b75873554", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562494, "uuid": "1a2c8c41-3560-43c9-9f1b-88b0cc375de8", "value": "T19454120428F8D557E42737711F75226A1F7E8A67C6F9D29F23206AAB3472F41D20E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562494, "uuid": "632ac8ba-4eaf-44ac-b4f0-c6cab71b52a4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562494, "uuid": "4dc39e29-cdf7-45ea-942f-ba0c25aadf82", "value": "6144:/Ya6uTG4tNpQ5ccKMiSmRbw+Et3WkGLBv+DN+myJM3rukMevRDegC:/YYTG4e5ccvivRbHEtGkcxIUDM3pQgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682562494, "uuid": "d01d3abd-bc4a-4a2a-bf28-3f8d148ad295", "value": 291089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682562494, "uuid": "dd4dbfa3-58f5-4804-8890-e9e22c8295cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682562494, "uuid": "ca78c084-605f-4a69-a53c-068ec0a9f288", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.13974.10636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeea8d3-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598364, "uuid": "cf1801e4-1887-4ddd-a45e-bce13ea2be69", "comment": "Malware payload (Mirai)", "value": "12956a4fc2edd7d353c7ed6ced542258", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598364, "uuid": "1fa15293-78e3-4b74-9720-925777aff6c9", "comment": "Malware payload (Mirai)", "value": "d0be549d6f9e42e9d2dd554c81dac972ff344776e7437381b1573328f6577228", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598364, "uuid": "554c722e-5713-48c5-89d4-0149907cdf7a", "comment": "Malware payload (Mirai)", "value": "d50ceb970e64da507619835b246f1a9c8cdbfa4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598364, "uuid": "df536b1f-b322-4fa9-81cd-d1cec72ee1f5", "comment": "Malware payload (Mirai)", "value": "d5115149e7add3e2e9be1e909ffd3df227166b4ab5da6e3a475edc7734238cecf32bb8568d3d314de4e846e4a957fe80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598364, "uuid": "787ec373-ade5-4df1-97de-3b1a24f414e0", "value": "T18EF3E770EA04832BC2D377BAEB5D028D3F351E9777EB3B115A3439742BE57A42A29510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598364, "uuid": "05880741-7187-4b4b-bfdd-fb0afcc0936e", "value": "3072:oByAgRFqXRRRHQ7XIQz2X7HznrL/HceRLADiDDOYU/SQzMKiqih:DkTCIQKrTnrL/8irDDOYU/SQzMKiqih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598364, "uuid": "bc5a2c24-89f5-44ac-8bdf-4b6e1efeb853", "value": 161292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598364, "uuid": "33dae55a-009c-46b8-a99a-f7cc0e21c36c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598364, "uuid": "010192dd-fb04-4f8d-889e-2eacbe88a5d2", "value": "12956a4fc2edd7d353c7ed6ced542258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e121db60-e4d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682584277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584277, "uuid": "673f692e-a1ce-48ba-86ea-c26886ae7ca8", "comment": "Malware payload", "value": "3d3c3464bf2fc5ea569fbddc652f01ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584277, "uuid": "e6e097ec-4694-47ca-8942-2a66cdd70f18", "comment": "Malware payload", "value": "d2803b97a3cdb1787df9e3bd60818968fecb86bf7eb48bfa51e0757f055b95e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584277, "uuid": "360356d5-74f7-494b-9f88-babc943ce09a", "comment": "Malware payload", "value": "421c43eda148c39d0dd8e0edc5231e48c980f625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584277, "uuid": "73197fb0-7473-406d-8aa3-3335a261fab1", "comment": "Malware payload", "value": "6df01a786c9b5b8c7b53150a5b130e28c910549193be984a549ce40a163f7d2abbbb8baf0a5cd836a1f8b8d807984d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeFlappyBird", "colour": "#FD3666", "exportable": true, "hide_tag": false }, { "name": "W4SPstealer", "colour": "#ED70E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584277, "uuid": "31a78f25-8810-431e-b26a-926f64dcd56c", "value": "T1E9572381BA92A5B7F845F3B64012060973298CB4B744C7473AEBF567AFBE6E06D114CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584277, "uuid": "7695f290-4b02-4355-b9b2-e86e1b49d159", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584277, "uuid": "83b73b6b-0062-4032-ba7c-5f36f2dafb4e", "value": "786432:wq8kA1njeGSzsisJP7Tz/IZXgxbKz3oBzk:l8k4jAzsisfzgZXgsLOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584277, "uuid": "ef8ef461-3f70-4b0f-ac00-1a66738cb9b2", "value": 27848825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584277, "uuid": "34e1545a-2c1a-4474-9fa8-c7b8927994f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584277, "uuid": "113a7a3f-d042-4e7a-82e6-ef31ab8cfbb1", "value": "FlappyBird.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7b397e-e4b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682568025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682568025, "uuid": "af59e6bf-e0e1-4a43-9416-bd48d3f63aa3", "comment": "Malware payload (Loki)", "value": "7022efdc7290b59496df738f10ff2af8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682568025, "uuid": "fd62204e-2138-4643-bf14-031d82568e73", "comment": "Malware payload (Loki)", "value": "d355c4841e3eaac57d849ebb20b976ab3d9a8a2a12d93ae6704fcc681241c785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682568025, "uuid": "d8987204-7de4-486c-80ee-955eee0952dc", "comment": "Malware payload (Loki)", "value": "c8010e7eefa1d6d58b48e23178947a29b8dd6649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682568025, "uuid": "2419978c-181b-4037-ac7c-c6b40c8a8859", "comment": "Malware payload (Loki)", "value": "4894abe2b2c59ea7cdf10d8d4cac35ddb6fc71ae30422e4db2b2d7e95952940efe7e3be319697605833a128dc88c55b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682568025, "uuid": "5d1f34df-88a9-4fc5-badb-dfed99426ff4", "value": "T13A45492DB3A7A833F3839339277C095A87EC2435F234C43BEE45B6EA91626855501F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682568025, "uuid": "aef41f65-e8d0-48df-88ea-c3496b5f8361", "value": "2b3814717d15f52ec487cff5902c1488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682568025, "uuid": "03806686-ea29-44da-a82d-4823d04084a1", "value": "12288:NbbbbbbbbH77777777YazjkAame5Ug5lYjbbbbbbbbH77777777rioJY:CKkAT2P5SiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682568025, "uuid": "81232f89-ee43-41c0-8752-1914ef9fa94a", "value": 1226376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682568025, "uuid": "3f754a24-ae41-425d-9ac2-0555c9f77ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682568025, "uuid": "c755b174-6769-4b46-96b2-1144082c98d6", "value": "D355C4841E3EAAC57D849EBB20B976AB3D9A8A2A12D93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894eca4e-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554065, "uuid": "23793acd-2175-4b4c-9589-c5cd6fe13a2e", "comment": "Malware payload (Vidar)", "value": "6fdea17609ea8908ec4a9d5e530d048a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554065, "uuid": "88512f04-dfa1-4f43-accd-7a0cb982dc82", "comment": "Malware payload (Vidar)", "value": "d3564cf77d63b9b2ec8cf914958453f19e0d1032f4ea4665fe05b2284decfb0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554065, "uuid": "d3e6c97e-5b43-43c5-8c50-b5213f6d7ca4", "comment": "Malware payload (Vidar)", "value": "8afb663c04747980d13750c9903cfb496f170c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554065, "uuid": "3cae5833-8a87-4831-a81e-735034f0fd89", "comment": "Malware payload (Vidar)", "value": "b94b231153cf85264901c44cf00e7d425b3238ae57e927d078d3e2218d1ab7664843f912c372ea5726b335105ab4f644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554065, "uuid": "8ef6433d-f5b6-4c01-9b09-ffaea516d92e", "value": "T15274F153BAD0EC63C8168435C818C6F4A7B9B4A54BC4DA9773083BAB3DF17E16766321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554065, "uuid": "8dec3429-956f-43a1-afef-51e8d599ddec", "value": "1e51d18e39297ceffe4d850dd23e3d8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554065, "uuid": "babc83ec-b294-4e10-9824-858f5cb9e828", "value": "6144:37nGJVhO+7psym+TcZfny5sll4HVXe1pnM4UTQlYT:67flo+gRz+ypnX+Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554065, "uuid": "4ad1c58d-e089-4751-96ae-b0cdaefbe3ad", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554065, "uuid": "886f6140-8041-4ff3-aeec-e7f3fd237d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554065, "uuid": "e383f3be-6735-483a-a1db-a151891f48c2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ce83ad-e4c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575124, "uuid": "50a771b5-a407-42e8-b951-93c41a3cb616", "comment": "Malware payload (AgentTesla)", "value": "b39d53b75a187cc348e74b3c78101364", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575124, "uuid": "9090364d-644c-4b55-9bbf-dd7d95d6a24a", "comment": "Malware payload (AgentTesla)", "value": "d46b8526a8a8b3ad723d25036a6d692009245eb965d64576e90915ae877f9eb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575124, "uuid": "b0586933-ef7d-484d-a821-d56beb2b111d", "comment": "Malware payload (AgentTesla)", "value": "3217a889aae78659d9f2652965a2fa044b30369d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575124, "uuid": "faee54ea-664e-4bc9-b7f0-019ee4d6f635", "comment": "Malware payload (AgentTesla)", "value": "5c95880df75ce65d5c3524a3e7a78c12a76e5d92a3dc4ee84e9fcdbbb1be300931be176b36d551b6ac55bea831743ecd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575124, "uuid": "cea7edf0-0196-4106-a7e6-bde04a384f06", "value": "T13C05373C19BE263BC179C7A68FE4C427B114A9AF3121ED65A8D747A64346F1235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575124, "uuid": "af0bf871-e768-45fa-a0ef-22e785074e83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575124, "uuid": "04806861-5063-475e-8168-6c03c4681c6e", "value": "12288:ta/9WflU/9eyH7BOGdBFkHD4h2doQI8kTLjmXQ/ufv9x7GXtqx:oylUZ7BOoeuCoF8kvx+zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575124, "uuid": "55df8d11-343d-4c32-9e85-2b86987ac859", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575124, "uuid": "1da728b7-ad60-4feb-b936-701b7944c143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575124, "uuid": "39568c4c-2a83-476a-aee5-e7239dacf99c", "value": "Statement of Accounts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe5bd0f-e4ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682594529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594529, "uuid": "bbc6edd8-3d99-44ce-a23c-10b1cf91d005", "comment": "Malware payload", "value": "71497e78ffc75fc1930984d5c74ed76e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594529, "uuid": "8ad54f1c-668e-46f2-a8ad-a1399493972d", "comment": "Malware payload", "value": "d524de902f104274775292fcd9f70747bc12aa686781e54ede9be012768a06ad", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594529, "uuid": "b1f35018-7743-42ee-a374-62a0d0118afb", "comment": "Malware payload", "value": "0fd2c7d62e0178669d50417d92574e0556470325", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594529, "uuid": "bae7145d-cca3-46e5-99fd-223980030cdf", "comment": "Malware payload", "value": "3e6a85d2e1060c8ddafb78688252a7d45da3f715a6ec279b1218487c413520600c5c8fd6a26f1f0d2019723991b52cc9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594529, "uuid": "d2788ed2-4b73-4029-b188-1cec461241d4", "value": "T183C633A7F759EE3AE0F7D636D73A066BA6064C9C4253FB031A86762C09B35C01BC6D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594529, "uuid": "cfb2bdf8-b528-42fa-9b2a-ba3c455ee6a4", "value": "196608:8sZG8723L2p8EZ4PX55E5l71IJ+m0om/bvlwcRYnlj5+sTB88nyB+1Kx1+uGOu:duLCDZ4PjG1wEZwpnysgx1Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682594529, "uuid": "1b97e0eb-0912-4dd1-9e04-770e386baa9f", "value": 11524122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682594529, "uuid": "9aa7ce89-a3a7-4ccb-97c0-e6934bf465b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594529, "uuid": "5f22f7e9-7dce-48be-a0c6-5908ee8b707e", "value": "1679631888434.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0982fe6-e48f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554104, "uuid": "ff229c24-8225-4db1-a0ca-2355d66ee6a3", "comment": "Malware payload (Vidar)", "value": "0310399e362384c27d344d555a4a67f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554104, "uuid": "c9a6861c-77f3-4b4a-b659-c919820153d3", "comment": "Malware payload (Vidar)", "value": "d63913dd7bb4c567c5e752149ebd9f90023a34f49b75a585e6f67c6834dc24a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554104, "uuid": "f161ebce-eb0c-4c29-8479-96689494f3f8", "comment": "Malware payload (Vidar)", "value": "23506dd3803a3d0c521d1010c01927ed5898bd50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554104, "uuid": "a0663e19-d46c-467a-8fc0-b87ece0a7b46", "comment": "Malware payload (Vidar)", "value": "72a3987e9d67dd483ecf82da9836494eed745a1eb0363cacabdebaef329e88a99300d0c1c990f952f8609e37304b316c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554104, "uuid": "cabfe9f7-3a15-47f2-9ad8-e8141bea3f6e", "value": "T15474F1127690DCB2C446C4349868E7B8AA7DF46196C69657732CFFBF2E30681E27B350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554104, "uuid": "ab710d11-617a-4f29-97dc-5310ead39d70", "value": "557304204f793bd25ef0de03ca7f808e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554104, "uuid": "7e985666-4b06-4da4-bed1-68ae143b4b22", "value": "6144:C0q8ZGeHWp5nZ109o3zjo7L7JsmrAcmP6DfURnaMeXtT:FqcGeueYYP7JsmrtW5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554104, "uuid": "477922d8-f67f-4e52-96d8-e4b3fbb6a60c", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554104, "uuid": "e3ac784a-d886-4954-a842-93e874c385ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554104, "uuid": "a0b84b5c-97e8-4a43-9b0b-804ed1397d15", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de83eabc-e4a1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682561939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682561939, "uuid": "b1cd30c4-9cc9-481c-8536-56cd2461000a", "comment": "Malware payload", "value": "3daaeda8b8b0d1cab921d680b50af703", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682561939, "uuid": "a2c56aa9-d4cd-4674-9c7b-fe9153fa9b92", "comment": "Malware payload", "value": "d65b7bbb0e96b15cbe707ca091c2d34ba2e159ffcf95bf3b4e9746074f55fea8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682561939, "uuid": "264b93bc-13c1-48ff-92b3-af1fd5a0378d", "comment": "Malware payload", "value": "997a2042f69236f886bd8bc7232126a02aba231f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682561939, "uuid": "441d0582-2977-43bd-9c7a-4085a01c0bfa", "comment": "Malware payload", "value": "237f8b8b4e25508e43b08e72a5809ac82a908ad88dc262e7e570fef2b3ebedaa3cf7640eb3b050e0f66b1f05cb1ba996", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682561939, "uuid": "4bf00e09-aced-41d5-b032-90c1fdfc85ae", "value": "T1BEB633569C4667CF12EEDCE4BD22DC27039312BD793880DA3CBC44E7A7705A89CA6179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682561939, "uuid": "87475369-9418-4480-b88a-f2423c37a817", "value": "196608:gmyXF4OLkso2A11C5vB9+9RKUpqaAvZES9Ydpbch4r7agRmyOWplke8GRZXzpI92:HQRtoT1C5vXMRqjzYddIY7z6mk1GPXzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682561939, "uuid": "2b6521c0-f24c-4d08-b625-62203580861d", "value": 11452416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682561939, "uuid": "8d27489e-2c44-42b3-8d19-486bef82b822", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682561939, "uuid": "ec935d28-6869-4dba-87b8-961d148877d9", "value": "5.5.1_116.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5fb6ce-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682554684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554684, "uuid": "537ca3d3-c68b-4757-b2b0-066cc6e131e3", "comment": "Malware payload (Smoke Loader)", "value": "39ca7f687fae04a7000032e9a2a6c965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554684, "uuid": "14f19fc6-cb7b-48a8-b58e-1b7ce6c25fc4", "comment": "Malware payload (Smoke Loader)", "value": "d7380d1d8c51aecf6ffa29f582400a6530ccc2de4f1fc2c46cc609e2bd7bc8f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554684, "uuid": "8e39d5f1-ee18-4802-8579-67c04df27bad", "comment": "Malware payload (Smoke Loader)", "value": "3bc924372e6e417790695dac7f3a335cff675e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554684, "uuid": "74dd0c32-812e-471b-a547-50ddba95272e", "comment": "Malware payload (Smoke Loader)", "value": "0d0a75f53c889fe8f775b960cbf45d1b3323b0b568e211e022abd577ffd72a98bb0e4aa2e9f65a89f2a7f2f968078a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554684, "uuid": "dbd6abec-5856-4fa5-b8dc-dadcae283e5a", "value": "T1C1243B4396E13D41FA26EB729E2F82F8B61EF6518F19776931189E1B04F20B6C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554684, "uuid": "dbc0dd4b-8b78-424c-b6b7-c7347d11af3e", "value": "f4d72c3d48b97275dbb7753d2cd3f6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554684, "uuid": "edc3e2db-229b-4e0e-8ac4-4ec92ff595b8", "value": "3072:ANBYcgUqeNgVLECw2iG4CIQiRjj0D4/DQQfc5qQgk0I:45gUqeNqhw2i484QfrQgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554684, "uuid": "5e028fe8-41bd-490a-bd22-32509c8ba318", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554684, "uuid": "c81e8b1a-c7c8-4a49-842e-1bf3663281b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554684, "uuid": "9d8f1201-471a-4059-9323-cd987e7f555d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22053c52-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682586104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586104, "uuid": "d7b9d708-57c7-412c-b1c2-46e3783e29a3", "comment": "Malware payload (Formbook)", "value": "fb9e320938e83d1c67dda20d8c39971c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586104, "uuid": "13206058-bac0-4a6b-81fa-5433168c111f", "comment": "Malware payload (Formbook)", "value": "dd7791a299aa1f8554c005c82f18973129b3d41168a180123cf12edf6dbe09de", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586104, "uuid": "a13bc176-786b-4057-852c-311e0e5d1fa2", "comment": "Malware payload (Formbook)", "value": "c23444e65523660ccdb357c65f850fec67e03bcd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586104, "uuid": "64a1b7ff-de34-45dd-9bb4-a794cd5511d1", "comment": "Malware payload (Formbook)", "value": "4675564f88224a395471f2b1ac1512e3e3755a51f7ab269bd1f4262d6d453b46b64f913a1d9187b9e39a22d69b8ead80", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586104, "uuid": "bb6e068a-1634-405e-b99c-859b909e26da", "value": "T19302AF6AF21462CC3FA836F7044FAD4F1434B4A5CD518BE09249E3E53B5DCA54ACA708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586104, "uuid": "1335d169-409a-40a3-aa98-feeafba7fcb4", "value": "192:uuYEQagZBtMossHGd7FH+AhOQ4dX7ShbF24Zkg7O:kEQxBWaHGd7FeA01dLShh24X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586104, "uuid": "9c1d320f-a658-49cc-92c9-03bf08e2e5fd", "value": 8911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586104, "uuid": "b80674a1-bb3d-4977-ba88-9c0970fc9a4f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586104, "uuid": "3fc25e1d-b73d-4352-b3f3-82afd9d366be", "value": "alloy_steel_pipe_accessories_specificaion_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81806a3-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597093, "uuid": "c754872c-f20e-47d8-85a4-16ade22e6a12", "comment": "Malware payload (Mirai)", "value": "f41c6357dcc35be0ce97a8698d46e2e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597093, "uuid": "811a97d8-3394-4334-bfa0-153bb524abcc", "comment": "Malware payload (Mirai)", "value": "e202dd45889dbe145098a85ca2b7dec0aee212e6b019731eef4e77032cdbdc0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597093, "uuid": "51f0b326-92ac-46bb-ad22-d6300b737e56", "comment": "Malware payload (Mirai)", "value": "aabf94d3cb70699b9465c39ec43eaea168b989af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597093, "uuid": "6248361a-43a9-4eb7-a66b-5cd44bf588be", "comment": "Malware payload (Mirai)", "value": "b405e93f4ff6fcfcdf969380d3334173184c82152a016ccf89a6f015f6da1266a884e4ce4dbe79c3a6e0c3ed41d0c75f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597093, "uuid": "df7c45f7-50fb-426d-aa2b-bce66499c8e8", "value": "T195633902B3080D03D1A71EB0263F1BD1B7AAD9C122E4F685795FAB96C675E334585EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597093, "uuid": "e363f40e-9bb0-44ff-a82d-1e8a32ae2101", "value": "1536:PTY+qynlwBMh0ZRSmDi94NbgOLjjwwbZnlh1:XqyoMhaZi94NbgUjwwbZnlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597093, "uuid": "b8cfbc32-e4b5-44db-b1bf-225416757e99", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597093, "uuid": "d6153c18-7e79-4c4f-a811-c493e18583f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597093, "uuid": "3a999cff-9b08-49f7-9541-3da492a0f4ca", "value": "f41c6357dcc35be0ce97a8698d46e2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f0b5b4-e4e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682590615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590615, "uuid": "716c08ad-5d4e-4a55-b8ab-409c62e5a91b", "comment": "Malware payload (RedLineStealer)", "value": "202edda8828033eed8bbc1a83addba59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590615, "uuid": "43792a3d-5cae-4707-a672-9a40ab58fd37", "comment": "Malware payload (RedLineStealer)", "value": "e36dbd1504b083ed1cc80e55eade678d59c6427a37f82dbde2858f95b83dd5a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590615, "uuid": "1984a3b1-2cfc-4f51-900f-2ccaa1f4f21d", "comment": "Malware payload (RedLineStealer)", "value": "8287685186ae385392f9ecdfda0bca03f03cd2bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682590615, "uuid": "7609d458-5f96-443d-ae15-796908c0fd1f", "comment": "Malware payload (RedLineStealer)", "value": "f10da6002937f089cf23f34b550b618e6ac62dfc47f5258f3dae6d7f9e6177e630b5ccb96d5a6cf51d9b30a89fb08f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590615, "uuid": "5db39fef-a1e6-4128-b646-7116cf5a0138", "value": "T195352373BAC44821DEB457F208F6639B0235F8806B64D7DB77986A9E4CB21C4983476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590615, "uuid": "143c6dd5-4920-42df-b67b-49c80262633d", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590615, "uuid": "9ac7bdd0-a34f-4be0-a7c7-4278d8b7cdfb", "value": "24576:4yGZhfpXdLKlZJ8W+UllxPYiQMQj/Dz5hg6xXQKrRkr7Q88kk:/MNrLKGWZze/Dz5hn5QaRAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682590615, "uuid": "c1efcfa4-c73d-4768-aa94-619718cc6292", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682590615, "uuid": "bbc200e3-a4f9-4e27-8a78-d5c93e96b1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682590615, "uuid": "6899f089-c6f6-4ec7-833f-e997b95948be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1a3877-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682554632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554632, "uuid": "3e6ae274-17c4-4dcb-a529-64795667333f", "comment": "Malware payload (Smoke Loader)", "value": "12d2898e76799b59c1e9645890dd8655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554632, "uuid": "9db3f649-3ea5-4680-a7fd-242d7698ace3", "comment": "Malware payload (Smoke Loader)", "value": "e3c15f1c7b655b44882792cbb98fd962f47137dea2621128be6595a1237a2672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554632, "uuid": "c2c7ae4b-8028-4381-8e09-86735549718b", "comment": "Malware payload (Smoke Loader)", "value": "308dceccd0d359c3ae36a30ce5fffa2e53d7fb7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554632, "uuid": "60fba47f-b582-4cc8-b8c8-935e2eb80bec", "comment": "Malware payload (Smoke Loader)", "value": "6f45efe09e173b7f73fbfd492396cfd4540939e681c8ba904fdabd35031562d6073d504e13bd56ca5dcc88d65ee207f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554632, "uuid": "d9fcfe56-9da3-4973-9552-b46e3155ed49", "value": "T1C3244C5392E13D45FA26AB728E2FC2F87A1EF6424F59776921189E1F04F21B2C173B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554632, "uuid": "67ea7947-bfdb-483d-9fcb-fe90368db00b", "value": "f0a1adf2f5b7a4f0da06f0ae432d3dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554632, "uuid": "22272af8-ae5f-450a-b5af-687275ee9e5f", "value": "3072:tJbFYzikkqWi7AXQ5Bp87Jct0nFznb/45qKKSk0o:t9uir1i7za1U0nRDHRSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554632, "uuid": "1c772caa-044b-491d-a8d4-7003e0f1a63e", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554632, "uuid": "b9dec74c-2249-4c25-9faa-9f44b3e0039a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554632, "uuid": "bcee55b8-788f-440c-8f80-8b18971a5ff4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cee609-e4d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682584820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584820, "uuid": "c42e0670-a0c4-4e8a-b7ed-11c07d8eafca", "comment": "Malware payload (Gafgyt)", "value": "c1f12be26062842dea7fc9dea4ccf6ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584820, "uuid": "613904bc-765a-4173-ad76-0043a4563f72", "comment": "Malware payload (Gafgyt)", "value": "e518909d39ac18056510709dd5ee38688153cf3422700dff3c9306607e35d5e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584820, "uuid": "6d03f7f4-b236-48d8-8398-c670445b8590", "comment": "Malware payload (Gafgyt)", "value": "b28022f460ebe6ce9d5050395ffe996cd6494684", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682584820, "uuid": "5cbcd9a0-c329-4262-abb7-e1caa6f9bca3", "comment": "Malware payload (Gafgyt)", "value": "6e8de483859b91c142b4e05553ea890384bd9570402cb2f999c41f31b423b90f990d0d8be0e943a1ddbf3fd318326744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584820, "uuid": "65ad2846-2430-4293-8385-2dc406155483", "value": "T126E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584820, "uuid": "b300a049-90f1-45d8-81b8-3ec5fbd5b701", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytV0pLtaoLAImlP+s4zWfOodW:byvWmBx+sK/Pfl6gImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682584820, "uuid": "2fa314d0-d870-4122-a418-fdaceb19d381", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682584820, "uuid": "97f58f2e-d612-45a8-aa2d-1ab81e0acd65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682584820, "uuid": "3e81efa4-d389-4834-a040-e9f1b2043ae7", "value": "c1f12be26062842dea7fc9dea4ccf6ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3105580-e4bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682574804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574804, "uuid": "779ba005-2783-460c-8e95-14d02b906448", "comment": "Malware payload", "value": "1808638c82f610f7ff2e29ed9d97d640", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574804, "uuid": "652c8e6f-4203-4b0a-a9e2-6753570feb76", "comment": "Malware payload", "value": "e53d10377220c68833fb09a570e9a048ccd06e5355d14a295a6b6bc89fb64235", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574804, "uuid": "574c6171-7957-4c82-b54e-9e0047bb0dd7", "comment": "Malware payload", "value": "b7f7a6668ee9b2643b5ceffc69fa1ab96353692e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574804, "uuid": "1e5921c5-d645-46c9-bf72-9b8195a8252a", "comment": "Malware payload", "value": "d2f225c01d538a7049eb9c272d52b782f73aac1963319b7571d891fc7e6b69676c897573bbd2c3f7c9f2082df944d90e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574804, "uuid": "c42dafd7-daa8-4b8c-a3ea-a77b643708dd", "value": "T145412A6A1C052CFB034300EF64DA7334221801B1FF7AAA829CEAF9CAEFE6C351154026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574804, "uuid": "bce9ccc0-f3d7-4342-b7c1-e65aabce002e", "value": "48:ZS805gJtv6uVGlqZf40uU2n78PSDEZRBgtk4:ZS8ugJtv6uglqZfgr8PSDEZj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682574804, "uuid": "860ca384-9de0-4862-b1b7-c29d475823ac", "value": 2002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682574804, "uuid": "26dbdb2a-516a-40c5-b5e1-7f05bc70b7db", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574804, "uuid": "1348463d-2633-459c-ba4b-b5080917723e", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f77f97-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682586137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586137, "uuid": "7eb309fc-6d41-4fe9-b4a0-fc037c0d727d", "comment": "Malware payload (SnakeKeylogger)", "value": "c62343c3c6463795e88fe0a2a81c82b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586137, "uuid": "d01f4e2c-38a5-4532-80ac-03216cc8dbb9", "comment": "Malware payload (SnakeKeylogger)", "value": "e6c7bf9f389f560ec25ba1808468c5d334cf75d2142face3704aac05af8c024b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586137, "uuid": "cb42453b-024e-4fba-9e9c-f3361ac455d9", "comment": "Malware payload (SnakeKeylogger)", "value": "02df1939b04bc7de83c3029c5eb8e9b25cc9be91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586137, "uuid": "a37a605a-62f2-4d7c-8aef-e1cc80058274", "comment": "Malware payload (SnakeKeylogger)", "value": "b888c3030b0a53f5b1b046c211897a3b6146a34feb01a7751619368014c3c34e2f3446b0593709e0b405f7bef50f6708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586137, "uuid": "03df2a30-33d1-469e-ac23-48b21062e15f", "value": "T18AD4E43C19BDE23B91B8DAA58FD1842BF740D4AB3115AEE6ACD747518316E1234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586137, "uuid": "7f0890c4-0d9e-4bf0-aa7b-691233120ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586137, "uuid": "69f0e7fe-2c2d-44d9-a57b-5add6ca8b3bb", "value": "12288:uTsF7by6LkLe/yqmes+tl2kDkgE1jBn0EOYFl:hFDowb1s+pDQxoYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586137, "uuid": "25b055e0-bec6-4ca1-a2c5-8cbdcdf22697", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586137, "uuid": "7e9122e4-7210-452c-8fb9-fb3475c0e8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586137, "uuid": "8dc3bc72-8aa6-4c65-b70d-b23fd06dd918", "value": "Request for Quotation No. HBKMC 54171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1437aa-e4b8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682571818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682571818, "uuid": "832bafd3-83cc-4d6b-9dbf-2afd71490383", "comment": "Malware payload (Vidar)", "value": "26c12aba3b5a115d120e72c7dd409d62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682571818, "uuid": "85f2ed8a-f90a-4612-9c16-e3a5b9afd7fa", "comment": "Malware payload (Vidar)", "value": "e6e4ba6207c487fbd207a88cd71d12203e8899daf72a6819131aa805fb0c4444", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682571818, "uuid": "2553e737-802d-43d0-80b4-60df3455c9cd", "comment": "Malware payload (Vidar)", "value": "9f6679142b2477d71be091e53c0f8ed0717b9ca5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682571818, "uuid": "106a9543-6c62-4b19-9171-0f483180b321", "comment": "Malware payload (Vidar)", "value": "5ae4658824b5e32156fe277e8118abba39168f2cb5caf41350c765c39b03a5a2d349073c9bd06137f488fea17f763d48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682571818, "uuid": "c9d01dc3-a643-4585-91fd-89a9617b5270", "value": "T194648D4382E13D41FA266B729E2FC2E8765EF6518F5D7B692119AE1F04F21B2C173B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682571818, "uuid": "901f5d02-0684-492d-966e-80b819253ea7", "value": "aeef7763af0e2894e4991dc94400d180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682571818, "uuid": "dbc7447d-f0b7-45f8-a498-6c2ba53fb345", "value": "6144:B2sVK4VHEAOqec36ItOuSe4if2CGzUdjJ1s8F8gU:gwKGVOqe5EnlLrs85U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682571818, "uuid": "29116bd2-9150-486d-9cc8-f6cbdfd9dd45", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682571818, "uuid": "7dc59432-68a4-454e-8d37-4705e0254c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682571818, "uuid": "e4eb8c48-90db-4923-b7b1-6d2a5fb494e0", "value": "26c12aba3b5a115d120e72c7dd409d62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add05da9-e504-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682604377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604377, "uuid": "a8eba574-fbbd-4e6a-bcaf-95ccac58bb5d", "comment": "Malware payload (RedLineStealer)", "value": "d8a38f728dcd6112b1095edd3c578c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604377, "uuid": "4a844f4a-db10-4ed6-8979-f0b9a1a5411a", "comment": "Malware payload (RedLineStealer)", "value": "e785fbd9596fe5d624315f7c710a618a8f9d7c6d4784c72dcc0e3557b9746f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604377, "uuid": "14e713c4-92b0-4493-84aa-14a63bda39d3", "comment": "Malware payload (RedLineStealer)", "value": "41fdb5a342deed100be6f8691796f9d23fe141cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682604377, "uuid": "ccc5b230-ba52-42a1-96af-8688f6530dea", "comment": "Malware payload (RedLineStealer)", "value": "708bd33a6756ef2cde31c34ef062b72e6190887b2b28b991f329d76e10c847ca3dbc854739ef8eb61d2ebf8e6ac3cd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604377, "uuid": "293fca6e-f630-48b7-b4ca-28cece5980de", "value": "T1C884AE03A3E17C54EA664BBE9E2FC6E8761DF6114F19776D22189E2F08B11B2C273351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604377, "uuid": "4c8ad4a5-6380-475a-9c0e-01a865e21bbf", "value": "3b1217408d4bba412a22718d3068dd73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604377, "uuid": "ec25c655-849b-43b8-a109-40f941e5f475", "value": "6144:0cTNwfcvv/HCoihs1kv5pbSyaHrqVmYIo3dLLpxMNF9DrLMTNv:0Zfc3/HMsQ5pWZLqRIadLLpxoF9nwTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682604377, "uuid": "d32ebb24-5f85-4370-9737-caa767697efd", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682604377, "uuid": "6b3db3dd-2a2b-4d56-8a30-20123ef9ab9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682604377, "uuid": "ca8412c9-b4e8-42f9-94ba-585a2fadb9fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6b0511-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597157, "uuid": "b085929f-fbc8-4ac9-8f2c-4bbe4e05a2c1", "comment": "Malware payload (Mirai)", "value": "615bdfd8555fc7a52e3e82ffdd5747b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597157, "uuid": "bfa4988f-637c-4421-8bb9-59764c702d90", "comment": "Malware payload (Mirai)", "value": "e91a96d2007efda539d64ba279815526d96e5279240262546f489773b84dc8c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597157, "uuid": "195b1397-1249-4071-884b-a4cac11e2801", "comment": "Malware payload (Mirai)", "value": "ff156dcba434b1b1efc4355a5939c6f497ee922e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597157, "uuid": "6047e86a-2b82-4ccc-a506-8b328b97be17", "comment": "Malware payload (Mirai)", "value": "8f3e9f5cd3a0286b919dabb736a409bfe8afab072eba6792c2e5e8268e2138092c600e600fbbf6c82c963f97e529ab4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597157, "uuid": "60631197-3a44-4748-b921-6179e3eb4a3f", "value": "T17F14827AA7615FB7D80ECE37019E4901188CDA4B12D92B6BF2B4E518E79BD4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597157, "uuid": "8d490945-19aa-424a-be45-58dce53e7b43", "value": "3072:ooIR900aTESn9teFTmlaI7xOHDDTlPWDyaejZh:oowVSeFTmR8DDTlPWDyaejZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597157, "uuid": "bddd6234-4282-4cbe-bcfb-8355d8de4aab", "value": 204660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597157, "uuid": "e06be0f9-4e69-4df0-9cfe-ea810db2bdcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597157, "uuid": "97e857e0-7b59-4386-93b5-808e6db792ae", "value": "615bdfd8555fc7a52e3e82ffdd5747b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca274dbb-e4bf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682574789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574789, "uuid": "3310d6d4-c9e6-4225-91e7-65df60d98002", "comment": "Malware payload (AgentTesla)", "value": "143d88cd3fc127fad6b63fccfdf880ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574789, "uuid": "c103e037-741f-4f60-bdfc-008bac88e989", "comment": "Malware payload (AgentTesla)", "value": "ea040b1b5f2777c07c5c620f3526d9ef9257e594911245713a2e6457de238160", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574789, "uuid": "51147f04-b0ff-44cf-b69b-f60887eb10a9", "comment": "Malware payload (AgentTesla)", "value": "bb4fe2fe65e731596a5fef00644454c6f42f1b37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682574789, "uuid": "b53a81e0-f386-48ef-af73-56829b288545", "comment": "Malware payload (AgentTesla)", "value": "3ba5fc79989397a10af82aa96e36498767993ee7a4299dc4317e71d71f90b2e9155acd1e1cbbc501aac69eac0a2d5fe0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574789, "uuid": "e49ac9a5-8a30-4b68-b955-8aa6900d1eb2", "value": "T1CCB46A3DA9EE89E6D179F2B5CEBA8821F1A3C56372519D3965E702054243EC335C02BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574789, "uuid": "c4ca5f13-9045-4b86-8794-15838950b931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574789, "uuid": "7ae5daf8-792b-4bef-ab08-295aaf1cd0a7", "value": "12288:lJBo1Q2iNwnjqyBoj1TFSu58jReI2HUm+hGWKHGLG6zh:/1WVKj1TFS1QIgqOxsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682574789, "uuid": "54fa04e8-928a-45d6-866c-360d951465fc", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682574789, "uuid": "6be948de-e1fe-4022-a2dc-a27b34e357dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682574789, "uuid": "30ec0902-934d-413d-b125-d17aa91c76a8", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f448c2d6-e4fb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682600630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600630, "uuid": "adf2d405-789f-460a-8213-64f6aa8c76f4", "comment": "Malware payload", "value": "6f1674e8c3136544e5a6195e407661b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600630, "uuid": "39c66ad7-43f5-4a9e-ac92-84e30816f9e6", "comment": "Malware payload", "value": "ea4ae17380630b5d401502c36c18d9a5364b6e44b9286046a30df611d103ce6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600630, "uuid": "e8491636-f60f-41a0-b981-97b6942ea044", "comment": "Malware payload", "value": "d0a00241ffc74e7317c14cdf8cec7a48e2b36623", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682600630, "uuid": "d17c88f9-4e8f-4d22-af3f-7dfc18e27880", "comment": "Malware payload", "value": "87c4c3f6bbd796a5bfeb931d4819b31469920e473ccbb096dcea43d625265dea6438ef2b228fef00410ebb3d9e340a81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600630, "uuid": "ddfb436d-4d2b-47f6-9750-a6b4f4208197", "value": "T115E20B5AE74F02B48B510273671E1AC9AABDB63EB35154B1346C933433EDC2D427A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600630, "uuid": "5137b47d-6721-4658-9ba1-154af9396ccf", "value": "768:YbFx0XaIsnPRIa4fwJMtRBTkTLzuvgWzyBcVow09l1T+J:Ybf0Xvx3EMtHTkTLivgWzyXw09l1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682600630, "uuid": "eb85bbd7-1e30-435c-89d3-d6bfd44ef2a1", "value": 31380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682600630, "uuid": "0c7a29cf-91a0-4851-90fb-5647d63df665", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682600630, "uuid": "d821d0b2-7455-4652-8ee5-7cd9c148a838", "value": "PO 20230427.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe3fcd3-e4da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682586127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586127, "uuid": "1a86a3f9-a63b-4fdd-b0b2-d1289d8f5755", "comment": "Malware payload", "value": "f78a39cabfe10c50cbfa7fc702d40538", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586127, "uuid": "adb3a3d6-0bf5-45cf-9800-105937edcd2b", "comment": "Malware payload", "value": "ea4bceb3df15541d335307a4c24db4829bcc7a0199900f89ba4a8cc55a7cf468", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586127, "uuid": "a4fd3212-3a53-4416-bed4-5a47f7652abf", "comment": "Malware payload", "value": "0b2dcde43a772b4673c6658afa05fd23a9e25653", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682586127, "uuid": "effcb997-17ae-4a3b-b337-852ddc0603c4", "comment": "Malware payload", "value": "4e145aa46ec4808146d6e544f9271b285b33622a923e9a31b2dec53e6f3c46afcd5651875d5408f17f710fd67c57fcf4", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586127, "uuid": "30f8e64d-c871-4c18-976b-91a8561e8356", "value": "T1B773028BDEA5C0473859213578C51BC7333CEC4AD1E8274A187EB11512E92D4B2DBE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586127, "uuid": "3febeac2-f87a-4ba5-b168-3c86240f23b8", "value": "1536:XP2OQzCCzPAZmMvVHp5bYhsoOW3wXhrl4FgeVl9vILZEG+LtdZ7+Ao0th0:X+OQ2SPAMMvVHp5shstXhrl4FHhALZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682586127, "uuid": "88401cbe-3923-4eb5-bb8d-1a25a7af5a1c", "value": 78260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682586127, "uuid": "4181e7c2-ff2c-4261-bb1c-eb2fe4fdea64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682586127, "uuid": "d28267b0-64d8-4a80-972c-3d687345e5e9", "value": "ORDER-230278.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23030ea6-e536-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682625619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625619, "uuid": "15fe5db6-7c81-4bc8-ac88-b8b5a9901749", "comment": "Malware payload (RedLineStealer)", "value": "eac580449a7ff0b06ad9ac7b76913d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625619, "uuid": "98b42cdb-a3d5-44e1-bbb4-efd65dc365df", "comment": "Malware payload (RedLineStealer)", "value": "eb59fb95f5f99db54c48268e0a4ec66771766c88d4cce0c511a1d86c6899ecb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625619, "uuid": "a789137c-c81c-4954-b86c-cc4f4324e655", "comment": "Malware payload (RedLineStealer)", "value": "10904b731911aa7a2062222ed8abacfc1cd3aa11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682625619, "uuid": "afa0ee4e-8e31-4b77-acc3-8c4ceaec2c2c", "comment": "Malware payload (RedLineStealer)", "value": "875ed18ea750f08d0654a74ad35df6ee88efbc69bfa885f0dd2e48d63b4541e91fcd5a4ea59d2b8dcdcb475b3f4b8d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625619, "uuid": "c4144366-f7ab-4176-b940-9002a7383665", "value": "T1FA4523617BC94176E9D067B008FF06820F33BDA5997682A7239916CB5CB2394B733367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625619, "uuid": "5e966d63-d79b-4aa3-b883-db8d11fad4a7", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625619, "uuid": "430bb9a0-942b-4af4-acc3-cb697a06014a", "value": "24576:+yzMW9jWPpw87gCw5qQxTA/wF95AO5qUW+a:NrGpw80Cw5RL95jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682625619, "uuid": "6818e6c6-a056-410f-aad3-b0f4579b9ad4", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682625619, "uuid": "bfa41baf-cd88-400c-92b1-9fb314746867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682625619, "uuid": "e0f8c189-2f82-41bb-bb70-33d142c3ea69", "value": "eac580449a7ff0b06ad9ac7b76913d9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65027973-e4ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682593088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593088, "uuid": "6cda6349-f60b-4f3c-82ac-16921492d5f6", "comment": "Malware payload (AgentTesla)", "value": "633e25294d72844ef52c1403ee051e95", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593088, "uuid": "c52d7319-4f05-4196-87a2-c00fecb8661b", "comment": "Malware payload (AgentTesla)", "value": "ecf8af88ed8d0c516d8de998dc5c18c4f1113c3dcf8bd7bc7963ced8b50313e2", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593088, "uuid": "5a553570-3c1f-482c-9aca-525814d8c5d8", "comment": "Malware payload (AgentTesla)", "value": "6f28eaebbb5c6c866f3d1b8472524efba3cb82f7", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593088, "uuid": "62b08ec6-b254-4683-9901-98e9bb46b851", "comment": "Malware payload (AgentTesla)", "value": "5946ed5c9bbd8af47a0a7db47a0832f491320c8ad70caa9b91d7283d60c3922d10cc20346469c126e45e8190084b3e86", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593088, "uuid": "4d3a90a3-5453-41e8-993f-952c2cfa9984", "value": "T182B423A76BF7F676A3043D712FA9D3E276B602E2A516E648108EF0C6B7785C0C143D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593088, "uuid": "bbd63602-66ee-4a42-a3ae-c7d999f9d6fd", "value": "12288:ulRf4KgsZOcJejjpq99PzUmHpDOE6V0dox+IGO:IP5OcJKjY9pzy0dokVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593088, "uuid": "207f5c84-1864-4168-90a4-4b594f92bf40", "value": 515909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593088, "uuid": "ca334b2d-3c70-4813-8546-16bc53dd7fbc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593088, "uuid": "06624954-46b7-4135-9f5b-15037fe97e48", "value": "RFQ 080323(MECH)NBIAP-23.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93024644-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682585434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585434, "uuid": "5a93a179-315b-41e3-a928-a2c340a24643", "comment": "Malware payload (Gafgyt)", "value": "41860ae736e21ae72be236e7c630261f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585434, "uuid": "2934953a-84c9-4b98-aad0-0d26e7644824", "comment": "Malware payload (Gafgyt)", "value": "ed1e4308a96c748f4261497a100dd8f54dac682afaca624c65abda72dcbce4b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585434, "uuid": "ecd65ef2-29d1-49fe-b245-97d6b906604e", "comment": "Malware payload (Gafgyt)", "value": "9149cdff1a3628b3a4cfc36809b8380858a38c12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585434, "uuid": "07c2f3a6-6ff1-4508-b276-5e9f4a50c9dc", "comment": "Malware payload (Gafgyt)", "value": "a50a650246525982143e1b2dd2a43259da065967e69c0b11a13e2edeeb62665c8e2cd24ceb0153beb3450cd4e63eee6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585434, "uuid": "a229d5a0-4358-4e20-81e4-3d9b3304d8ea", "value": "T106B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585434, "uuid": "fd5c1f1e-ff2e-48ad-a6f2-d26a4261f4ff", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwls/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPKsSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585434, "uuid": "d4804b7b-b59a-4e01-a4cd-4ed1c692b0a6", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585434, "uuid": "b1bd0982-c411-49d8-a824-dab5c0a9d62c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585434, "uuid": "6a18c076-4484-476a-880f-768bb1ab97d4", "value": "41860ae736e21ae72be236e7c630261f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccace190-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597128, "uuid": "2b83861b-4d84-46d4-8769-864542ee5f4b", "comment": "Malware payload (Mirai)", "value": "53d27ca34e6996d304abd6765092d4e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597128, "uuid": "0eccfb0c-8923-433b-a820-4f30c424f7a1", "comment": "Malware payload (Mirai)", "value": "ee4caa2e545a515dde16d588a6cc60ce16a479c19ea6517d8d53b5d144c16980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597128, "uuid": "e890c4bd-6027-48ab-ad2f-a63428fd0e84", "comment": "Malware payload (Mirai)", "value": "556237be8c483c1eee625337be4cca48809a2d94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597128, "uuid": "e06c57ac-1542-47fb-8a47-dd4f4269f833", "comment": "Malware payload (Mirai)", "value": "b95e521df48644367ad86ba568097ecd215b760e74d51d27a31e52afd4658c0cdf55e55e00f912b03c66ef937d42ce09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597128, "uuid": "d6ff08fa-5770-4220-b24e-45ef8cbe4415", "value": "T1ECF3C67B26532A23C0C9047201E30232ECB5DF9734B97797699078792F3AAE435967ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597128, "uuid": "57260ed7-d68d-437f-8927-c9978c6e0d6c", "value": "3072:95Ke38Vn32YtQLMUNPcvSrlZbD7YR4AftRaq+h:PKe3In32cMlYSzbD7YR4AftRaq+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597128, "uuid": "17ebdf92-37fc-43fa-8821-25194ba8eca2", "value": 171162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597128, "uuid": "096a38fd-fe98-41f1-97f0-08a4ed204722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597128, "uuid": "06273720-ec20-47c4-9ec5-12b31976c8b4", "value": "53d27ca34e6996d304abd6765092d4e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7246d9-e533-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682624350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624350, "uuid": "e38cf3bd-1b61-42eb-9936-c6cfa711047e", "comment": "Malware payload", "value": "cc537dd061f2b72949091cb78718245e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624350, "uuid": "6c532af4-73e8-41d0-8b58-23002654940e", "comment": "Malware payload", "value": "f087269c2d07ca2dbead66fdb0f5dae031046a379e644d9c8776256b1b3227a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624350, "uuid": "44e76451-21f2-45ec-acbc-ad458df27ad6", "comment": "Malware payload", "value": "c497492288452ab89258f2a7df5013170a9de6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682624350, "uuid": "b6124e92-fc35-4ab8-9c71-2e7404b5be4c", "comment": "Malware payload", "value": "a1cee158010eda98a61abc2bb1051baff25566d6c7e07fd2af8e51a2414882bd368ebc976584ee79a9b73ab813f3a09e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624350, "uuid": "dfbe5b3b-3b26-4089-8b6f-3eaec1f6ad95", "value": "T15EE533535ED32037F4E9CAB2B9A9D7024B2A35BA93305149A2D01FCCFE225F45662F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624350, "uuid": "674aba73-b3af-4697-84cd-2e9606a5449c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624350, "uuid": "6daff823-09f2-4c4c-b4c1-ccaed598de0a", "value": "49152:EGlJfsgtqB4lwh9YhqtPoTIYIwbh16CYAw1FtmVfrem6W7xpq5r0OYq+nWHygU:55tqylwbYsti3FRAFUVfrb6W7e5r0Q+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682624350, "uuid": "c7cfe6eb-4959-48f5-b271-66244247cfb3", "value": 3070530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682624350, "uuid": "ad1e58dd-5864-4236-9c34-1c956cf3e231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682624350, "uuid": "c9efc4e8-0e91-4296-bb8e-25934f394a66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41650faa-e52a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682620516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682620516, "uuid": "c3b284bb-11a5-4120-8ec9-623d4a1eb648", "comment": "Malware payload (RedLineStealer)", "value": "07e6b5b50d4add8fec7eb40aa3fafefc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682620516, "uuid": "aba7c2aa-d3d6-4d88-9359-8135125056c9", "comment": "Malware payload (RedLineStealer)", "value": "f0ff65ff911fb7c92ec0d3ca398cc0f4a9f4e8e28aacfdbd0110f42d926a9c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682620516, "uuid": "5049c0bb-fcc6-4c2d-bc16-b126d17c97e5", "comment": "Malware payload (RedLineStealer)", "value": "b08e5d4b451930be76bff9a282d292052f2d36ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682620516, "uuid": "0c1129a2-dec2-4c43-9744-c188fe9bcdcc", "comment": "Malware payload (RedLineStealer)", "value": "8c77163b18cd20bf1c2716aadd9965f4a21879c40e3133cbb052503eb103cf523a94274ccdd8d594f38f838d68795bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682620516, "uuid": "0a7b6172-4b03-4fca-ac8c-a940e6d78574", "value": "T16707AE03674C42F1E52AC9BC5DD48660B9B964313B9F91DF7748135A092E3F1AEBA30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682620516, "uuid": "254ed35c-d168-4c48-9611-f35cb0bd8f6d", "value": "92c78975352dc14751070ec085bed292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682620516, "uuid": "1c0aea14-6555-4ab0-b43f-b44001377a8e", "value": "6144:hSy8mwWjL3dtx6nyDVsOq8w3M8K6qxbylIN1coX:PjL316nyDbw3M8KRVjco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682620516, "uuid": "1ca6108c-45ac-4214-a0b6-ee223bca60fb", "value": 18152096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682620516, "uuid": "d694fe5e-613d-432a-8435-f46f85ba6874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682620516, "uuid": "f44fca5a-ff06-4656-9dca-d941cbb4f712", "value": "07e6b5b50d4add8fec7eb40aa3fafefc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54423617-e4e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682592631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592631, "uuid": "322dd915-5846-4fb3-a191-e89e2d2e084f", "comment": "Malware payload", "value": "8cbef0f655b3f253ee39c71acfd049c2", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592631, "uuid": "21350477-4060-43cf-97b9-a104810b9b1b", "comment": "Malware payload", "value": "f20f33ec9982f5086e4f301bae584471d0af8e39724f75b28b1b9c19e5790e2b", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592631, "uuid": "6f236ff4-a048-4d38-8f45-ad9cd88bc24d", "comment": "Malware payload", "value": "aead53dff2ad033c389952f59e706aedf3de1c3e", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592631, "uuid": "13129a99-c3be-4e20-a450-8b226acc30e8", "comment": "Malware payload", "value": "01b17e3efeff44733731633dde053ee7fd5fb078912b83e23c084d4cae764896a72b4ff7912c285c1945e36983d7fa96", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592631, "uuid": "c1520c33-f683-4e17-bab0-527dbe9e3103", "value": "T11045F43C19BDE22BD1B8DAB58FD5842BF340E46B3115AEE6ACD647518316E1234C723E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592631, "uuid": "041becdf-7c78-4411-8a51-0dcfb27f5dca", "value": "6144:UqMjgOgWMmHO4rRiv5j2fMEPEjTGCudcfECfroNFnGoS2r3S7maaWi9l8ddvkkD2:ZWMm5iFAME8vGCudwECyG7maaWgTktQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682592631, "uuid": "0a3af4d8-db47-4c12-a51a-9788c325b33d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682592631, "uuid": "f7e82c7e-ea7a-4a57-878c-b2c8675e708d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592631, "uuid": "4eb16391-63b7-4063-9198-4e1933ddf0cf", "value": "Order-PO#1864.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4c6041-e4ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682579467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579467, "uuid": "3cf2cf57-a32a-466b-8325-4ca4f40fe222", "comment": "Malware payload (Amadey)", "value": "263c5126a2b3b2cb509a83785bd294c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579467, "uuid": "d4b0d257-2fa1-4e26-ab9b-7f2a0c9ee7d6", "comment": "Malware payload (Amadey)", "value": "f28c7307e05eb2dfe507711b29e0e0a8f270f7dfa5562fd8db7bc592c865d273", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579467, "uuid": "5f6e7ca5-422d-4061-903a-699d77d2f2fd", "comment": "Malware payload (Amadey)", "value": "a94cae85bbbd103e0defa9835c1ff63aa4d673c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579467, "uuid": "6c2a97fe-af1f-47ed-8ed1-441866f0b3b9", "comment": "Malware payload (Amadey)", "value": "59277459de59db8984e1455b6b154a1f0f6f156eb031c4df808842bfe5d66519843b458c517705356b2f9a3bdc5e7bd8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579467, "uuid": "53788929-e931-43a2-a234-fbad8c29b916", "value": "T1723523027AD49032D9F12BF018FB06630B7D7CE51E6897DB13899A8A4CB32D8953576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579467, "uuid": "bc23b4f0-f44d-4301-9fbe-6b1366f40ead", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579467, "uuid": "7a7420f8-e8af-4e85-837f-c9a599b1e1d3", "value": "24576:ky0wBBanqioMCRKuMcVtv5H2WO3ByaG17g3wU7NwJn9KIiUNZRMTTqO:z0s8nqioMoKwVt52NBygwU7NwJoUzRMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682579467, "uuid": "dd8812e4-3ac9-4e0e-8343-868fdc856505", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682579467, "uuid": "d1533e46-210f-4e7d-919e-8becea94ae56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579467, "uuid": "da588ec8-2347-43dc-a9bf-239291b8f934", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6674345-e4c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682579159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579159, "uuid": "112ae71c-0f4b-4869-a499-986ab950f349", "comment": "Malware payload", "value": "4aa0e039d2e050ba5fd4b5300f8e8050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579159, "uuid": "2a48c2a7-bb17-4783-9d4b-73d73fbd50ae", "comment": "Malware payload", "value": "f50a1f6a4a18f16169d39eae603f6300def0c4c8a8f6ad8807686f243e836314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579159, "uuid": "131a39b8-80e3-4a6d-971e-239ec18cec78", "comment": "Malware payload", "value": "be9af96373f7186be8ac46fd2beee71b2a8521ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682579159, "uuid": "f0f1bbc8-52b4-4423-b719-8fdcf78d776c", "comment": "Malware payload", "value": "7ae0b782f10d6c76788f15d6bee717dbaafa25dc2c2931f49d7d498fa9cde36861f286c8845b85a74ca6406347528325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579159, "uuid": "aeb8ad09-0e52-4503-94e3-1ff104a3d839", "value": "T107646B91B2D20CE1D0368238C4E28954E676FC258B6067CFB35CB23E6F367D1A53975A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579159, "uuid": "17454a92-17ee-4519-85c5-8bffb58532c4", "value": "ad11bd4ece5b8c1c6b17256b291c3295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579159, "uuid": "44c68161-948b-4bd2-b1bf-5902f94d8b00", "value": "6144:yQRSmtSgjwpfETO6vBn5KNXAy3Odjp1w25KNXKO:rZlNi6TKVAy3OdLNKVKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682579159, "uuid": "e18c46a1-07d3-4cb6-a2b7-a3a8e03ab281", "value": 320352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682579159, "uuid": "fea57a52-b4b9-4765-b4d5-cf8d91889902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682579159, "uuid": "2b62a05c-784a-4fdd-a526-0a5507d26db1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6342df5-e4ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682594916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594916, "uuid": "3e29d644-cd6e-4257-9a86-19da3575b9ea", "comment": "Malware payload (Mirai)", "value": "0ad1d416b24a171ca364d7e291671d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594916, "uuid": "ced9fda4-1498-4e07-a0b1-311577e1cc1b", "comment": "Malware payload (Mirai)", "value": "f51d75ee7f39538cc4f9b233230c6bf20f56a2d3b175b01fc1b0d82884bac2cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594916, "uuid": "55701eb7-8667-496d-a5aa-9e18604e5a0e", "comment": "Malware payload (Mirai)", "value": "1be57e4459207c9d650b9c65eb359975a5754e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682594916, "uuid": "8c3dd2c0-ca45-40fb-9a47-59efce097363", "comment": "Malware payload (Mirai)", "value": "fe7a513bdf79a539dca27e21398fb3e6dd77bb53d2482d461f7ec24998a1fbc101e979e167184c75880f53898e418a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594916, "uuid": "51a10aa6-8c6e-4dbe-944c-95040fd4a68f", "value": "T110436CC4E743DCB2D8171631107BAF37BA72E6E81224E746E7A8A636EC51702D017E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594916, "uuid": "d4ac9982-e3f5-450e-bf0a-5eb9aea3377f", "value": "1536:7sV4STUx6ghctVlOOPvUDw+NF4ygl8s0ih1Fr1tBwbZnG:7Q4STUx98VldvUk+NFD48sFrnnwbZnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682594916, "uuid": "b40d4bec-b7b5-47a7-ad6a-f9d8317c2cba", "value": 59056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682594916, "uuid": "72260bdb-b051-4ef4-9644-265c73c90d96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682594916, "uuid": "4e667668-1c72-4182-a144-7386f8ee2058", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8053617b-e4dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1682587121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682587121, "uuid": "246e0805-a791-4421-acf0-67fea37395a6", "comment": "Malware payload (Smoke Loader)", "value": "37cba474938718a98d6a50455f48d65f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682587121, "uuid": "5ea6c24f-0cc3-46e0-978e-0075e04b354d", "comment": "Malware payload (Smoke Loader)", "value": "f56e0bf106d8ffe6931b40fbe3623b364c071488118ad8f9f9f2dc29ecf778d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682587121, "uuid": "819f5445-d81b-4ef6-b28e-55f715cd5817", "comment": "Malware payload (Smoke Loader)", "value": "f91cd2a7b908921567d10921ab7e89dde8edc1d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682587121, "uuid": "8fb21492-d835-4403-a08d-50697e6641ac", "comment": "Malware payload (Smoke Loader)", "value": "6aac761f1183e42d994fbefdb577462ac3457203284909b772c34e0afa08d95f82152131443866e6beed8276279d2c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682587121, "uuid": "3729b914-b86a-4c0e-a0f3-543397150dec", "value": "T1CD241A4392E23C55EA268BBE9F2E82F8761EF6504F59776D21199F1B08B20B3C173741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682587121, "uuid": "cb630beb-d218-46f0-9790-f7463a2860d5", "value": "958f32b2db4437f7a0509a6814224698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682587121, "uuid": "788545bc-fb7f-4e2f-a518-5ff5382c9200", "value": "3072:BDgJTI0bmVeV3pbX2ciTVYp+Is5qFekpvISk1F5KnLPNvs:lcI0bMy0cR3s6DpvIN1SnLPNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682587121, "uuid": "a1ca117d-6d90-448a-916f-1d28796c2820", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682587121, "uuid": "c99332d4-b094-4a66-b8b0-7cf881244a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682587121, "uuid": "765e8547-e98a-4da1-9ce4-cc2cf978a5c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b82837-e4d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1682585419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585419, "uuid": "06d75ee8-2b46-44ab-a273-cbae91c0d900", "comment": "Malware payload (Gafgyt)", "value": "f5ca5405c3d096e8dccbb76d75aa9feb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585419, "uuid": "fbf28de6-105b-433e-9402-263971f3badd", "comment": "Malware payload (Gafgyt)", "value": "f5a0b33b81ed7753bbd3fec1f1ca1b0f6ba358f9dfb2d33b0f708f30f529f1c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585419, "uuid": "03575fc3-e987-4f72-9be0-1a12eb56093c", "comment": "Malware payload (Gafgyt)", "value": "9f49e4e8f59376b7a2ae31bebe35dd3e6b356aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682585419, "uuid": "609a0598-2533-40ce-90d0-1015bb4611a7", "comment": "Malware payload (Gafgyt)", "value": "59847eabda9d288f99fbe01c1e67205cb75d74ba3fc3e706814f4f5312d5ab6abe903d21e75f7214161e9129a879b686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585419, "uuid": "44a07bee-c7d2-4e6f-ba1f-ebf6fcfd8183", "value": "T1B9C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585419, "uuid": "571b325c-afa0-4aed-8d90-5ec7fae2babb", "value": "3072:H63VpNeuWDGeQf8sRCxt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCxt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682585419, "uuid": "c1691db2-f361-4b8e-9f42-4a38b2023b3c", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682585419, "uuid": "89e5316c-f48f-468c-899d-01797d33e733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682585419, "uuid": "697073d0-2943-4c3f-a111-bf5587dc8bde", "value": "f5ca5405c3d096e8dccbb76d75aa9feb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd6d6c3-e4c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682575947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575947, "uuid": "2bd3237c-f0be-4f93-853a-2748dad7bbcd", "comment": "Malware payload (AgentTesla)", "value": "ad3aacf6f8e0905d67f88ba2c31f69d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575947, "uuid": "582390fc-4608-489f-aa67-f42168a9b631", "comment": "Malware payload (AgentTesla)", "value": "f77c28f545a934ce820d6f8825455540e032bb0bc19d81100dc5c6ea4a349114", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575947, "uuid": "bae14d09-22e6-47ea-a75a-13d72281c4e0", "comment": "Malware payload (AgentTesla)", "value": "3a867a2b0e24f98281ed5138866adb0b9bcdaac1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575947, "uuid": "59602e5c-ce8c-45aa-9673-63f48d4a1eae", "comment": "Malware payload (AgentTesla)", "value": "5d5676e1f3a40f54c8bfbae8daf985649040754b2b14c3d4b8871fcbac1a18292a25177df062d5242d72fed6031609ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575947, "uuid": "4287724c-1ec2-4f66-8bab-c5b5e960f1d6", "value": "T131B46A3C99EE89EBC274F1B5CEB98861F5A3C5637251893969DB02445603EC336C42BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575947, "uuid": "a0ecacaa-f2c9-43ed-a978-62f954e3e149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575947, "uuid": "70cfd6aa-b8fc-4d6b-9703-47e79d1fa7be", "value": "12288:IQ/ZfsqjIxTvEOVz329xVUoLSYuZEmaOh:T3IVEm729P3LSYYqOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575947, "uuid": "f0f17ebe-733b-4b6b-864e-b1f185edebca", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575947, "uuid": "a23ce922-f4d0-4afe-b840-666ccd36b239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575947, "uuid": "4f055e86-36e8-4a94-9cba-8cbcbb7aad12", "value": "Urgent Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205fcee9-e4c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682575364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575364, "uuid": "91511238-880e-4f5d-8713-3e27662965b3", "comment": "Malware payload", "value": "5c86246bb2aad07c08299918ffa83350", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575364, "uuid": "74607eb4-f18a-4e85-bce1-d4c2f71e05b2", "comment": "Malware payload", "value": "f7a331edf950c889c61ece788c8e8d229c2241e31717c4ad4994497a14a8a5b5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575364, "uuid": "d415d8af-37da-4ba3-9c3d-aba37c05a1eb", "comment": "Malware payload", "value": "7a223bab964f2d45f5d40dfac3725c3cf06c31eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682575364, "uuid": "830ce143-cdb3-4b20-8efb-6abf7d2fc0c5", "comment": "Malware payload", "value": "9bb16bf1c818acb08e72205c49bf804973ca7d99c7664e3a92d476492714788b7e164c9235de1f2c1df91f3177e25f7b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575364, "uuid": "91bfb94a-55aa-4245-b5f5-745b5ba8e668", "value": "T1F153D0F8674170B4C5B24D72B507A78433252C05D2D1DEECBA0EB79A5AC29674F13CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575364, "uuid": "5ff4c615-f495-48bf-886d-d4d787d6810a", "value": "768:D1HwhLRJEE1MfD/9HHdz/bBG54N4YxHh8HbYbAZcW3CyWcZonDdDW5tQqht6:ILRyxbZlc4WY5iHuAZcsCybCDA5Gkt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682575364, "uuid": "6fef0d19-7b13-44a3-a365-b1033d28b578", "value": 62077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682575364, "uuid": "81cee7c7-41fe-458d-ac23-d121d8b95698", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682575364, "uuid": "8c30defb-8724-4a25-aa25-1dc463cafc61", "value": "SICF Meeting.Minutes.2.23.2023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b3329e-e490-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682554319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554319, "uuid": "6d323770-38d7-4d82-bb73-e621d4298dd6", "comment": "Malware payload (Vidar)", "value": "ecc795aa362834ab21058cf673022207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554319, "uuid": "2fcb9f5e-b2a6-46c9-9ae0-7de6ea57f910", "comment": "Malware payload (Vidar)", "value": "fa3dc6c4c0ce44fcaf84b68d5578976bd0f6c5ace4a4c57d6a9c39d2ca5eab47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554319, "uuid": "d411b6a3-e93b-43fb-9e6c-6fd320b85414", "comment": "Malware payload (Vidar)", "value": "95176f46e96b637bc1152bcf4c66e5e18765ed4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682554319, "uuid": "5c461a5c-8359-435a-bb4d-672aa4b941ed", "comment": "Malware payload (Vidar)", "value": "67660ac2c250438d78daf39fae933e6c2f5d3be762849a6fa0ee1c6cc75073984ac047df18747d646d18af5385209a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554319, "uuid": "e8b8d79a-d1a6-4dc8-b675-a53844c193c5", "value": "T15C640292B6A2DC72CC5745714401DAB4A91EAC21D798869B337C3F9F2E30B928B76371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554319, "uuid": "d6536a27-860f-45dd-9886-7789afab8151", "value": "4b07758d5b167b27106e05a1732f0848", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554319, "uuid": "e1968031-ab76-406e-86db-523f54a4b21f", "value": "6144:W2Pt4Zx6cntuRCB6CSc6R/JIUNSRQIwfYzaq4p4gU3:W2Pt4Z3cRCB6N9/JIUqQqz445", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682554319, "uuid": "a828ae9a-f112-474f-ae06-79ea58cf9b47", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682554319, "uuid": "8ac38aa4-9fd0-41e7-8ef7-a983796f04f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682554319, "uuid": "18fedd69-a27b-419e-80fb-009176ad8718", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca8a32c-e4f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682597208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597208, "uuid": "bf19a421-67eb-4c91-8612-bf4733774168", "comment": "Malware payload (Mirai)", "value": "4097f696317628eba14cecb85f77d20d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597208, "uuid": "0408805c-57b5-4caf-a952-97284c4d964c", "comment": "Malware payload (Mirai)", "value": "fb8b2648893c0dfb3e02e3728c4cfd4d0d758f70dfcfe7db8a96b0e117cc6684", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597208, "uuid": "6e0b122f-4b10-4909-ba02-00b1ae2b6bb1", "comment": "Malware payload (Mirai)", "value": "feba749f1c0a32bd95567af059bf519e011b31c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682597208, "uuid": "87ae93b8-05e3-4648-b873-5d93e890cf38", "comment": "Malware payload (Mirai)", "value": "e41e576e9c0acea2b5e8fc9aaa9ee5ba58ab18f4f828e2d2666c30f9ac9fa6bcf1ba927a5685fe8cd1079e658ee212fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597208, "uuid": "5c199ad6-55e5-4418-adf6-61ab56b26297", "value": "T1B693C519BB511FF7D89FCD3746AC1B01388C958622A93BB67574D428F24B24F15E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597208, "uuid": "728daa0a-7d3b-44a7-97a1-d77a3ae3ec8e", "value": "1536:NUYHK4GHWD+ozBqG3N4SfxMW4ZXH1RQVkwJtwbZnr:NUYHXG7w4SfeW4RItwbZnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682597208, "uuid": "82df4daa-88b9-457d-809a-a18f50d9ea04", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682597208, "uuid": "1aa89873-50b1-425d-9056-939babf2d5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682597208, "uuid": "89a13bd4-f626-4403-903d-aa7f9f01d0c2", "value": "4097f696317628eba14cecb85f77d20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d5b329-e4f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682598358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598358, "uuid": "4c050de6-4287-4585-8f5b-a50d30c8e958", "comment": "Malware payload (Mirai)", "value": "e449d3ec036f68c97a3131055f6d974b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598358, "uuid": "0ec26a9a-0e2b-4851-9b21-6a317498667b", "comment": "Malware payload (Mirai)", "value": "fb98c84c4ad30f0de4ce459bcf71a34ccccdbfe70e784074b3d8444a2bb67281", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598358, "uuid": "9d8db589-2833-4e64-b558-62fa2d9401b2", "comment": "Malware payload (Mirai)", "value": "8c4b67ec6b17cf3817eb91d85912560b04f01bce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682598358, "uuid": "5dab74d9-fece-4562-9e67-e36de4de31db", "comment": "Malware payload (Mirai)", "value": "25b48cd23e272eaa0d425b4c311d095e9713c30a0344960cdd0f1c62fc1ff1be1d735fd39b72d2f3df781cb00e422081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598358, "uuid": "623b7be6-5049-4fa9-a3ae-84aaece1bb7a", "value": "T1E0E31AB6F920DF66F40B973A04D34B25BE70BFE30B532522731B79A69D362D41826E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598358, "uuid": "21163b38-cb95-4405-898e-787e3f11095b", "value": "3072:jsYcb1Am2IZZ/FlCp5jUyK6Oy7Gr5I28DwYR4APtRagXh:jsD1AmJjlCfjUzy7gn8DwYR4APtRagXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682598358, "uuid": "0cfd779c-0720-462c-bcfe-11fbff9df2a6", "value": 145370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682598358, "uuid": "fc24d41d-df27-45cd-a4b1-d63c8cc5ecb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682598358, "uuid": "8bc6494a-5a6b-4628-85c2-81792fce20b6", "value": "e449d3ec036f68c97a3131055f6d974b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515907f5-e4eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682593485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593485, "uuid": "5cf3c34e-b859-42e7-80d8-8eebb379a29d", "comment": "Malware payload (Mirai)", "value": "aa5f59b5b1ddddc4166b79b9e35ad2fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593485, "uuid": "b4b07784-2da5-4ade-ab3c-b6ec555809ac", "comment": "Malware payload (Mirai)", "value": "fc4d7f987cbf740e5b2a18741dbafb255feef0ab48aa8b50c91e9cfcf728a57d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593485, "uuid": "70c5ff8f-b11b-468c-b3bb-1970b3a1d48f", "comment": "Malware payload (Mirai)", "value": "f043bc6d5447a61fd61e5f1173ff0f250156e222", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682593485, "uuid": "39276171-070d-4cc8-a10e-d8f017cad905", "comment": "Malware payload (Mirai)", "value": "3d6344a783a68927fa270457783bbd810fea7bafa8b53fdbbbdcbcb875a1b1a6b568d1c55a05948932b949a8218e43b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593485, "uuid": "98b0a2ed-7573-4c15-b0ec-08812cdf70c0", "value": "T1BF24F834E650871BC2D237BAEB8A424E3F324F9773EB36094A3476B43BD1B695D22511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593485, "uuid": "22c41ddc-e9f9-4d30-9611-25097cc8890d", "value": "6144:jg3ULHp2atw3S9arg0ozPw+/SGM/9A9Wmvt24yFJkWXi:jhLHp2atw3S9g2zDSn/gWmvt24UJkWXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682593485, "uuid": "27bda9c3-0d75-4e34-907e-b1b227878371", "value": 216411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682593485, "uuid": "66e5836a-d89b-47ba-8d1a-be873c583593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682593485, "uuid": "5ffb619e-99e2-4a88-b3a5-44cd1f0d07c7", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beeda6f-e4e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682592536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592536, "uuid": "5f16f148-12fd-4fa6-84ec-78abfba8077c", "comment": "Malware payload", "value": "d6ca72036582dc30495249924d120a72", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592536, "uuid": "a7e49c77-b0e6-47b8-bcfa-c4735e548794", "comment": "Malware payload", "value": "fe71a81d0c520de551f804e7865acad3f1f4d663efdb224a7296da1e35daa642", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592536, "uuid": "4835be27-b719-4939-97f3-9a54bd697dfd", "comment": "Malware payload", "value": "2431718f833d069017cecd9183c04bbe0ff33bd6", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682592536, "uuid": "94c22642-7764-4414-b494-9b769d968394", "comment": "Malware payload", "value": "aaac73340a99bb518976453eec41f70899ffa234bf914f2ece92c424db7b11fd36f9ddc5734716411cc093c447f5982c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592536, "uuid": "673f4d66-17a6-4880-9fdb-1d3e3652fd42", "value": "T176A5017B7E43FDE9EB750CB4D4C605254C8068BB831C60E4B8D8B7AE93E5854EA56CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592536, "uuid": "d1f93b59-06c7-4aab-a269-e753ac914e06", "value": "24576:ursUxXDsKyVTAUGyHbFcwuqTJFMHgBKV8ZW4psRIHNRB8nPeM2zypUrIQdzBI3VT:Ssg2++MQZRmmHNRyPdB1BVJtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682592536, "uuid": "992b2d37-26c7-4ffe-ab4c-7fadac99a6a9", "value": 2230272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682592536, "uuid": "c5ef6042-2e0b-4f96-9a73-c8708dd6e2ae", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682592536, "uuid": "70d212c1-d25a-4f8f-8e8f-7941adad8a1d", "value": "PO7535522.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }