{ "Event": { "published": true, "date": "2023-02-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-12", "timestamp": 1676246582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5bcb11fe-471a-40e6-b561-3f69a43f7943", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee106da-aac8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676201334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201334, "uuid": "b624094a-2091-4c78-9fde-4f51add28b41", "comment": "Malware payload (Smoke Loader)", "value": "976e1273503adb826ae43afdafbba3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201334, "uuid": "16325170-56d8-4d12-922b-4bdcf8d1f4cd", "comment": "Malware payload (Smoke Loader)", "value": "00b78edfbeab7f9329e51baee0281883a71764b3d0dd521ad903a9e055ce57e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201334, "uuid": "df4f1408-a78d-4d68-839c-102c2dad34ab", "comment": "Malware payload (Smoke Loader)", "value": "e4f18133d6e8d3d062ecb683aa282857ed87c857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201334, "uuid": "8db466b9-e582-4d9e-90fe-eac57e1f8134", "comment": "Malware payload (Smoke Loader)", "value": "8855d10cd7728a0d97ce7d566b78aa811a7bdeba213f7274f9d7b9cb6523213d00d6044b4d4e14383e3424d2e926ecd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201334, "uuid": "416b9e4a-f951-403f-9dd3-662d622b3c09", "value": "T1A214D012FBA0D072D19F49BC5920DAA46E7BBC7157A2C0CB234806AE1FF07D15E7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201334, "uuid": "e322ba75-e64d-4aa2-bc3e-2157990f5429", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201334, "uuid": "66e3a8f2-51d1-42f9-ab87-b454294d7984", "value": "3072:GbDT+FSj1Rsd2QmZoaoKa+EjvoRATbwf0HDhvxvhSw8:ofJIsQWoZjARATbwf4DhpvUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201334, "uuid": "f4b075cb-354b-46b8-923c-3502fb6f7958", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201334, "uuid": "83c7a7c6-3099-4045-b119-1260c2d12ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201334, "uuid": "70ff05cc-eaa8-4690-b9f8-3d03e6751806", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c03e47-ab08-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676228669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228669, "uuid": "cd2e7110-fd73-42f5-88b5-86209c7a99d2", "comment": "Malware payload (RedLineStealer)", "value": "c65bca3187055f7e3d9ef433a54608d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228669, "uuid": "1e5046e7-04bf-4647-b2f8-bceece104928", "comment": "Malware payload (RedLineStealer)", "value": "0143e6dc021cd5746ff4c791010a9168608970e7890fa4ae0479d6a72d75737b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228669, "uuid": "34084f04-96af-46e8-8bf7-94884a38e6bf", "comment": "Malware payload (RedLineStealer)", "value": "92d692f56bbbc593801d3f4e7e6c6d1316203d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228669, "uuid": "2c6d3b9a-e2de-45d6-970b-2686a4ef855d", "comment": "Malware payload (RedLineStealer)", "value": "27b4810f0795b27a6b605ade0edb0a664110a44d220979a5d991f5013b9d7ee0e5aa1579fc8ab21d175eeccaa4f1e20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228669, "uuid": "0757807f-0e45-4a50-b862-66c46dfe2d78", "value": "T19EF4120BBAD88032E8F547705DBA43C32A35BD529A38535F578F5D2D48732A0A235BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228669, "uuid": "e6181dc5-af5b-40e2-af8b-3918b7ff7a19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228669, "uuid": "c93e7cf8-eeb6-4fae-9195-94a44be439e4", "value": "12288:NMrxy90uFlUa0T+b+699MWxHrYyeJaE2NN/a5RJOfVq6Xmlgz:syOa0Tl+FxLia1NYRJ6qqmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676228669, "uuid": "80cf8782-ac40-4e58-8d5a-92cc6a21a444", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676228669, "uuid": "5a905e82-da8d-4083-b526-eaf38236f117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228669, "uuid": "15323db9-17e8-47fe-ac7b-63d0155f3a68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f0c369-aaf6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676220947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220947, "uuid": "36692bb8-ad50-426b-8c5d-c50c4d4c012d", "comment": "Malware payload", "value": "51ff75f6b4c9fae9c7102a2b075c141f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220947, "uuid": "8a211425-38d4-4267-a5f0-d92f6f6d6b47", "comment": "Malware payload", "value": "01e83081e3b4d0348d91f851b635afab5f132d05fdae96ed070abc5dab84f82e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220947, "uuid": "eb6d0dc8-6f7a-46e5-bd84-8f8078b1c5e7", "comment": "Malware payload", "value": "9dc8cea9c90c87af3b4bbbf33621cd0e141f8d38", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220947, "uuid": "bb62a321-0aac-41e7-8f85-15cb26f8c734", "comment": "Malware payload", "value": "02d2db7599c6e14f7b9253a9b25250237235c702bdf5b3162eb1361163bc329881d6ba9238e7427b5f5b37c153b075cc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220947, "uuid": "fd436926-3c47-499c-a4c1-3d69eb1834a9", "value": "T1C2945D17BA61F02DF553C4B0EAA592A66824AD361544EC1BF3C1AF4A31355D3A4F233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220947, "uuid": "254e5cf3-fda4-444e-959d-5a31f7608903", "value": "7bed3cf5261795440d221b269d33f79b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220947, "uuid": "baee6103-8f94-4129-96dd-1366b8fca5a0", "value": "6144:IDGMY7CArtccMIOjl323hRrc1Cbbzll6gNgSaBiXMzMHETT/GkM8d1/w5KA81IJ1:+GOmvaIQ4g7BsMzpGkfjYKkJj6GmZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676220947, "uuid": "ed18fe2e-d7b0-4ad1-a33d-d6a09e39b676", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676220947, "uuid": "fa34a550-3b76-471c-98bb-5fe4b41dc691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220947, "uuid": "20192a84-be71-4f5e-8666-061a27593e9f", "value": "boost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a184221a-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676229766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229766, "uuid": "fce19d38-7a89-43b6-adf6-bbf44ed9013c", "comment": "Malware payload (AgentTesla)", "value": "c48006308fea649b2418636bd55a178f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229766, "uuid": "862258f1-bd09-47f4-8ccc-577371df9156", "comment": "Malware payload (AgentTesla)", "value": "02ca90c2ce88953cd800366ae4c9936cb91c6bddd2361367b350b7a70e771e3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229766, "uuid": "8a67c1a8-ca6a-4ec5-a713-679737646a58", "comment": "Malware payload (AgentTesla)", "value": "7144985c79c6193e105542921682d24e0bd35067", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229766, "uuid": "eb2d9c3f-2d9e-4a4f-9f52-93fd235fb897", "comment": "Malware payload (AgentTesla)", "value": "ee16b186fb3be33d1a4a5f89a6d7708ce208cdfde738843cb8ff041284f8c39109e6fc0dcec85996aa57ec433ac0966a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229766, "uuid": "09ce818f-3048-442b-b9d7-e3dd93dc4a52", "value": "T1A42512E072EACAF1CD8D0A71C4F6483463F1E69A52F3D7587DC10270AED2790AE5D698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229766, "uuid": "dce99f9d-40b3-4074-88b4-3bf24f714067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229766, "uuid": "f7cba315-283d-4162-b748-00c57714b678", "value": "24576:hZueDDKQPSDe35LKzJmCFUnqrCec5m/1Y+TEo:Lue/335yFUnlec5U1Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229766, "uuid": "7b7ba7e3-1be0-4a92-98f0-9930fcb487f4", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229766, "uuid": "37be9afd-1ab2-403b-9c3f-f721dcd93332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229766, "uuid": "5b3583f2-835e-42e9-85a2-855e5ea3b844", "value": "c48006308fea649b2418636bd55a178f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae92702f-aa70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676163646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163646, "uuid": "c07b9d43-295e-4276-bf02-c5e4ccf76c17", "comment": "Malware payload (RedLineStealer)", "value": "5006e08f03d124428c558f7bfe273e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163646, "uuid": "3f24ff7b-792f-47be-acda-5ed71040725a", "comment": "Malware payload (RedLineStealer)", "value": "036e50df79f0682dc0362d7e14efdd0fafbe1c2a19cd76f291d1d9c3d4a51442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163646, "uuid": "b93ffc64-2eeb-4bfe-a349-453cba03f1b8", "comment": "Malware payload (RedLineStealer)", "value": "e72375cc52a0a5afa992a09815600caaa229ba4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163646, "uuid": "9f75bcf1-816b-4152-8395-180f5b401141", "comment": "Malware payload (RedLineStealer)", "value": "5d7366a3ed46d6ca685932d5662f08af37d64f691b2f6e70c06d835cb41397fc5086680570ded11db4b2879ca9025d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163646, "uuid": "566e8dd4-79c2-441f-874d-d4025d3fedf4", "value": "T17E54F01076A1CC73D4A249785921DAA5BA2F7CB19B9583CB3345172E3D303D28EF539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163646, "uuid": "4b302561-9c35-416d-8c3a-6b5f2298c45d", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163646, "uuid": "d2718164-80e8-44bb-acc4-93361070875b", "value": "6144:YGVRZx2ptZIktSkNvJScat0Lw/gaMQeBIpI+TtitIt6xDfnz:YGDZEXaox9OGdaFQgIPxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163646, "uuid": "2490f1b8-422e-498f-92dd-a5911899902e", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163646, "uuid": "d805f678-19b1-421d-9b94-16c016c6a9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163646, "uuid": "8e9a4e90-158e-4fa7-99c8-e2d3c8638303", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362eb426-aae6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676214124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214124, "uuid": "720d8102-2826-403d-83fe-fc8a6afbc56c", "comment": "Malware payload (RedLineStealer)", "value": "3c76e790522d2f249155abd372b33066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214124, "uuid": "41203600-0686-4f21-b839-4a5b9332a479", "comment": "Malware payload (RedLineStealer)", "value": "038fb0e98f5e917bd1cb54647244061bd7ede237f2f06fa239d98d6e4dac8a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214124, "uuid": "188ba45b-5509-48a8-a71c-40f37787be17", "comment": "Malware payload (RedLineStealer)", "value": "7a98a31de0aeb71a3c6951eadae4ca73be8adb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214124, "uuid": "6a1f6d94-c897-4cd1-b906-4f7c8a236174", "comment": "Malware payload (RedLineStealer)", "value": "f843c179d68a114379dd940def74b8accf17d9eadc3a42c8832b97fc8dc5c1a555a073c573f8184a6e2f6bcac01178ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214124, "uuid": "90232420-ed28-45af-865d-2da53837d5f0", "value": "T1B8F4120BF7EC4533ECB4A7B019F602C31A36BE516A34975A278F2D5508B27B0A635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214124, "uuid": "ef7e4068-f1c5-448d-8e54-7c7cfbef4596", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214124, "uuid": "db1c6880-7c06-4098-80dd-2df1856947d4", "value": "12288:eMrwy90UF6Zr05npiqxHKCic1ytodL4fbNeJizEhhiareqcLlI2+5:GyVUY4udFwSiii4cB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214124, "uuid": "702bf23c-2714-496c-88d4-34f128ab837c", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214124, "uuid": "e8da2625-5851-48d4-bebd-2666d6c76d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214124, "uuid": "a601be3e-ff6a-41c6-b786-3e054f7aa55d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0c213c-aa6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676162484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162484, "uuid": "c2c6e5dd-f6cb-474f-b748-e69192fa7e72", "comment": "Malware payload (Amadey)", "value": "a4ffeb58edd866f55cf799266340c9af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162484, "uuid": "1f3a392b-4785-417e-9680-e68b75629dc8", "comment": "Malware payload (Amadey)", "value": "03d8a88ee7eb507f130076717c8341cee4ffc735296848ea3741dba95b4a5e6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162484, "uuid": "ab6b8c6e-dc18-44e2-a8a0-273955c35140", "comment": "Malware payload (Amadey)", "value": "236933879f5d37c1970072884d6bd891d04568ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162484, "uuid": "70dbcc3b-092d-4ce0-80f4-71324b089bb1", "comment": "Malware payload (Amadey)", "value": "fb256f1916fb7765a68a4af8cc2975c352392bc39182515d05573c90725593c534c37f39958210243922cf1198acf13c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162484, "uuid": "c8404e16-b2fb-421a-88e3-9b95af0a0a84", "value": "T106F4121BEBE95062E8E42B7019FA13D31A397D614B74C24B678F7C181D722A072747AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162484, "uuid": "c091b692-30d7-4bc4-a782-222c3b0ad40f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162484, "uuid": "df17197a-bd16-4ae7-818c-418187a068a5", "value": "12288:qMr1y90NheNxSKsOPVE6axVVNFeJQF7Wxwovqhj7mPwCNqVkVQ86x7p:HyGAGKRPH6Hovqhj7mPlqVkQx7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676162484, "uuid": "26f46c10-6f0f-43de-a405-97e49cd02908", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676162484, "uuid": "18cac17d-00f1-4375-8bfe-0a7c661f7758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162484, "uuid": "e7dd6c1d-6c34-4aba-8c0e-fb81934cce56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894844c6-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212116, "uuid": "66160942-260c-4745-80d9-c65f8e58e7a0", "comment": "Malware payload (SnakeKeylogger)", "value": "30484c6ee7a191242dfdd4a76dcd4be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212116, "uuid": "6cfa893e-eb83-485f-93b0-f25fc90d9172", "comment": "Malware payload (SnakeKeylogger)", "value": "0430ab24edddf88e4c3da08c5cef8fa6ef133c535fb5b22a2374ad9f3c517960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212116, "uuid": "7b41f963-6d2c-429c-bfd4-c915058cc05b", "comment": "Malware payload (SnakeKeylogger)", "value": "ed1d866dff00604536be3e3c0b17efd8479569eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212116, "uuid": "4759ce9e-0674-447e-a6ad-b0864577dbc6", "comment": "Malware payload (SnakeKeylogger)", "value": "c2c860b3f11810d5d7d5a25c2e525876a8f202bf18c1a12c0d601a1cd194d1ddf3389fb9a64dabd5775b40eedac51993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212116, "uuid": "b963e81f-d42d-4036-ab85-577f06dc67f3", "value": "T19624028807F9579EE3F701B18928608353B482824524F833EE7AF4D59951FF2DAA3E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212116, "uuid": "3195f1eb-5d7c-4e02-a528-a2517b3d4cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212116, "uuid": "af7347f4-694e-4b48-b03a-b83988372487", "value": "6144:OuFDutOc6duxKLolSPNWdrQw1NLUGO4OOdQskTkMfoCDcg/:FFDutOc6duxKLooINLUoQsI7AE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212116, "uuid": "e09d5c5f-2097-4ef5-b8b9-c63f188c64b3", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212116, "uuid": "bd30bd9f-75ad-4ffc-b60b-ad11efac9593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212116, "uuid": "fa19c09d-230d-45d3-833d-1b4123726172", "value": "SDP0434578900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a94ab64-aaad-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676189758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189758, "uuid": "3f7649e4-ef55-4115-87a7-e9b6e601a76a", "comment": "Malware payload (GCleaner)", "value": "70dab4de234dccfca8f0044daa4aa5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189758, "uuid": "d8e05e5c-37aa-48a9-87e9-37830ed04de1", "comment": "Malware payload (GCleaner)", "value": "044cbbdfa6199557d11d2046bf974c3e0c78101017ddb963ff9cd9122c2036f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189758, "uuid": "9fc52e34-5e71-4791-a231-d9bc5e2f6f01", "comment": "Malware payload (GCleaner)", "value": "1464530c40f63306d55ddc5d3d91e7b35f7dd45f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189758, "uuid": "1bd17551-ca2f-476e-9ba0-09b8a7800718", "comment": "Malware payload (GCleaner)", "value": "dde54cdb6f4bd4604a66e64cf10b864e0ea8cd482b09da91d81c9f5c4ee9cf5585f66031271a93c11378cc1a55649854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189758, "uuid": "0dfae5e9-c61a-42f2-b630-6d24ff42cf68", "value": "T118F5127C7445C9ADC290FDB48C26D5E71CD66EF3E9E0A02270DDBF3E11B92899A0A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189758, "uuid": "64e024a7-94d9-4fc9-a1a7-9b52ea44280c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189758, "uuid": "f17bf8c0-3695-4cd3-9b71-142b599e6604", "value": "98304:JHS75f0T0517sqtDNCz5zUCaXJi3iseGgebv2MR:dGE051DtDN+5zUhXbsetebvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676189758, "uuid": "316db6a6-ab97-4ea0-92c7-964002b4e00e", "value": 3613531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676189758, "uuid": "7f81e52f-8f02-4650-be7c-3c5208355b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189758, "uuid": "069d5c4c-a96f-426d-aff4-d0bc5c3bd1ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc071972-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676212228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212228, "uuid": "012c2dee-8550-4b80-b60c-8edba5127bab", "comment": "Malware payload (Amadey)", "value": "5bc6fa35b0ce935255a6167c2e520774", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212228, "uuid": "fe200a7b-5e5c-4848-8ae1-bbd20aa7abbc", "comment": "Malware payload (Amadey)", "value": "049c94974a1a83a1aea0620a40c195020f0111328407ee977bc5daab505b0608", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212228, "uuid": "9f2b716e-9078-49ce-97ca-2ac65bd7b6bd", "comment": "Malware payload (Amadey)", "value": "3e94cf6a27e5830a586abdb9e51c1ee9a8d29057", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212228, "uuid": "57004bc5-6c01-4265-89fd-c667710613cd", "comment": "Malware payload (Amadey)", "value": "c7170522784f4b360abbd5199f99f9482d0c3b5d48039a8f1a49d82ab6650897f81288cd7d27ee6ee315dec9223276c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212228, "uuid": "7ad58aa2-4e60-40d9-b29d-17ac4b7dc750", "value": "T182F4120BA7E89132E9B097716DF342C32B39BD611B3842AF5B8F5C5D08316B4A53572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212228, "uuid": "bb06b47d-ad21-412d-a252-e054c63c23f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212228, "uuid": "f168a1df-5447-4a18-bbc2-23fb1a2bcf53", "value": "12288:RMrzy900mDjRv4QFNSZE413zVXeJTX6Yt8CSm7gaxb84aLLg8I9eF:uytmDjbaEOmT5t8CSIgae/aeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212228, "uuid": "ff4b1a24-c88a-427b-a233-3bd2df3885af", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212228, "uuid": "09f337e5-a867-43f4-9544-59285c47c8cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212228, "uuid": "1d121e62-d25b-47b1-90cb-c31bc0bd1484", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf447e1-aae2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676212634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212634, "uuid": "04801910-00b9-4b66-90c7-8c0fb4bb6929", "comment": "Malware payload (RedLineStealer)", "value": "374c04c530c8e3a4f82535e0be2c748c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212634, "uuid": "a7e1153d-b356-410b-a70b-d449c26758ea", "comment": "Malware payload (RedLineStealer)", "value": "05321f9484b678c42a2e08e86f0674093eeb69b9a2c47608439946601cf098c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212634, "uuid": "f211d595-7f19-463b-8b40-8bfb40f4bb8e", "comment": "Malware payload (RedLineStealer)", "value": "b58c9d12a052c2ee8fa1ca019b9ee8d1670306e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212634, "uuid": "36e2747f-f17c-4ccf-be8f-eac4de8af045", "comment": "Malware payload (RedLineStealer)", "value": "6fd2b11eab8452e5c122266c00d0e94b45b9e78af009488034731148d01899829e79aabc637ede29457624bc05a0dbb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212634, "uuid": "15bbc7a3-f215-4ef3-8ccd-fe42188545b2", "value": "T144355A3BB491C732D4A113330ED5C67137EAF8DC757988AB179A372B0A2319EBE12525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212634, "uuid": "d6e35553-d591-4e30-a800-2eedce0f3e24", "value": "0992ce2778ae787bb96d086c5eb37d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212634, "uuid": "d6a55f2c-f04e-4a24-81f7-2be9c3adec2c", "value": "6144:sm71FitBY0YhRnvapRo5AOKtUIlmfnG6utlD8lMc:h71FitBYNF5bIlmaQlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212634, "uuid": "661d52be-1424-433f-b03c-1f9eb9ff2693", "value": 1096720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212634, "uuid": "adb18d40-93a0-4856-94b6-15092c3546bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212634, "uuid": "7b4c3c2c-b0b4-4948-8d17-d7c06b4a0940", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16e7a89-aaab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676188964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188964, "uuid": "79aab0d5-ebdb-46aa-bf8b-12ad739c5209", "comment": "Malware payload (Amadey)", "value": "a7ba369e30e2e5a9ff2c98db4e53d1f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188964, "uuid": "366ccf2a-8b19-4e8d-a46d-5a0ccab3355a", "comment": "Malware payload (Amadey)", "value": "05f87ea77ed3903590b86acb14fc023ebd22cfae653af979080743dbb9e6cad5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188964, "uuid": "6f676ccd-004a-4ba1-94cf-063b9d6a7135", "comment": "Malware payload (Amadey)", "value": "641c2be2829ca5a277eea189540650780456bac0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188964, "uuid": "c5e93e24-1b09-4745-a89a-9d4727fb7c0e", "comment": "Malware payload (Amadey)", "value": "6f475cb32ae538f4ba87e9795ef816120ad1f24b15e5b05602783435cdb366188ead8603ecab2dd25856c9bfd4b2282c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188964, "uuid": "b9831b10-b4e7-4867-9762-3ff677262643", "value": "T13FF4120BA3FD9432E5B29B702CF717C3167979A05E3882AB624F5C590C726B1E275327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188964, "uuid": "a211e023-97c7-4383-9e39-ab23c1cce4c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188964, "uuid": "291c0789-eb76-475c-8f52-3218f7048f3d", "value": "12288:hMrGy90A/a+7nMSTyESB3iXhUElr1wFtEInxoeJ3vzbCyXinjB5gm7rwPir32:ryN/77EDyRUErqcIr3bbC9ngm7rTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188964, "uuid": "183d88e5-d7b9-40e3-8398-8c655287e9ea", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188964, "uuid": "6f9e45ae-af5c-46d3-9977-f8a9d94dfe8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188964, "uuid": "24309332-28fc-4bfe-a61e-a0f23a35b412", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d6192f-aab7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676194024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194024, "uuid": "7bbbab80-79ad-48d9-9b02-91a8020e5de0", "comment": "Malware payload (Amadey)", "value": "e092f36a0c4233f8999f7ee10cf16a9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194024, "uuid": "b8105c79-90e8-4a05-b6c0-0cfecb75ed09", "comment": "Malware payload (Amadey)", "value": "068d17bd5e4880b7532237c9c1e2843ff66a6fc5cb1a9c0e06b5df893041dbf0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194024, "uuid": "acf9d48c-f3f1-40c8-b54a-8ecc1d0e5c3a", "comment": "Malware payload (Amadey)", "value": "371364cc6f9c6ac6e67246fe3e45a5d5ccc207de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194024, "uuid": "491459e6-09d4-4d47-a66d-d6b8ddca4235", "comment": "Malware payload (Amadey)", "value": "e253bf940ae38c3951415fe2d531b53f6b7681d4561a246f16cc73ea0bb67e4f282c05b5bf81200684680c5b34934697", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194024, "uuid": "5b0c147f-5547-41f8-8766-e23531a9889c", "value": "T1A5F41207E6EC9422E9F457700CF202C32A35BE611B34C36B278F6D6D1976AA1653636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194024, "uuid": "788f10cd-ccfb-4c9b-980a-6b1f3eea7010", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194024, "uuid": "955984b9-62d2-4fb0-a00a-c4784da7bbf1", "value": "12288:QMrMy90be9fL4g7v6T2+qWkR9TVHreJ0No+0/EdGmPIXzh4Il8nC:MyH9TN6S+KRJG0CEdGuuCswC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194024, "uuid": "1b7434ae-2129-424d-94f9-c524721e5f5f", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194024, "uuid": "1455a897-5546-4ba9-94fd-3dbd5801f42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194024, "uuid": "b9bb2475-aade-4f1d-8bde-5ff27c5e2d37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf0808-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231815, "uuid": "d3e0ea1b-cd18-4eaa-b496-c1ce82376c57", "comment": "Malware payload (Mirai)", "value": "3b37efc726b627741ad7794d8e2e91f6", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231815, "uuid": "5ae68666-a068-4a26-a275-0d20748665df", "comment": "Malware payload (Mirai)", "value": "0696ca672964b29f97127307671ba25d7e498cf00e3c4029d37ff7c2483b3002", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231815, "uuid": "250d394d-3a1c-43b4-92cd-27a6f68523f0", "comment": "Malware payload (Mirai)", "value": "ce0cb06d0d1ea095bcf2f4a0169efe51d8d5c6ad", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231815, "uuid": "cba8c690-5380-4d11-ac31-bda628d7d92d", "comment": "Malware payload (Mirai)", "value": "5021919503d2dcc2d14f12bb2e0e544d38cdbf65773a15911beda0b82003f8937f62827347963ff0142f83361ce8dfd4", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231815, "uuid": "bf88d0ae-56d5-4270-8548-53f2e81659c9", "value": "T184B39E71F0912DE1CA030A7865F9CDB4072AE9D521F51CB3BBDC856814AFADAB11CF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231815, "uuid": "9e202c15-5aa3-4773-8f84-86412ea15430", "value": "1536:VkG3Pxg3J/nUbyUElO8t+NoHuLSilBitiaKMH9PXr:/PxMJ/nvblOuyyuIoib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231815, "uuid": "61fc4824-ad73-4a92-ad7a-4e8ab2834f0d", "value": 107784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231815, "uuid": "7084cdb6-bea0-4cf8-89ff-043d0267a311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231815, "uuid": "efbac2f5-94e2-4313-83e5-59fbeff4f9a8", "value": "log21.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78c4a23-aadf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676211442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211442, "uuid": "e6a02b77-fd7a-4b0b-b0d8-30304e807664", "comment": "Malware payload (GCleaner)", "value": "e13b870a1d7465d32051286a8319ec64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211442, "uuid": "e945c863-0610-4843-be07-888a0bad7409", "comment": "Malware payload (GCleaner)", "value": "06fa8c6eb74f8209d4cbd0bbc507378b7c6c096a41a6b4283f23c51aebcb4aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211442, "uuid": "4d1602a9-256c-4c53-9913-6a3b674f68aa", "comment": "Malware payload (GCleaner)", "value": "d6cd2ba09d17795672dff5c17c857be15e89af4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211442, "uuid": "49ad4c3f-c0d9-4654-992d-7aaa9dc8c429", "comment": "Malware payload (GCleaner)", "value": "9de49a2257fa58be8ba6caaf9682e5e8ea10defd5b331e3c41f339d274f5ebb58800c22c4de152e7df7b663b7d8f63d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211442, "uuid": "c86d7c3f-a921-43ab-8093-5a15e356b52f", "value": "T138F5127CB401C56DC590FEB4CC3AD8E75CEA6EE3E4A4A06270C87F3F9679285861A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211442, "uuid": "fa80b993-9368-473a-8898-554688148b83", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211442, "uuid": "51b046d4-8f23-4034-b6d9-ceebc312eca7", "value": "49152:rdHAiPbXiHdFWaUW9o3/NNSW2ndkxoDg+tKaIluNvgkjAKQrugniePEHopLCgv2Y:JHpqLWmoP/1muxos9a7vgkLNexFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211442, "uuid": "95a9b179-8c83-46dc-bf48-f937f5460728", "value": 3462630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211442, "uuid": "8564c910-26fa-4553-a287-cff113c56626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211442, "uuid": "75260406-e0ea-40c8-ac36-d7f89b78682a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dc07af-aaea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676215894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215894, "uuid": "82837679-773e-4d3d-8648-696629fda964", "comment": "Malware payload", "value": "3e09426d839d4d6d5e1568ece4884b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215894, "uuid": "3e3cadb8-c59c-48d8-a19f-8f28ae772d14", "comment": "Malware payload", "value": "0753e07f5a14b7224336e71ab0e796693c32b1d6d0a5ca4da1e26119f83c97e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215894, "uuid": "e54dbacd-9e3d-444c-b7e1-f1b4defe4dc5", "comment": "Malware payload", "value": "ef37db2e14297fcd6d6ee8c3acaefe3a7b1e3edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215894, "uuid": "578b5e69-965d-433b-b19c-988a5d4706d4", "comment": "Malware payload", "value": "01680052eb889d71533e3d6f810cdc80eb398a7e8a76460dd4547b7b9b23fed40be3f7744f0da7ab34bdd5f21bb556aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215894, "uuid": "1c83971d-dfc4-44fd-a729-8fbe6060fc46", "value": "T107F4120BA7D89522D9F4777118F343E32A353E505A39931F278EAD2D08726B5E23076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215894, "uuid": "4a03379a-7528-4ce7-9a23-f05aa467b1f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215894, "uuid": "8712625f-6694-410e-a0e3-65a7d943d200", "value": "12288:XMr+y90/BvzGzWeto/z59oNMABpui0mveJG1t0ngUwq7kRSYEn:pyqpUW/uRBpuiKk0gUV7dYEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676215894, "uuid": "1e6df3e3-0bbf-4c3f-80c5-ebd3464fba74", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676215894, "uuid": "71c9badf-5180-4a85-9326-37171f2b5e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215894, "uuid": "fda1e460-0a77-4470-b41b-73f3906aeb44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720a1765-aaee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676217661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217661, "uuid": "8e7e669c-fb97-4c1f-909f-27077889c8c4", "comment": "Malware payload (RedLineStealer)", "value": "bd1a8fb9af693f4dd1f3e0ec2e186f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217661, "uuid": "c7782b8b-4da9-462e-a911-88f54ec1da49", "comment": "Malware payload (RedLineStealer)", "value": "07728dd544ec371bf65209cce3957cb3f0e8471d4208ea48d8c49646e339618f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217661, "uuid": "ed7d298b-d596-460f-90a2-8163a6c1a05b", "comment": "Malware payload (RedLineStealer)", "value": "c76c3f8aa1b8d21d38fea006fc46f4875f882815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217661, "uuid": "861fb77f-084a-4160-a6ba-5016732c0472", "comment": "Malware payload (RedLineStealer)", "value": "412546316870633b7e1e120708a473e090a895f8e782b0938de32c856ba1c32ef69758bec411103a60378ffb4812cdc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217661, "uuid": "a2749244-3250-41f3-9f6c-c5158de36b76", "value": "T1C254F1027EA9C036D11F85742921DAA56B6FB8A03765C0C733441B6FAFF13E05A7A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217661, "uuid": "8b8eede5-39d3-4727-b925-63bbc60e3d06", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217661, "uuid": "a33404d4-ff28-48e7-b40c-a9c6736fefae", "value": "3072:d7bC+rGK/5iPU3VTjrSoTb3WJBirraNyVPlEDWfPZGXoE0rGxamaptb4lfzz2FOo:52LKUPS7GJBbugWJGXP0rF3b4lrzR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217661, "uuid": "48a7a58b-7dd5-49e9-b95a-a98be1063821", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217661, "uuid": "08c1f217-095c-4df1-befa-7e2a53a9d445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217661, "uuid": "481cfc0b-d68a-4244-96f2-c24a5a57fc08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a3b7e0-ab2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676243727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243727, "uuid": "c41c90fa-5f72-4f83-a626-e7dab492a1b4", "comment": "Malware payload (Mirai)", "value": "74ad6bdcb13817ef239d6f3206bb0092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243727, "uuid": "0908131d-da0c-461f-95fd-da6657263895", "comment": "Malware payload (Mirai)", "value": "07a42224702a6149472d38f2766f3d6960c020ef2b0d56558cd360599a6eeb26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243727, "uuid": "6dccdb79-7aa1-4b0c-acf4-d4faae938273", "comment": "Malware payload (Mirai)", "value": "996d55ef724f068cc255cb98eb42328b35ade11b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243727, "uuid": "85b10561-edcd-48fa-ba6d-b6e5567409b0", "comment": "Malware payload (Mirai)", "value": "514ca922e26bf17d605d3cd634faf1755078034e4b1d399025a46d3b49031e17e451f03518cbc7e635f59a58eade50bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243727, "uuid": "a899d18b-0501-4370-8fca-2ee5cee30bed", "value": "T140E2F12130802476D4E51CB29DB8494D66E307F8FD99B1BD3B34A2ECD0A51EDB9B42A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243727, "uuid": "9efbf056-9ef1-4f2f-b760-f03e08a4ac4a", "value": "768:u+MNQiFb+eqOyreS/vzvMky3Q70HIsvMIn2Ouo463U0:u+MLFV4Uk+Q70osUE6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676243727, "uuid": "f580d685-0897-4aa4-b06a-e9dd788a76e0", "value": 33420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676243727, "uuid": "e3c73713-f47d-4f35-8d34-21da73698f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243727, "uuid": "152852a5-9ca5-4b5b-ba89-dceecfe2dffb", "value": "74ad6bdcb13817ef239d6f3206bb0092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e57d5bf-aa6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676163028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163028, "uuid": "ac35946a-b959-4792-8634-d4ca59ddd96b", "comment": "Malware payload (RedLineStealer)", "value": "8f0f6d8e8f0ec846fa9a24b8a413035e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163028, "uuid": "f42067d2-1aac-4bb1-bbc6-4f157e72de67", "comment": "Malware payload (RedLineStealer)", "value": "07f3b5c37fe8a418c2106deb78e3879111c164913d249a4f6622e0bada816bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163028, "uuid": "1c24ce35-6f87-4d30-b751-46e2057b9cc8", "comment": "Malware payload (RedLineStealer)", "value": "fb920ef61551030f3b9f6b0bfa1ff163d9731d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163028, "uuid": "a3dc7306-a82c-42a2-a936-807365ff10d7", "comment": "Malware payload (RedLineStealer)", "value": "af724f010ef59d12b88a780fa913b734c7aac7f4ee8b807917df0052a00d826fe6f7e669fb92e0f2912407a2479e1f79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163028, "uuid": "3ee14ca7-519e-4d09-9509-0ce306ed51b7", "value": "T187F4120BFBEA8072E5B567B048F317D326317D512B3CC38B638A6D5918721E0627976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163028, "uuid": "4504f7d9-7d70-4e14-a680-f6da35717a39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163028, "uuid": "045195bc-22ee-4be1-ac67-5f3a8e56ce35", "value": "12288:UMrdy90EyOjV0ztPInJlSJv+iDeJjrrxVxlYZzzyyTjYm7C2NOVkcQkIkMM9I:pyTvV0WeJv+tXrL2z+IjYm7bOVk0IkxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163028, "uuid": "f6aa9921-c064-48e7-a490-3c9334c49f2d", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163028, "uuid": "b8616b40-efea-42f6-b8df-57958118b627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163028, "uuid": "42edd650-3884-4d0d-a9d8-3bbf4354fd0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb5c8ed-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676235771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235771, "uuid": "c15ecc0e-620c-4c5c-aa5a-89b20daca8c5", "comment": "Malware payload", "value": "eb7467846309b6a4850761c08afabfef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235771, "uuid": "4097f00e-1ffc-471d-a3dc-599b20b953a3", "comment": "Malware payload", "value": "08176d7dac07e1bd4f2f4c42bd3b71de13cc876122f337a786ca10e8c978c919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235771, "uuid": "73ffae67-ccb3-4abd-bb16-45eeb9b53d66", "comment": "Malware payload", "value": "ceead8f56a8d27873f6ea63c9daded94f62246c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235771, "uuid": "a6fa284d-3425-4c65-96ae-aa92b5d53110", "comment": "Malware payload", "value": "afd0ef96c3fa2dd760a6a33a8ce6a7f97d0462b8ee8b2fe0a6b580b7dcf121740e8515bbf406668df5e36e3ff4f3f08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235771, "uuid": "cfb2951a-7f73-40d3-b041-79daadec847e", "value": "T1B8F4120BA3E89022E9B567B01DF707D31A357F608B38836B638E7D1909336E5A535367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235771, "uuid": "8b500bfd-d704-4d0a-acbe-ba327e80cc49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235771, "uuid": "dd8639ee-6e7e-4415-8523-683a15f9e738", "value": "12288:MMrSy906O/3t+V6Hr3pVbuxR+im15Ov9fseJOpsrhk/ujCBCn6Z:my2/EV8r3PueimoVOKLCBC6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235771, "uuid": "6c4aa3d9-b24b-4ac4-8441-2481593e8439", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235771, "uuid": "00cf8d0e-e4e4-47ef-aba9-775d35b12a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235771, "uuid": "7d26969d-2cc9-413b-8e86-77c1b0d7a61b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca0784-aaec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676216722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216722, "uuid": "5c5d3625-7a03-42ed-bb85-508410b73dc8", "comment": "Malware payload (RedLineStealer)", "value": "252b8be94ec57f65a21f7eca12f0c01a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216722, "uuid": "945b9178-834d-42ba-8fb5-38f1a310e880", "comment": "Malware payload (RedLineStealer)", "value": "0832ff937c6402ec6b252692df3f45abbe08291b1696f243c99f5aef93270d88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216722, "uuid": "2eb3c3f1-7c61-4568-bb04-34d0cc090e6f", "comment": "Malware payload (RedLineStealer)", "value": "36b7fd1715d9168f87cc9a2724dc7d62ef0b1e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216722, "uuid": "6840ba1b-a95e-4a3a-9848-ec27fddaaf54", "comment": "Malware payload (RedLineStealer)", "value": "da80c54ca3e3428628764078bfaaf0cebd44f727c8f0a62e3ed287a17663718ae0fab28b51bcafbccdbc049cd20b8e6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216722, "uuid": "c69f2847-5afa-4cc5-9b0e-bef247bd9cdb", "value": "T17BF4125BB6FC9061E8B427B11DF703D31A3ABD909A34911727DEAC5D0CB26A1A231737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216722, "uuid": "3c4bccf6-3f0c-4403-b371-e87a4dd92565", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216722, "uuid": "ed57b88c-a4b2-478e-9601-43592ea7977a", "value": "12288:DMr5y909ICfwhIvQT4M+KAygkBBDFVtuv6r1tX+NeM68QrJ4nqPln:SyoICfw2vrM+XohZuiH+NeocJ4q9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216722, "uuid": "d5886831-4cc2-4718-abaf-3d8d604ed237", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216722, "uuid": "e5e4262b-4320-47cf-9c75-73f60ded4a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216722, "uuid": "9d7e96e9-858f-4285-83b1-b0a0495a237f", "value": "252b8be94ec57f65a21f7eca12f0c01a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d42bad-aa84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676172108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172108, "uuid": "b2202a9b-e37e-4ef9-9039-ed419aa36e14", "comment": "Malware payload (Smoke Loader)", "value": "cd662276083fec49f31250e42a6a9861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172108, "uuid": "d864d27d-67a9-4053-b076-fa5c43c73e19", "comment": "Malware payload (Smoke Loader)", "value": "0862e9c4a2813cfddb54b6e936141cc159a9236a0301a76e826499bcd61999d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172108, "uuid": "6d45240d-19ca-45f3-98f0-bd8c6fce7e93", "comment": "Malware payload (Smoke Loader)", "value": "084a7447e7d95da3e4b94020d0e5519c532b2159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172108, "uuid": "3e64c735-f538-4ae5-9167-f72bacf5cabe", "comment": "Malware payload (Smoke Loader)", "value": "6cad69bf4b5cd63a952ac995609fe7cc9556c73497d47ab46615aa6db3f9c740e5e7b44692783fef4b2affb91c9949a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172108, "uuid": "7f2e40c2-4673-4972-bad9-d57ca9217a3a", "value": "T18514E02576A19073C7A385B52931C7A46A6F7CA253A5C1CB3309166F1E303F18EBB397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172108, "uuid": "0b5d0af4-55e6-427a-b895-728203de9c3f", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172108, "uuid": "976c571d-304f-4644-87cb-d5fe5d8055d9", "value": "3072:6jqRO+0JVTK5C/nR4XPwOos1OHbHbQpa1NtG:6GcRP/GXPtoHbHMgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676172108, "uuid": "23532855-0475-48ed-943c-051ec1d8efd0", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676172108, "uuid": "ba9099f6-fbb1-4b25-a89d-5a08ff93effd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172108, "uuid": "2f937e8b-da9c-4803-a439-79258ae5720c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57820650-ab25-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676241238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241238, "uuid": "38bcb5e1-e97b-4c0d-8a24-bc001bcd16e2", "comment": "Malware payload (RedLineStealer)", "value": "06b0eed2c677285525439decc5793a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241238, "uuid": "c09bd053-64ee-49fb-9aef-3951328211bc", "comment": "Malware payload (RedLineStealer)", "value": "09cb9cb15c62379fc24884310432aa2eaff3ead0d4ea3801f05bda953b355231", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241238, "uuid": "9bd530a6-f3eb-4573-bc71-65858f4058bd", "comment": "Malware payload (RedLineStealer)", "value": "43e09d375ab8fd632ece68f78b04d9a168e2673f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241238, "uuid": "bd22d00c-d890-4156-b6e5-1620245f9dc6", "comment": "Malware payload (RedLineStealer)", "value": "4d9f16e9b7e391c635470af47e3b0e0b21503e4c0d3591f5c974a27c1ad39697ec296ac74b7bf3e80a55d69da8e44ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241238, "uuid": "e62fd602-4e8d-46e5-b727-0feed4248e97", "value": "T1EDF4126BB6FC5031E8F5537029F707C32B3ABD506B34839A234AAD2118721B5E679367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241238, "uuid": "d241a25b-8b79-4c96-9d44-3cd70fb3b8b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241238, "uuid": "eca960ee-2c80-401a-a65f-140a3b7a48fc", "value": "12288:/Mrty90L01OSrzjAfxm6MfHLYZodvZCoeJ0Y1aYKCUj7R0r92FqZaEUy:myI0MScgHlmFatZSR3Qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241238, "uuid": "5986068b-e82a-4d36-bacc-2c4b5f42dbb8", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241238, "uuid": "f167056c-338d-434b-8c60-42c45d407c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241238, "uuid": "193db50f-f4b5-4350-b04c-9f26ba601edf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747487a5-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231838, "uuid": "1ac81a8e-947f-430f-b1d0-0bc019cd1d4f", "comment": "Malware payload (Mirai)", "value": "f9fa0971b974a9397558d3e9c02dd092", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231838, "uuid": "0e10204f-ebf6-4acb-b0d5-7ce96a9c4bd4", "comment": "Malware payload (Mirai)", "value": "09cbbd696e50e03602de58aa62211f282675be9795b8b7f0134f6146241f6e7a", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231838, "uuid": "5ac96383-8181-4480-9311-457a0aed168f", "comment": "Malware payload (Mirai)", "value": "1c23b22d0aae8821a5a21e3f455e795a271068da", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231838, "uuid": "c2adc4a5-be60-4f45-8afa-6274a6c3b370", "comment": "Malware payload (Mirai)", "value": "6129731d7fe1da3a766f548f50be15aa4532b34efac66cc1e1a9058c6541ff969a0fe919ac9e48d9d07216a18b6a69dd", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231838, "uuid": "fa0c942c-5023-4ee9-8790-90b6705cdb2d", "value": "T1051302B3552560BDE42BA27C8E036380E343BC07069E6F491FDDB56BECAB111B4C9762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231838, "uuid": "70c751d7-0a47-4680-94c9-8260d14a6c26", "value": "768:IXTQv0zfnz6PIypr1r1lZh+sMiiDD/+00fFcpMVGOJMIFuv6x0x:IXTGYgprhDZEVD/yGGVZJFFuCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231838, "uuid": "3e37c041-efdb-4525-a765-eac8fdba2ff5", "value": 43856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231838, "uuid": "34c4454f-ee1e-4ff5-8d55-561375233ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231838, "uuid": "e97e393c-af2f-440b-ad25-d80be17fbb06", "value": "log21.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc90225-aab6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676193471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193471, "uuid": "087aaf3d-cc5d-4fca-8380-a7bdd69191cf", "comment": "Malware payload (Smoke Loader)", "value": "73d59bb63cacde163f1ee8eb94bb2410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193471, "uuid": "9efc4858-0a80-485c-b1e5-5dbc6d2d4611", "comment": "Malware payload (Smoke Loader)", "value": "09ea8f4b3791e944b2aaeb24a4ca6e92af2382e2152a36a43135c1096838859a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193471, "uuid": "ce97154f-0d36-4872-b279-fd77bf3291b1", "comment": "Malware payload (Smoke Loader)", "value": "5860f9ecb55d79f054c29232eed03d0bf18cf608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193471, "uuid": "f12aba7c-685c-4fda-9d4a-b094bff48d14", "comment": "Malware payload (Smoke Loader)", "value": "113ba144c7178cdb800df17d8f9503bab1ab42bd97ddd98b409430cffb3b2f5a0512a9f951b8c52f4b7e5f92752265ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193471, "uuid": "07bfbcbc-cf8d-4a21-baa5-5d4fe8bedf1a", "value": "T17D14E01266F2C073D55386B12971ABA57A6FBCB257A5C1CB7309262F1E303D14FBA302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193471, "uuid": "089126c5-c821-41f2-903d-8509f91e5cf5", "value": "78e1c4f9669ded46ae386ba562a99468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193471, "uuid": "7d1415a6-42eb-4100-b13c-7beebaa5b3a2", "value": "3072:yDKv8+NkazVsREcQI5RB8wGG20bKfrwjJEHzl2McrJ2g7TJDY:yGUGchB8wJ23rwdc5j62kTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676193471, "uuid": "6b6b7847-94af-461f-83a3-25c49465f765", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676193471, "uuid": "410418de-9c21-489b-a2a2-50abf4f88b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193471, "uuid": "4c4d3472-cf13-449f-9f10-4804bae114c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f4494e-ab0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676231201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231201, "uuid": "9db2847d-e6cd-47b8-8dbd-1601c0c95930", "comment": "Malware payload", "value": "d578063f9947d0af70f8426b609018b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231201, "uuid": "bbc2792b-ffec-4123-a01f-5fe32b9675f9", "comment": "Malware payload", "value": "0a317d2f576c7e09004e67ff769e3499a6e2f508bb42f522d861bb3e5ed3a334", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231201, "uuid": "f4c4b1fc-1f34-4c9f-aa34-c268bdfd484e", "comment": "Malware payload", "value": "1525ddae510869fed0090e46f2945665d99d7cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231201, "uuid": "8bbbefc7-313b-4e3d-b9c6-6f0d0c64fc9a", "comment": "Malware payload", "value": "7d40ea97b7d402a5eabfc3e10afcbbed54e937df7e275f6c6d56d5e01992496e5db454c72242035f575f0b0f1f0265d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231201, "uuid": "fc40b4d3-24ec-4479-9ece-7d0cc0cc0163", "value": "T1CAF4120BB7ED9032D9F147B06DF603D32B39BDA11A34935A038EAD090DB25B4A675367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231201, "uuid": "045a8bf2-f448-4d9f-ac42-5b05b220b99b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231201, "uuid": "29abf43a-9df5-4b9b-8ea4-6ece017925ce", "value": "12288:rMrjy90skftBRcUYi6MntP7/b6rip5eJRzpaHQn5kuYOYyObI:wystLZYMnhujF4Q5kuYOYyObI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231201, "uuid": "6d3ecbd4-eb14-4756-8f77-484e7d75d56b", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231201, "uuid": "f0c2c698-c29e-443e-a863-d6497f1b23f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231201, "uuid": "01dbc8e2-b3c6-4da4-8e17-6d8d394a4a8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf51f61c-aaf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676221226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221226, "uuid": "a33f341c-ddd5-4d73-a375-b725af901c1d", "comment": "Malware payload (Smoke Loader)", "value": "6509349609531cc9c518fa5240e4d468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221226, "uuid": "ba647f52-93db-4db9-b54d-ef423b46cc50", "comment": "Malware payload (Smoke Loader)", "value": "0a32ff814da3140043641b88be6624e09f156fc21f8a2e3b19ee44b6e810a447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221226, "uuid": "376b2726-b4d6-4f96-aa4c-f93562b8d11d", "comment": "Malware payload (Smoke Loader)", "value": "7f758dffc0a3f6a035becd8f5c7bd7a751742d27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221226, "uuid": "34270f90-e3c2-4a7b-a6ca-76316dac9b90", "comment": "Malware payload (Smoke Loader)", "value": "222ea4e87199c972278c1d25983a6d1335d117fbb542f780aae3666f980ba485c1cd8fd90f514e80fdcaf0f54760cbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221226, "uuid": "e75851b1-cb80-4c94-9e9f-1985c3ff4ca6", "value": "T1EA14CF0276E1C072D55745B1646DDAD83ABEF8B16B72CCDB33881B6F1E202E09E79385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221226, "uuid": "c8713560-6270-471d-a288-56988902b7e3", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221226, "uuid": "a6bad50c-3f7f-4d46-a099-d03624c77bb7", "value": "3072:m76R7+rGvh5igXd6p19TOb0fjlWo/x5PnURtjqIyKHI5SBGN:IuL2gXwp1x5fjlWMLMmIQ5CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221226, "uuid": "ecc161e5-f9da-422b-8e90-4749fe15d107", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221226, "uuid": "03b8c067-6175-4f86-adb1-cc3ec3c1e097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221226, "uuid": "b092bed3-8601-446b-a611-347eddbbda9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f629ee27-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1676235921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235921, "uuid": "94ad5521-4774-4549-abd6-95c4978d8328", "comment": "Malware payload (AuroraStealer)", "value": "50d48404f9b93a16c69aed2e6c585192", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235921, "uuid": "5ad0d858-9dc2-4f64-8d71-ef4db1144c2d", "comment": "Malware payload (AuroraStealer)", "value": "0a6ed49a01a7c4cad6ea914495d5789b97a9993508fe82ff3232613afb2a0789", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235921, "uuid": "5b739998-0108-4f34-aed2-2e2c7d31e3b8", "comment": "Malware payload (AuroraStealer)", "value": "3f949a4b96bac4f7e1cec881edb5b65295410a1c", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235921, "uuid": "a58442ef-f6a6-494e-abaf-87335b88e104", "comment": "Malware payload (AuroraStealer)", "value": "f3964a43f41e41356341a67db32cb8486de1a25e05f56a68d6cb54f9f6136705fb7bc3a4afca739a0b01f1cf417968d5", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235921, "uuid": "8ce05da8-167a-46ff-aa84-1c5c4644f344", "value": "T107E5084BB89481F4C0AEE230C9659253BA713C855F3163E73B10B3B92B77BD85A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235921, "uuid": "9d0a4d5c-6645-4e1f-b5b6-24f94c246349", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235921, "uuid": "1f75fd72-40e2-4245-8db6-5b55bf202d89", "value": "49152:Eer33gFd4ujF1gD2hJAUIaEsLFA8uJp5vk1b:d04yhDTLO8uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235921, "uuid": "bbe8265c-b483-44ce-9908-29522c59225e", "value": 3114234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235921, "uuid": "dea65a7d-ceb6-42d8-9ff7-219a765a5423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235921, "uuid": "f595c829-abb4-4beb-b28e-d2f33ce2b76f", "value": "50d48404f9b93a16c69aed2e6c585192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045383a1-aa75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676165507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165507, "uuid": "67929986-b6ca-4757-9877-9bb7cc8160b6", "comment": "Malware payload (Smoke Loader)", "value": "c4c0df1187e643384d3de1a951111151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165507, "uuid": "a57d4eb2-eb29-42f6-a06c-52fabf4856ba", "comment": "Malware payload (Smoke Loader)", "value": "0aa2ce266df01cd0abc2b043202ae77b56300b1584c8051c5aee76bdce674399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165507, "uuid": "0ce019c0-ff0b-490d-a4c4-0a2f98e999e7", "comment": "Malware payload (Smoke Loader)", "value": "12551b8ebe88ead1a989c3d13a255556c75b7f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165507, "uuid": "f0a72cce-0611-42ee-a958-8efbbeb09c4b", "comment": "Malware payload (Smoke Loader)", "value": "4c6ea9a14d737b2ae665bc79cf532fa67af4da1fea96afb22b1993b31d1680ddcf8d4eb0253f0a88a3536942dd4ba4c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165507, "uuid": "0cc5ea74-fb23-4f62-bc49-bf46b75c390b", "value": "T1D814CF01FAE084F3C55742BD2935EA906AEFB8A197A5C1CB3358166E1EF03D14E7D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165507, "uuid": "9c48ed07-20cb-4331-8c6b-76f89e69598b", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165507, "uuid": "001a4b56-0da7-40c5-98b4-279cc5534488", "value": "3072:rejqLA+0Jy7G5C/Dju2+CdTqxDJ3Y7NEsCMm7h45oW0FU3VtG:iGERq7ju2/TEcCW5+SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676165507, "uuid": "c805eb7a-6b7c-478a-a537-4080abe45893", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676165507, "uuid": "6fdad07e-9cca-409c-b0e2-09392f422f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165507, "uuid": "b2f5207b-a095-4fe1-9935-0e72c632851c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4bca82-aac1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676198461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198461, "uuid": "c6384189-6f98-4e6a-93a1-8ddb325ccc7b", "comment": "Malware payload (RedLineStealer)", "value": "78128884e3680210d9b6621231f82652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198461, "uuid": "f405ce7c-75cf-4745-b2d5-52f140ad3463", "comment": "Malware payload (RedLineStealer)", "value": "0b083ed0f87b7fcefb839bb17f78919e5dde622662167ee863773d6bb6a223e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198461, "uuid": "dcefa3bf-af96-44ce-a808-8d35c03c1c38", "comment": "Malware payload (RedLineStealer)", "value": "b267e3ea26d175d28deda83b83a5a70d2b8dbed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198461, "uuid": "fecf7888-71ba-4371-be7c-bf730354d8cb", "comment": "Malware payload (RedLineStealer)", "value": "57372fe6f70a2014cd65d6296f9225ed441e5d3fe17e629fa9f86f095b85e23f0a53a34d81d79d414a356d1ceb202066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198461, "uuid": "0d37ee63-6440-4a02-9f12-bdedc15ca9b1", "value": "T16EF41207BBE88032E9F1537019F202D32B35BD915738C666238F7D6958316A4A6727AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198461, "uuid": "ad3e71bd-6c85-4b84-8d72-b2cdbb312c71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198461, "uuid": "e827554a-9874-49ff-94de-c9cef04fec01", "value": "12288:vMrly90DwIpzuIZ+blW694jeJgKGvIImzhs5l88SiMpssq:myIwIL+bcQgKGAPWfBLM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676198461, "uuid": "c08117e4-7c07-41fc-ada2-39797735ab89", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676198461, "uuid": "6a2c3a34-739c-4d15-8d9d-5954cced29fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198461, "uuid": "96e865bc-3dd6-4e94-948c-04f6c44932d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5914c0-aabc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676196153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196153, "uuid": "14b6f660-e9de-49a5-a496-31b2792d677e", "comment": "Malware payload (RedLineStealer)", "value": "89208481ea2eeb0fdbf196447c527380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196153, "uuid": "1b52b3de-e460-434a-8c2d-b974ca392067", "comment": "Malware payload (RedLineStealer)", "value": "0c2814ea196766ae0484f1169ea7bf8e210122a4da25e82f5e38c5e2807b5d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196153, "uuid": "6ae29988-9731-4107-bd65-f356ca365404", "comment": "Malware payload (RedLineStealer)", "value": "c336b44755a3f9caa7e6bcc17f15fae219041adb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196153, "uuid": "6057095d-04f7-4f3c-8ada-60c03b463096", "comment": "Malware payload (RedLineStealer)", "value": "96b95618aa8bc3689b352313c8a0456d2f2d8df5787dd7cbb75a370fa03b8da49455e36c4cb46ee085f7fb4b47a9e49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196153, "uuid": "4229099b-8830-4fe3-9cdc-7cef9079cae4", "value": "T1D2F4120BB3E89032E5F153B028F603D32E3A7D505738839B528EAD1959727A0967676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196153, "uuid": "7cea3dda-2dd6-4917-8fd2-90eff814288a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196153, "uuid": "dc3172c9-eb25-44c6-a136-6af39ee54a6b", "value": "12288:uMr+y90MjEYjnj1whfwbqDVJa98205eJVgAkthx3Qhmb7xTpZCGiNITzhjx1l8Y6:4yzjXjjSfw2DU8AJGP3QhitpZCGEKxx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676196153, "uuid": "7bb5d373-6351-4168-825b-66d9f0ee66c1", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676196153, "uuid": "0eb8a305-20ae-4ef7-84de-1f822e82a52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196153, "uuid": "cc3db04b-74b7-4dec-8c5e-00ac58a2f11c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669ee6ec-aad1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676205186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205186, "uuid": "bd057a17-56ff-4ca3-9583-1d21e44b5986", "comment": "Malware payload (Smoke Loader)", "value": "0f1d7832a61f69b5d6434d3ab3fc29b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205186, "uuid": "09630e92-6313-48d3-891f-c55abea9598a", "comment": "Malware payload (Smoke Loader)", "value": "0e5f0963d42bfd515cf3ca185eb9ab899e12e903a80e81766256ee3ff26d0d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205186, "uuid": "d918206b-f5bd-4d4b-aa44-f4c8dc17fda9", "comment": "Malware payload (Smoke Loader)", "value": "b905e329f5ecf64d68801a2483a112d2d742fc04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205186, "uuid": "7cc9fd47-d38b-4733-9958-5e5ddecc06fb", "comment": "Malware payload (Smoke Loader)", "value": "2262ed4ac36c3b72f5f975b708d21a5a4607a7b74dc569640e4f89400f316cc3e444f0b242e4c292b28e87228569fc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205186, "uuid": "6ac427da-7edf-4fa8-aabb-685d4d901101", "value": "T13214DF12F293D073E11B85B56821DAA1A97FB8B0E7A5C1CF2344166F1D303D29E793B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205186, "uuid": "13c20b25-470b-44fe-852f-7f2f180a9de9", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205186, "uuid": "0957f4ac-d041-402e-ad26-6eb5b8f35fe2", "value": "3072:J7Rr+rG7O56ZHILe5cyrGd89g5DBF9qrFReJ/RqU9DN7:9JL7FZoSz6ey9Q7evnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676205186, "uuid": "65dca3a8-d191-40c6-9879-72e6591edf59", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676205186, "uuid": "586b70e9-9a4f-4622-9cb7-a4ed2ba57dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205186, "uuid": "7fb35318-d90f-450f-9d18-5bab2fb8d0cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b56637-aab9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676194826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194826, "uuid": "1bf709c1-c4bd-4270-a84f-154b2c594169", "comment": "Malware payload (DCRat)", "value": "28b15bb5be6281cf30dca9bd20d37148", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194826, "uuid": "684b6bdd-cee3-44bf-bea2-eac3977623c0", "comment": "Malware payload (DCRat)", "value": "0f4eba9245a244a5706749ab0d505804f352ae8c39919fe4de3d63df1f5e18e9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194826, "uuid": "a143ad11-ee83-4d04-af99-f4aba4c2d71c", "comment": "Malware payload (DCRat)", "value": "411d4dd597a8c468744eb2e096ce84b0867057ed", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194826, "uuid": "70c9ba35-b5e1-4c85-b222-b2bf51cbb675", "comment": "Malware payload (DCRat)", "value": "b2cd6bb3dd5d796f15275219057066f4de3f0d1a541ebf9bea9938077ce52988d0a65f5901931cf4501c3a97e9c707b9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194826, "uuid": "bff25551-fd3b-486d-8e3c-8a65bd45cdd0", "value": "T1DEC5E1C57BF2A02EF48B725264183A9DDC35B943774BE14667333B5092C88FFAA94583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194826, "uuid": "69b99912-9729-4bf9-b2ae-fd1d6a8f9212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194826, "uuid": "badf5184-fdfc-4d8b-a9e6-051fcaac00c0", "value": "49152:JTmiAznN8OLA03GMjKoZYz+WqE3GMAsH4wDnyBMzTvAaULscNpVQPUmXq:ciAzSOLA0cooNrkSD6brVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194826, "uuid": "3e23a36f-4f70-44e4-9d6e-5a8c99137bbc", "value": 2598400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194826, "uuid": "d4ee50bf-c0d0-451e-a834-840213a5756e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194826, "uuid": "2bf83421-6e68-4070-a498-d3a1c33b46ef", "value": "28b15bb5be6281cf30dca9bd20d37148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfb01da-aaf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676221865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221865, "uuid": "c2f2018d-bb95-451a-9145-5e5a80fa5632", "comment": "Malware payload (GCleaner)", "value": "0d159bc7c8934095a18b4d2093de2df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221865, "uuid": "ac2da226-3767-4dac-aeaf-4b663a37c16e", "comment": "Malware payload (GCleaner)", "value": "0f62fd92465382415fc24bc92be34a4132ef8a8e58b2dee2a15aaf70534597b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221865, "uuid": "75aff69b-d434-4b0d-936a-7b1581d6800b", "comment": "Malware payload (GCleaner)", "value": "63cf17dd39bc575cf56a768509abda368d05e664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221865, "uuid": "07d9e3b0-f1ee-4c3d-8b61-38c9403938ab", "comment": "Malware payload (GCleaner)", "value": "2b1395cfa2d7d445d225fd703c16a601adad0fc647babcc73fd9dc3359ecabb6e19d30284f7842e8f2e58d04b3125a2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221865, "uuid": "63b613d3-19a3-4306-99a5-0570f3d79965", "value": "T1A1F5127C7245C8ADD6C4FDB4883694E76CDA6EE3D9A0A01370C87F3F91B9284970A51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221865, "uuid": "b922e03f-0baa-4a44-943c-aa41cdef4cb1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221865, "uuid": "3a6f996c-73cc-4266-8b7f-f5442d6dd0f5", "value": "98304:JHTT53YWt2qqwoR08NtNgA0sTH03v6e13Uxv2MR:dTTFYWt2qqw2JgA3o3iehKvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221865, "uuid": "227a6aef-72a9-4caa-8092-847155942f62", "value": 3623713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221865, "uuid": "fc4f2d87-2e15-47b0-a274-3066638371a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221865, "uuid": "6b4230b1-e1cb-429f-aec3-d87db80b6f9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8d32f4-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676229754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229754, "uuid": "82fbf1ef-74e1-4844-ac98-7b99133c170a", "comment": "Malware payload (RedLineStealer)", "value": "530d02bacac7a8c69e254ec1fba9b062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229754, "uuid": "179b4309-a174-4724-8e0b-383e491458ac", "comment": "Malware payload (RedLineStealer)", "value": "105df0af6bb33fd87046448cece05686e78645dc4cdb3ad13bed1ae8ea9feece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229754, "uuid": "e0defe61-00d8-422d-a0b3-90b4eafaaa55", "comment": "Malware payload (RedLineStealer)", "value": "9947cab7ad55fbe12e415733446ef0f80ec2897f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229754, "uuid": "41e33358-126f-48b1-8042-8f4b6462ac09", "comment": "Malware payload (RedLineStealer)", "value": "08928548b32f86fde78798a16e62bcec7d16e983219ef3304089db8cda74bed97c3e8867760ef9f2e9eec4f78377c544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229754, "uuid": "ad1027e3-08a9-4d04-9dbd-240956643dbe", "value": "T15AA4011BFAE88032E8F4577018F702D31A36BD616B3487D7674EA9190C726E8A53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229754, "uuid": "f0261c3f-0227-49a7-8f01-698bd2dda2cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229754, "uuid": "c4baba9d-1f83-4503-8d3f-faf4580b8477", "value": "12288:yMr3y90qmsAw3eTO/Gq/Ot5/S/t0sMhzT5nPi+RtU4:FyHC6eTO/yeMza+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229754, "uuid": "ccc5128e-bca3-429c-8f62-0189398f3983", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229754, "uuid": "52070f0e-92f3-4c8d-b14d-521161c0685d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229754, "uuid": "0beb9d24-3991-4f9a-a73d-66f46bce2fbc", "value": "530d02bacac7a8c69e254ec1fba9b062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c07c6-aa77-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676166551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166551, "uuid": "cc417880-2db9-4d02-a8d9-09728cf8d727", "comment": "Malware payload (GCleaner)", "value": "a53de727b2294a7e3b3d4cc851635978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166551, "uuid": "2c391926-debf-4cdd-8a5b-ab3a4a500257", "comment": "Malware payload (GCleaner)", "value": "10d7e7095dc3364169863ce5bb0d92fde43338c4d374528953624aab0cc099ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166551, "uuid": "4e42c69c-8f67-4d40-bcca-147b6c2cee45", "comment": "Malware payload (GCleaner)", "value": "7e4d1678baf4a8331e0f5142d657e86b056f5965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166551, "uuid": "ed6213e9-2f9a-402a-8a0d-1a1de877b4be", "comment": "Malware payload (GCleaner)", "value": "150be3a322ea7ca9f4e30a06a2d01b555419c4ee87075a31ecf44f783e6d926a74925272d43384f2e74b153bca2bea11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166551, "uuid": "9f29d13f-a344-4a14-bac2-267daf200231", "value": "T159B5127C7145C56DD280FEB88C2A98E79CD76EE3E9A0A46230DD7F3F517D2889A09113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166551, "uuid": "5709b167-7b01-4e0b-9f3b-767645b15a47", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166551, "uuid": "145bf468-4b51-43ac-a435-fc7ffc3ce58f", "value": "49152:rdH9TiRpdZHV/z/pvrSQNDfLHzqpRB4ah0Kg5uea+3KdLCgv2MR:JH9edZH1xvrxfLHzqJ4adcKjhv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676166551, "uuid": "14e3eb62-f187-4683-9aed-c96239131de6", "value": 2432645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676166551, "uuid": "c3c4c3e9-9368-4291-b8d4-c41b1cb62a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166551, "uuid": "a8784e7c-b6eb-4eb2-a580-ce3e81755f09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1cc36e7-aa88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676173932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173932, "uuid": "4d391805-c32c-4ae0-b1ef-2756e4cf069c", "comment": "Malware payload (Amadey)", "value": "00a3c62c98d6f8daeb9872b0a0292a51", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173932, "uuid": "97909ab0-84a8-40ef-ba65-efb90eeff482", "comment": "Malware payload (Amadey)", "value": "11e3a29344e93641be53aeba47ab00596070590691bbce9e799e649999b62d83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173932, "uuid": "aa287f16-c0ae-4142-96d7-3a940cb78de6", "comment": "Malware payload (Amadey)", "value": "620707da9604a7ffd5cf18f2f2dd7a15fffe6e87", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173932, "uuid": "42bcceb9-2b20-4e56-b2d8-ee9cef57c90e", "comment": "Malware payload (Amadey)", "value": "1e557990770f4ff4ee046e0cf48db185d96bace6433079725b314ce312a04fca35a865d61073bc86a997d0faecbb8ecd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173932, "uuid": "af47fa24-52b4-40ad-abcc-10770eb3b306", "value": "T1DDF4121BFAD89071EC626B705DF607D32A317D304B34C29B378F7C5A19625A4A23636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173932, "uuid": "66d410cc-e0a1-4021-abcc-c175af7a2264", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173932, "uuid": "3aa06be1-9219-49d2-a294-60d834ec8340", "value": "12288:MMrXy90sJ+UV0oCCote31RD2WegyeJRwq7p5N9deY0KS2IhWi:DyTV0CbXRtT0nyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676173932, "uuid": "a06b6146-2fea-465c-b61a-be30f1623f77", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676173932, "uuid": "2bf29c32-a384-4a13-b2db-687e05a30541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173932, "uuid": "b9ea595d-8936-4171-bc09-62c847327f52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e223db79-aadb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676209688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209688, "uuid": "b004aac9-6c2a-4436-9aae-53bd79766fc2", "comment": "Malware payload", "value": "a5396df2ff693345b1fbd4492e78a53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209688, "uuid": "f819260f-50ff-4946-8b6d-4cf83d728caf", "comment": "Malware payload", "value": "13af75cac69f271a200d00553a5a19362b6e847ea68223b3b43950659e7e5130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209688, "uuid": "3bb464ee-ba14-4f36-8b1f-7bc5031fa337", "comment": "Malware payload", "value": "d10404c52f56aff8f614e74f0bba5639dec85849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209688, "uuid": "e65de0b4-105b-45bd-be65-e31e13212d09", "comment": "Malware payload", "value": "0a593071b5d879480f0ea7ef7f06cbe9d3575ef8d1daabb0ae537fa2b1226a888d0f216b61ce80f980812aa4e2529715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209688, "uuid": "8157a905-eabd-4455-8fa7-a5760283b099", "value": "T1FDF4121BA7FC9023E8B163706DF303D316357D619A34825B278B6C1E6CB22A1B635797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209688, "uuid": "79caeccc-d72e-46db-82d5-6efc4befa977", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209688, "uuid": "6cd89878-47f5-4c36-8242-16dad70e4243", "value": "12288:4MrWMy90mqYAxfkgvOe+hpq0xWpzY0XAYSBUCeJBRbNK1iQgpkq1kOQxZ4+ns:TySxfk1eT0xWpzY0FgS7bw1mpkLpZvns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676209688, "uuid": "fce879dd-65b6-495d-8e51-a5dbf27d35d8", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676209688, "uuid": "69da307f-376d-4895-a1a6-3e9a9223556f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209688, "uuid": "3ede2521-1036-433f-85d0-e7cc668c22f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4587d827-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676229182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "e8e03df1-533a-4fd5-a5e3-f1662def2a02", "comment": "Malware payload (RedLineStealer)", "value": "fa77fc5915abcecdc3534351b64727af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "f9b5d185-3a5d-48eb-9f1c-b88d24b3252c", "comment": "Malware payload (RedLineStealer)", "value": "13d54f839060b601a0c89beefd65599bd07fd37cee1e302c43bfb55c281fa23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "f5dbf6da-b7fc-4d0a-b468-9a2d3e67786f", "comment": "Malware payload (RedLineStealer)", "value": "1f3c3df5698eb949a8f2a2c34c8a1f64c5e9eca3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "6d333a13-05c9-4145-a49e-5bc2baf1a4dc", "comment": "Malware payload (RedLineStealer)", "value": "a9398f42050e81e1ef0eaa3cc84a6b719d6977645b5aa73ad83a0a18bbf97c5f6d0a29526848ff41c970f211e0f056f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "ecb5bca5-1f3d-49c9-a79b-11b30214d60d", "value": "T1CDF4128BF5ED8123DCB4A7301CF202C31B397E125B34539A274E6DA51DB1A61B135BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "83aebe54-6955-4880-96ad-5b1305de6d94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "abba8e3f-90e2-488e-be72-31765cab0062", "value": "12288:OMrKy90bM6n7cUuF82eAorFpKkBHZJQTeGVl+sIdfA62qUbiMl2RcKf2ECy:ky+M67cUOqhpKnZVl+ZxUbTlxYwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229182, "uuid": "338ce981-5cd9-4447-9d7e-5b6d22a74a76", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229182, "uuid": "e09530cf-f75a-4b3d-b833-ca34ec649d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "1e3ebb10-da28-4004-a738-31cd1c91e904", "value": "fa77fc5915abcecdc3534351b64727af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a222ed-aaae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676190256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190256, "uuid": "ae54ffb6-b87f-4ecc-9801-6646464a8de5", "comment": "Malware payload (Amadey)", "value": "e660d7727488e63caedb3ebd42a43a74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190256, "uuid": "30f66ab2-4cef-4b74-b2a5-a5615ec47ad9", "comment": "Malware payload (Amadey)", "value": "14e982c8d855f6f743afe6e3c3d50f578b48683bcf3859a8256a0215ad4ce1e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190256, "uuid": "dd181dc6-53bd-45d2-9511-af2e21c9f267", "comment": "Malware payload (Amadey)", "value": "4a14ef9f32fb829e326d7a712bd9e7acc926188a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190256, "uuid": "ce3a94b7-8535-403b-ad22-350b135184a8", "comment": "Malware payload (Amadey)", "value": "c3db89a7697d64ec1d53fa74d17491c11451f7225e037c373318e6d54960f6b88a47958aa18c783db5b1aae9f9d77244", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190256, "uuid": "f98d4944-3de1-474d-ab72-40f1b66c2d75", "value": "T1C8F41207A7EC8432E9B1177018F603E32E32BD615B3483AB564ABC591D336A5B27477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190256, "uuid": "fc01ff10-e541-4eda-a0a0-956174e5c73b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190256, "uuid": "7c4208d2-15ce-4586-bbbc-64696e7d25b7", "value": "12288:VMrVy90UzlIQ041+HsagmDNqfl3DQQ6eJ8+UYdrc0t6rSon+Qm7UwPYoD/lVw8U:Iy3zO81+HNxulzQ68a0rd+Qm7Ue/w8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190256, "uuid": "87a8db58-ae59-4119-9e21-e1a9aec5dd4a", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190256, "uuid": "bb80454e-0b9f-469a-837c-89b2b3247891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190256, "uuid": "4351b24d-80e5-4af5-ab7d-5669fc72b83b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecee968-aabf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676197415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197415, "uuid": "657a5b7e-4fb4-463c-a7a1-4d1ab9cc5140", "comment": "Malware payload (RedLineStealer)", "value": "f6c3529489c9b14e03cc0d5737262b81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197415, "uuid": "029d7aa8-a359-4f34-bdd3-4774c02c6eb0", "comment": "Malware payload (RedLineStealer)", "value": "14f00b3509a0ab5830b0a7e673c27d5032642741bf990312038ca2cb2068954d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197415, "uuid": "017f3479-928b-44ca-9880-1b7b6ec961e9", "comment": "Malware payload (RedLineStealer)", "value": "cc633f31c664b6da84180c2521755413fe041ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197415, "uuid": "905b3a5c-90c3-4157-a051-0d49167f47cb", "comment": "Malware payload (RedLineStealer)", "value": "3451812db2f75278854902ca1b485524fbf560fd04abc9384ec1c9bb1d77d89d96b131024489aa413cd83a0692436310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197415, "uuid": "beb1822b-f5f1-42db-9db8-09ab0cc68c0c", "value": "T19FF4120BFAEC9132E9B4677059F203D31A367D611B3482AA638F9C591CB12B1663537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197415, "uuid": "ba0df557-5a32-46db-b195-0a43dd4b0629", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197415, "uuid": "a3eec544-8298-462e-8adb-af255a471ffb", "value": "12288:wMrQy90nZWVuDiFNuQu96UXdSeNeJgqdRDqBPsMG+uIwzhSu1l8nG7:wyFVii/uQVodS9gcSPsMG7lcuTd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197415, "uuid": "48b1bf61-535f-43d8-a6b2-d7674b23ec0a", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197415, "uuid": "fb1a4d2f-f133-46b0-90b5-351cf36b61c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197415, "uuid": "3ebd556d-5392-406c-8567-5e177902068f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeab821-aaae-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676190277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190277, "uuid": "dda6a4ad-7d30-4ca1-a07d-148dbc3f0515", "comment": "Malware payload (SnakeKeylogger)", "value": "eda087049b25038c82268f4e4632b4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190277, "uuid": "b42af052-66d8-48e3-8057-e13c2ee497e0", "comment": "Malware payload (SnakeKeylogger)", "value": "15fdf335aa7b720d7ae187afe07af4de7ff71092dd06934e0f3f61b0b642bc39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190277, "uuid": "a3f6685f-4870-4481-a199-0856c08925f5", "comment": "Malware payload (SnakeKeylogger)", "value": "d5078ed7fb9cb8d6df2273140227b4e2ffaabc03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190277, "uuid": "e0dc2b7a-0a3a-42d4-8070-b626cfbb9fd9", "comment": "Malware payload (SnakeKeylogger)", "value": "6f8b9ad1716d38cfd2c23eab8dbabbb31de421f25e124305adca3c00898ca820fec460d51843525b13001f6daba72c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190277, "uuid": "e1cabb5b-c916-4328-9327-e8e6c95204f8", "value": "T15B65DA243EFA501AF1B3BFB55AE071528EFFFA627607958E146113860933B02DD9193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190277, "uuid": "76e5e4bb-93ee-48f5-8d12-d73e57acc0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190277, "uuid": "623cc6d4-6a75-425e-ab90-21bc95232a1d", "value": "12288:UYilYFnyW7EcgMe6uN4uVDC3l4R4spuL8bILSuL4cSbEX7ULxMto2eXcDUnquyQx:ZNaELSuL4k+F6+KtGcIQMo8QEvYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190277, "uuid": "88504268-3fe3-4d11-8a82-ed3f0ca09676", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190277, "uuid": "64195ff1-c2fb-465d-ae25-2c55001cb13f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190277, "uuid": "8766f1bd-c55e-45cf-9fa4-a8eaa1908d58", "value": "098765434567800876567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ef1f60-aad8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676208158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208158, "uuid": "70ecbbc4-314b-45d9-bee8-3fc47b83e279", "comment": "Malware payload (RedLineStealer)", "value": "041f32b1a8c5b7ccb00fb162d9527c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208158, "uuid": "6705b03c-3fd4-4dd1-a398-5d305a306787", "comment": "Malware payload (RedLineStealer)", "value": "16a36f6ee9217aa06a6b4dd86daea232907059f2a8a202c44107b8a2cdb7b61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208158, "uuid": "a827f97d-3f83-4196-b1af-2beca08eeb9b", "comment": "Malware payload (RedLineStealer)", "value": "adad8b4ca9f468deba079aca9d137a2874d40de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208158, "uuid": "5558054e-4006-420b-a019-8259547c24cf", "comment": "Malware payload (RedLineStealer)", "value": "a505f8fea127212534fa88f8f56c494914147e6b4882547e98ef35c5fff0738a0c2613f02892cf9fc78c6a7073981b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208158, "uuid": "a9dedaec-60a5-4461-9dd8-2426dcf063d2", "value": "T1A9F4120BEBE99422E4F1FB7029F607D318367DB14B39825B53CA6D0958722A0753637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208158, "uuid": "b1639497-9e88-4696-9e31-bd6f604d5052", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208158, "uuid": "74a1bc1c-52bd-4939-a1e3-1e70db1662d2", "value": "12288:MMr2y903lAvWVsvZT/xrU2PX0nqPeJG3GqnkFEUo5g0TLH6jbT:CyreV8TjPX0/GWqnkFtoe0TDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676208158, "uuid": "f97f577f-acf5-4784-a114-353a3440ed3a", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676208158, "uuid": "fc97307a-ce4e-4fb6-9576-6a374cecf782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208158, "uuid": "330d8278-2367-4c48-bdb0-93e219a0264f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c9635f-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229641, "uuid": "c4520a43-b74c-484c-b1e2-1a6c78172112", "comment": "Malware payload", "value": "b5c120e7bfe4b8c19a90ada80512b169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229641, "uuid": "bf2a15e6-5dcc-478d-b8ec-78a31af0d353", "comment": "Malware payload", "value": "16bef27367f2683f86d67c927d004632a4d27607bc03e60d70d4e0d30fdcce6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229641, "uuid": "89599fbe-b5f2-45b8-a806-8a5c1553d95a", "comment": "Malware payload", "value": "da6f3e7675c59dd6e001c227576c93d33e08fe0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229641, "uuid": "c4255b95-d97b-456e-baae-efbc2f4a4089", "comment": "Malware payload", "value": "3776ebe6b740eee73c70729feb5b3a8e51757f032cd6bebb9982e1f738e4b825403e78c565418359a3f1561cddb756ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229641, "uuid": "89e54d8f-00d5-472a-9480-7525d4c3c63f", "value": "T1AE652352FAC08670C6322D3446F7AB717A3CBC2067B5CCE797547B1E9A201E09A36767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229641, "uuid": "a3af998d-5ebf-4332-8a27-936d4a6c1454", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229641, "uuid": "196677a2-6eae-4303-b1d4-58fb5efca08a", "value": "24576:VLeTtjJF5HrK7g8QENCX3UCIjBzMEryfzJMM0SF61rh1l3WQHiCXTl:VLYgcRnUCIjBTrydMMe1r/lmQCGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229641, "uuid": "c901921d-af51-40a6-a100-ae61585c045e", "value": 1489526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229641, "uuid": "0296fe3c-9eb1-4e42-acf7-415b2c09ec5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229641, "uuid": "87347eb1-edb5-4049-a6fe-34689e50b1b8", "value": "b5c120e7bfe4b8c19a90ada80512b169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c0db8f-aaa2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676184950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184950, "uuid": "2fc302ee-4c11-4e79-b1ac-a48158922fa9", "comment": "Malware payload (Smoke Loader)", "value": "f49ec67d39f760d9dc372095e819de9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184950, "uuid": "fc7f2bdc-336e-4a0d-a03f-3085cd7d113f", "comment": "Malware payload (Smoke Loader)", "value": "180ffcf3a5a95f9a005eba228227d2a68b81d58a924e3ea5b450a22e740494d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184950, "uuid": "27e56487-cc46-4fb8-8ef4-27f6bd57fa1e", "comment": "Malware payload (Smoke Loader)", "value": "43d9ba5172f5b1e6eb57d469ec539cce1e28541d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184950, "uuid": "4597d856-55a9-4ec3-ae31-c9cf0fb96940", "comment": "Malware payload (Smoke Loader)", "value": "befe6159c1b909c7033c1565e65d168db16f8cdd605c0af360d92e5ed7366b575b32b9e52be74c63dcf2c20ffaf0bc93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184950, "uuid": "22b4a275-aeec-4966-aa77-7ccfeca05880", "value": "T10414D03136A280B2F55749B51831D694EA7F7CB26B5581CB230912AE1E333D90FFA31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184950, "uuid": "daa24980-ba16-4a65-984f-e0df9c845978", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184950, "uuid": "d957ae99-c997-47c4-88bf-67468f322444", "value": "3072:9jq666+0JdnG5CPZdnIufiIcQhtlW5BvIW2nOjMU1E7TJDY:9GeRPPF6Ibo5SWcOj36TJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676184950, "uuid": "029c0f43-cc93-4018-86ba-407b58e7f48a", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676184950, "uuid": "c0b3111b-2bae-41b0-841c-6fb3fbd7ff04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184950, "uuid": "8ceb45c6-f8e2-4aaf-8459-78f301f4bacb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41309b25-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676229175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229175, "uuid": "017a80c1-79bf-4731-8e16-47278dc3cb71", "comment": "Malware payload (GCleaner)", "value": "1cd9d05f69fcf8357f67c7a235ded9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229175, "uuid": "346b64b8-9560-4b4c-93f9-b233a286f200", "comment": "Malware payload (GCleaner)", "value": "183980cbe08b23d76cf678d3587ccfba2981c0e7ec2994fba29b95955ec2c11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229175, "uuid": "9fb82312-50f5-4716-933f-14baec03dbab", "comment": "Malware payload (GCleaner)", "value": "dc0a184f0eec8f8022da5c3efbc523094655f849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229175, "uuid": "6a0a993d-9d37-435f-9e7c-0d28ec1d8e8d", "comment": "Malware payload (GCleaner)", "value": "83f592ca820680737e37f66647942fdc42fa4f62fe26f47e8c3bf6b94a8e2690ed5e1e170d2dd2418c18d8211cff6222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229175, "uuid": "7055af2f-3051-4880-8abb-c2da7bb7d23c", "value": "T11544F12439E04432EA9A71B12931DF92296FB97627A5C1CBB379224E6F313D25D343C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229175, "uuid": "58c3e1f0-513e-48cb-b311-67d458934a12", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229175, "uuid": "3277f539-0634-4d38-8f3d-5fcec2539f4d", "value": "6144:wGDRntNOhRbrP/8zmb9jyAMB12n15pXjX:wGlnihJ8Ityonnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229175, "uuid": "f7898c9f-e6dd-420b-b93b-ba837ba6efc5", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229175, "uuid": "cd69be5e-70fd-4c8a-bbf3-03d2a00fbca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229175, "uuid": "21924640-daf4-4b3c-9926-cb6677daf3b2", "value": "1cd9d05f69fcf8357f67c7a235ded9b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ae8fdd-ab07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676228322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228322, "uuid": "a97d469f-78ab-4b0c-8515-f41ad955d438", "comment": "Malware payload (Smoke Loader)", "value": "c62d0e6b08372bdf718d93120d3bc68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228322, "uuid": "e574d3a0-1626-41f5-a6ea-2c485d15ec70", "comment": "Malware payload (Smoke Loader)", "value": "1a28123e32b8df8688f8311cd6f01776ef8a1208ac28501529322ae2ea951e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228322, "uuid": "16e7b1f4-f219-47d6-8ce7-1e448a3dd641", "comment": "Malware payload (Smoke Loader)", "value": "84cd698cf0298a28b13a2cb3102ab63d548ff8dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228322, "uuid": "309d3a74-e978-4a88-ab21-d1af5380c2e7", "comment": "Malware payload (Smoke Loader)", "value": "06efa4c386555568177f9ceca091d88c32fee3b37325e7ad2a663c22f536deabcb90e9cae75d25db816328bb25ddf59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228322, "uuid": "0fa8e417-275b-4b7f-b4d4-bc9c1aca4738", "value": "T10314CF1176A1C073D2F745741420DAA4A67FBCBBA761C0EB23480A6F3E217D1AA7E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228322, "uuid": "3e2863c5-2306-4e54-a764-b5bf652d0296", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228322, "uuid": "f042f445-cf79-49f2-bf01-31e440ad7159", "value": "3072:/7YCa+HuNW56Gq4PzErdzOSrB9c4bKiD6u4YZ6ei:T8Cotz4PYrdz3ZDP4YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676228322, "uuid": "ef7bc534-bda1-4e02-8754-5331105a19e0", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676228322, "uuid": "97f65d88-0642-4d1c-995f-93a754e17846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228322, "uuid": "b3df177b-88cb-408a-9290-00062aad5dc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea326e6-aafa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676222916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222916, "uuid": "d3955ddd-c71d-496f-85e4-d2fdd828f2d4", "comment": "Malware payload (Amadey)", "value": "c4008af331fd84c5a5e728c1682f9f7f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222916, "uuid": "908ac42d-c563-4b8e-bd91-4a5b7c10a822", "comment": "Malware payload (Amadey)", "value": "1a529f066acec69f89305faa748acfbdfe08b560b605b3efc39dfae2f36815b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222916, "uuid": "c627de7b-23a6-4c11-88f4-7bfbfb111a76", "comment": "Malware payload (Amadey)", "value": "5f0eda6bd7e1457dbf3ee6252e88b19d435780c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222916, "uuid": "77d43522-d146-43e2-8dd7-78ba08fa2266", "comment": "Malware payload (Amadey)", "value": "0f5e4ede2d068a25e8d10b6a964cce13271bc095c10938ed75e052609fbcee7338c9dda3492cfa4b90bceb11a9415f51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222916, "uuid": "0f8a41b6-aa1e-4fca-b1a2-5ca2f4762af9", "value": "T12CF4120BB6ED5122E9F5A7B005F703E31A367D616A78921B238E7C291C32AF07571727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222916, "uuid": "a4298291-f8d8-4ced-9b32-4907e9fccac0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222916, "uuid": "78b1e106-634f-460a-9247-c8dbdc2dc349", "value": "12288:qMr8y90qUaht26vFtY6dX0v5n9UlaITDUeJigkx6ZFrr8bvWm2I7Y:GyNL269tvXE5nyUITBigACf8bumjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676222916, "uuid": "f4b36861-8ec6-46e6-b10b-5c0131d62a0f", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676222916, "uuid": "81171aa6-3ac4-48d7-8739-d90581de7045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222916, "uuid": "34397bfb-c8ec-454f-b93d-a6bce56352aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dba808-ab14-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676234047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234047, "uuid": "17ddefe0-3fe6-498b-861e-3e0761dbd4f2", "comment": "Malware payload", "value": "0964d6cfdc4590ec10257fe389e6bf05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234047, "uuid": "7300c786-dcbe-4950-a65d-4cbf74d724f9", "comment": "Malware payload", "value": "1a8e115ba688aeb93e4d31e817ae011930d28e230f84421833d2fc30807130b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234047, "uuid": "d18a802b-a26a-4c59-a81f-9f25a7ac31aa", "comment": "Malware payload", "value": "42e2445294661cb5108c7a1933ab723db2ff868f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234047, "uuid": "63bd2c84-e8bd-45fd-a2f2-6cc4f7e6c80f", "comment": "Malware payload", "value": "b69d2dd1b68c83e692a8df50af3152655d281cf28b61a60b8357c8bf2452660e3a6b2128b982541366bf93cefea7b1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234047, "uuid": "c5557132-fc57-4a3e-89d8-5afbdd0f166a", "value": "T1D3F4124BABE8C062D6B51B7108F647C31E363E51AB38439B334BAC581CB36B5A571367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234047, "uuid": "c19cba60-ce72-4e7d-9f51-d9a59f869f44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234047, "uuid": "7a53f842-97b6-46d9-b328-5325f5d8e180", "value": "12288:SMrty90FkaVSlt845NQfP+Q5xt+vpHHs8eJYS3vjxdI/B6KZivYntVh:fyifVP46mqt0pcT31Q6Kcv49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676234047, "uuid": "bc097cbf-8bbf-44f3-aede-f3aba8845a69", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676234047, "uuid": "63dbef99-8f3f-4007-86e5-0986ecfc03dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234047, "uuid": "42ebe72e-3fc2-4de7-99e0-8e8b4d4522b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee02818-aaf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676219320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219320, "uuid": "75c87eaf-9ff4-4c15-9c46-8ae5c00f8bca", "comment": "Malware payload (RedLineStealer)", "value": "c0b1567e227f3e81f49137321444ce2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219320, "uuid": "a0836b87-b379-421e-8d43-20e18df740a5", "comment": "Malware payload (RedLineStealer)", "value": "1b3a4d8fc2e6b0be4eaf22931be439e6f3b1ef9aea86df5910a2297fd695502d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219320, "uuid": "f92c6075-4c78-4b18-b40a-411e37a75103", "comment": "Malware payload (RedLineStealer)", "value": "c7316d0b093718b8e6dc92432f3ed5f9a30e5c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219320, "uuid": "6f59d1fb-0e44-474c-93b2-1cb6338ae59d", "comment": "Malware payload (RedLineStealer)", "value": "95d8ef00fdfc8d410b7526651a0860a821b506d73ff0e18672040fb33be57322535bb8a5b18edc91f2993d342fb8956d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219320, "uuid": "f5e742f6-c0c7-4c60-9028-facf67577ae4", "value": "T10AF4120BF6EC9532E9B077B10CF207D31A72BD601279961B2B8E6C191C736B5A274727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219320, "uuid": "a3a85953-32b5-45e6-9b91-f95810f0ad51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219320, "uuid": "f8f62396-2e04-4b7c-8c5e-df0e2937054e", "value": "12288:+Mr8y906J1sKODnKPgcWCju4rcCeLYceJ3yLWs0QvTiaS8EhiV:CynCJDnKPgjCjuqJeUcDTc8EcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676219320, "uuid": "c8f5f994-8c79-4d8d-bc63-dc03971acf98", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676219320, "uuid": "0644b3b7-8fd7-4f8a-bcbf-15813f876dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219320, "uuid": "bd9a3a48-30b0-43f0-9fd8-c66b49b66e52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f084ac9b-aae0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676211860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211860, "uuid": "1edebc09-e531-475a-96fe-7367223ac68d", "comment": "Malware payload", "value": "00daa028a06708cbc93c98b18e5c8c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211860, "uuid": "73b1b49a-f540-4922-81ee-55532732903b", "comment": "Malware payload", "value": "1b46c5ff844dfbbad78672410cf732f057b6b90c563f17cff8ce88c724b0f45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211860, "uuid": "50f9380f-2517-45d5-92c4-2e25c58ac6f7", "comment": "Malware payload", "value": "d344a98d00de4fb901c4a7c8b3b1f3bfd81a98a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211860, "uuid": "ad69a557-0752-4fc0-99a0-2a30daca3753", "comment": "Malware payload", "value": "b5ad80a1285f26e7355a89dcf7233711c46770b309f4dad3327b94d8b71cdebfb16e94a92dbc6e81fc902db6de62f8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211860, "uuid": "e09649bf-7961-42a3-b0ad-bcec1d04e4da", "value": "T108F41207B7ED9022E8B597706CB702D327727E119A34934F634B6D5E0C726A46239B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211860, "uuid": "d45ce05c-0cf3-423c-b33e-a7fa5209121e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211860, "uuid": "03510412-4ccc-4961-93a3-4d8f6758dc77", "value": "12288:LMr9y90fjTbVtmQz78Nvk6wOGJMm9idBLceJDFWJFrgNUftOgbPtjaPqBvR:ayEb2Qz78N7whJMm9SZDFFWf0gbVjsqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211860, "uuid": "5d5f6893-658a-4308-a8f1-6b98f30afbff", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211860, "uuid": "7495ad6e-8935-4f43-9809-d909cd870f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211860, "uuid": "f2676bfa-01f4-4cc7-83cd-7721b92c79b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc02acf-aaeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676216336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216336, "uuid": "57bf1b12-807f-4d60-8c4b-6945892479cc", "comment": "Malware payload (Smoke Loader)", "value": "0458a10f833654dd1273abe7e95ffdc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216336, "uuid": "fd7fed74-8686-4b3b-87d9-4eea192e7e18", "comment": "Malware payload (Smoke Loader)", "value": "1b5ad939397e7bcea508747a3c92d06d5ce64e944f8ba908688be7d0dbfb13a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216336, "uuid": "3af1c074-8639-4c84-8542-47c7ab8e47d3", "comment": "Malware payload (Smoke Loader)", "value": "bb3c65a5fc14276b2bbda8444d88ef2c4c850696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216336, "uuid": "906ac94d-710e-4797-800f-567df3c5981c", "comment": "Malware payload (Smoke Loader)", "value": "713aa78ca19a9cc42755e4f1d7f1c8d42da636d8be27e82b1775cca3b2045bcac2a9930cd08eea92bbbde58e52f10995", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216336, "uuid": "4202b8b4-4d51-4514-90de-a5daaad6e4ea", "value": "T10F14D0513961803AD44F46B05432DEA06A6FB8B167A2C1FB27881A6F5E307D14EFD35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216336, "uuid": "41d97e70-77ee-408c-b1f0-15a4e1dba0ce", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216336, "uuid": "927c5371-8666-4c44-8388-68b46eda7090", "value": "3072:179r+rGJ5iPQ+1pJcuZsUB2QLJx3jObSz7IdF:R5LmPQ+1DEY7LTISPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216336, "uuid": "fdd2f731-0945-476d-a69a-30fca32a0ca6", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216336, "uuid": "20cc943f-0000-4e52-8ab2-dfbb66a50135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216336, "uuid": "e0db4ae9-9e12-46a8-a241-f310fbf543df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecb397a-aae6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676214112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214112, "uuid": "465eb70d-b29d-4931-a2c9-0d280b6c40af", "comment": "Malware payload (RedLineStealer)", "value": "4f09620923bc6a8092952ccb743d76fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214112, "uuid": "1e6a16fe-cbd5-4ec1-935c-b0d71c251f93", "comment": "Malware payload (RedLineStealer)", "value": "1b66f5bc2ab88fb6a30d060eadbcadd9acabc3f95670cd58982393372bc2c7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214112, "uuid": "fc53965b-9df5-4459-8fd7-f1af9567f3b3", "comment": "Malware payload (RedLineStealer)", "value": "90f99f44cb69987a7ca88eb52ebc0ba4dc81500d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214112, "uuid": "33fc904e-5647-42d7-a038-70048c9f781b", "comment": "Malware payload (RedLineStealer)", "value": "cc993989e1c4874079cdaba3b8cc9cd580747491794470c5863a95ade917377dc64d1790cad02d546e9e8a5caf584c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214112, "uuid": "604c45a8-3e63-423c-a103-a16f54ebb416", "value": "T18654F11175A2C073D02786B82822FBED667BBCB2575585C7335C1A2F6F207D24E3A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214112, "uuid": "b976265c-e4cb-4f7e-9396-eaa41846fe0c", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214112, "uuid": "9b61856e-ceca-4d3e-b347-46c6d4ba7ec6", "value": "6144:UTLPgZgzAMeTtPeU9K55GqCHiYwUDZrnc:UnYFMwNQXGqCHxHlrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214112, "uuid": "041e73ca-f134-4074-b166-3ae7b2c6770e", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214112, "uuid": "6f27a473-d3ec-488d-87db-7d52e7ccd64c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214112, "uuid": "599c79b8-e368-4b33-bf23-578fd64d37df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bedaccfb-aa6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676163243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163243, "uuid": "40ba6559-66be-4977-9ee2-af607358b3c0", "comment": "Malware payload (Amadey)", "value": "c940b04511792934ff73cf5ad4305d66", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163243, "uuid": "f53dde60-f267-4617-a622-cfb7de567c29", "comment": "Malware payload (Amadey)", "value": "1b6f7821a2606f08ff2aa315e6c9a48e21f5aa3ecc7d5f3b439cbf9d4a8a085c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163243, "uuid": "59b2842a-37dc-4c3a-bfbb-b9055c13e891", "comment": "Malware payload (Amadey)", "value": "a7260d081e54d0cd9050036811394f448b8fb564", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163243, "uuid": "f2dc0e78-90bb-4584-979b-e2c6a58b0d73", "comment": "Malware payload (Amadey)", "value": "0bc39265743bbece3e156c78e2d008794e3f1ed20a2e5d6cead3837b5398cb2af8afbbb5a561ab93b7abf415756803ea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163243, "uuid": "1f4272fc-9d71-47b6-90b2-9e00c757086d", "value": "T19FF41207E7E9D132E8B557B01CF603D31634BE615A38925B678F3C1A1C735A4A238B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163243, "uuid": "e9b404ef-4c6f-4023-a171-cf779ce124db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163243, "uuid": "765f7ed8-1850-4d79-a764-a8636147fc2f", "value": "12288:TMrvy90PnlLjH3tXxDVUvvpJd2SkBMk3+eJKbXCcxwPvqajOmXWuNSVkoQ+/x:Qy0BjXbMv5mMYK7CpPvqajOmXpSVki/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163243, "uuid": "091c5ef1-7c98-451d-8946-3f2fc2256cd6", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163243, "uuid": "820312d1-55e5-4266-a8f4-cd6dbd6d552f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163243, "uuid": "ad9ac2db-9eb8-4c5f-a6af-97e8068ead38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f7ecc3-ab21-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676239788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239788, "uuid": "28a3b219-2366-4fef-ac2f-c90d986ee50f", "comment": "Malware payload", "value": "98e5f60a554940f34408e7c9045a47a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239788, "uuid": "c661dd25-7147-43bc-a6b4-44532962c12c", "comment": "Malware payload", "value": "1b804bde0413a8b31a78e8f9464a156f5eb94b964f399fcf4d2e42ba372b2c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239788, "uuid": "b3549805-d6aa-44b5-ab48-c15583eb0800", "comment": "Malware payload", "value": "7de7bc6eb41e86e201526a7e480ae6387ffe5dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239788, "uuid": "6a1f8e62-dcd0-45e5-bb4a-9c1f60dd2511", "comment": "Malware payload", "value": "676a71de2599e23099d2d0582cfe1aca80e7733cd00a81d0fd18e65872f797a8fc435a7138be0cee2f63ff46482ac391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239788, "uuid": "2d751663-a789-4473-9dda-b28cbf5026bd", "value": "T1C7F4124BEAF88033E8B467B029F603D30A3A7D505B39835A638F3C191D725B8657576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239788, "uuid": "1625d464-9f60-440a-967a-056708b2d53b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239788, "uuid": "56567d6c-b398-4576-b681-fe5292f8376d", "value": "12288:SMrFy90ac5keVQj+WqB0fwreJaQC0jUYP82CJDK073f+PC0M:/yOku9Wq+fJaQtjLADVfUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676239788, "uuid": "50e1068b-8764-4ff1-9858-785630ab38d0", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676239788, "uuid": "5f4fb409-05ca-4c8d-ba5a-566c1cc04083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239788, "uuid": "48db0379-c216-470d-bb34-7b6631303ff1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b70e031-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676229649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229649, "uuid": "1615122a-bda2-4b3a-a604-94b2220f617e", "comment": "Malware payload (CryptOne)", "value": "e0c3ac51041a93810dc44631cb0caa85", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229649, "uuid": "3f90aa57-ea6c-4b69-baf5-8d6d89259ba5", "comment": "Malware payload (CryptOne)", "value": "1bf670a7849de0a9248d907fb026a6359cb0b1c3f1a5ecb52bc18fbad7d6df05", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229649, "uuid": "d8382386-3784-4c6e-8fee-e24be097c31f", "comment": "Malware payload (CryptOne)", "value": "2a7747453ae328e627a290ffeed517434ad5fe2f", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229649, "uuid": "c653b0f6-1612-498e-8624-5aa815a73ff5", "comment": "Malware payload (CryptOne)", "value": "c3d145c41934eae42f157332856c4170e04f19a02f94471a90a9976a86c9edea3e845581e8617d1f3ee07a369ff5a788", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229649, "uuid": "126b8eab-5cbc-4d32-a651-5eec817c3b31", "value": "T1E6752221BBC1C872D9A618350AA5A7317B383D305B798FDB57885B1E9B311C0AE34B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229649, "uuid": "7877ad73-5212-4d86-995c-baad2297474a", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229649, "uuid": "c702fd0c-b817-40a8-a717-bae6e1f16959", "value": "24576:JLllLl7tEtFbM1P2G8PMo5i1fI2t1CkYV7RpkQdC2R9RJtqRhWFwbUgFgVum8:hllL8Fb/Goh4BPtKdw2R9sRhWFM/FOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229649, "uuid": "a9cde749-8e64-4196-9e64-a67892f94152", "value": 1612073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229649, "uuid": "c95c9098-6186-4640-aa36-4b54ef737765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229649, "uuid": "6227845f-6ccf-461e-9085-8cb3a4667ecb", "value": "e0c3ac51041a93810dc44631cb0caa85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d574c120-ab24-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676241020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241020, "uuid": "8ae754a2-021c-42d5-ab88-d441b6db68af", "comment": "Malware payload (RedLineStealer)", "value": "21e688d6cd359552ae9ba7c51e9ffd63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241020, "uuid": "fb7ced27-0d91-400b-82af-4628b42eaba5", "comment": "Malware payload (RedLineStealer)", "value": "1c2ba6e06c4580fcc1cf4cf52302ecb40e38834c858a495c259c6698938b3450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241020, "uuid": "6f9d85ac-12c4-4612-baff-2ceaf0a60d67", "comment": "Malware payload (RedLineStealer)", "value": "1b7172c98cabaa0e33b2ddb91a5b1573428eef48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241020, "uuid": "8a6b34f6-feba-4ec4-aa31-5e5bd8f4453c", "comment": "Malware payload (RedLineStealer)", "value": "244d6719838402ab1956644af08b6973a73961d46665b46b846f229bbcce0063f80b1ff1387c23e32766a2079ee05612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241020, "uuid": "6afbd832-573a-47c2-8ffa-325e2c6a0bd7", "value": "T19A54E11179A18172F0B385362B21E6E1E92A7CF397A1C5D7231516BF2E227C08F75327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241020, "uuid": "6f4854fe-6036-4c14-8754-6f0d35144773", "value": "e846e4e65f8973af5941088654b5219b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241020, "uuid": "966c56c2-40e2-440b-9933-58199d01ef18", "value": "6144:9JoHq+YPnJChpYgT6QTI5IA4TbcGjr4j8B:97kpYgT6iQEU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241020, "uuid": "21c5d619-5d21-4ec4-af8b-64a89088b33f", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241020, "uuid": "1e689209-fca2-4469-9105-5dc573658c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241020, "uuid": "9da4f87e-ff14-46e9-83cc-7637b5096e50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a9e115-ab2b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676243735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243735, "uuid": "c914de85-24c7-493c-b1a0-5630563d1c7c", "comment": "Malware payload", "value": "e7b3559fb04f8afbb040663b61936f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243735, "uuid": "7daaf0a9-43b4-440b-92e4-b05d12ea6b90", "comment": "Malware payload", "value": "1c81b37b21a68f6058062a4f85ef004229492152292cf8f27b5888ef0f75ab0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243735, "uuid": "fd998810-ef96-44ec-bcc4-1eecb005ac63", "comment": "Malware payload", "value": "66ba4aebd4424fb66b459ca26476a5d69c83bbf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243735, "uuid": "6917b1f4-3199-478e-8ddc-c518e99d5c30", "comment": "Malware payload", "value": "70ed8e196980a4a2a8aea5408ab8d81ee3f63eb5c281bcf54a63ec4b77f07df6fcdb9479df5a0c018975073929e21981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243735, "uuid": "1d7332c0-8147-421f-9fd3-4a82c6126f5c", "value": "T19204DF2179A18072D55B477B9431D6A8EA2EBC31F7E1C0DB335407AF1E302D19ABA397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243735, "uuid": "1e2c2311-3b8e-47ca-b8c5-edf125cd6f5b", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243735, "uuid": "3aba1baa-e402-4d5e-89d5-10d9ddc4badc", "value": "1536:qY7BZF/04hSLbkm95HAt7eydXXKtB8AtT++F6PbOLFeK034uVffCPrHhVYIaTxUd:qIBZC4ix5Ho9Knq+F6PKBeKWkLgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676243735, "uuid": "fe1c0aa3-d295-4516-a2df-2163247bb466", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676243735, "uuid": "6cdb1c44-ea9c-43d5-bee1-af396db6e0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243735, "uuid": "34d56e8d-8070-48ea-af15-6298f735ce18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5ea163-aa85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676172606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172606, "uuid": "01a9034d-367a-4247-8f83-9465335970ba", "comment": "Malware payload (RedLineStealer)", "value": "151a48d300fb54c2fcd8004ed6af31d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172606, "uuid": "c8817a35-df14-491d-985b-e7529fb7b2bc", "comment": "Malware payload (RedLineStealer)", "value": "1cdac47c375f816d89c503a08345e8857de52fa46c56ccae7eb0d508d654c3c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172606, "uuid": "8a7a3fc6-9283-4380-b106-b74debcea560", "comment": "Malware payload (RedLineStealer)", "value": "4b3e0c0089f9b411407f4abaf222f1b6892f0a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172606, "uuid": "1c116ebb-af76-4144-a503-7f2cceabe33a", "comment": "Malware payload (RedLineStealer)", "value": "4a39dace5d52ceed6b91498df63366d1f811c654d2dee2789fb5c398fe2bb12e01750a6d93362f9a9d647cc73b80747f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172606, "uuid": "dbbfe003-fc76-4258-bd8b-2989ffbda152", "value": "T13CF4120BBAEC5032E9B957302EF207C31E7A7C514A34926B779F6C4D09326E4953276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172606, "uuid": "c301306e-027f-4034-84f3-c571ca51f891", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172606, "uuid": "11a1bc95-c438-4a86-baa0-e92de83e6cd3", "value": "12288:4MrLy90Qb5/rBGaex/IQ2HLPxYtbh3XeJFU42EvEoOHw/SWLIGOR3heiI:TydbJlVA4LxYtCFwgEtwKwOR3Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676172606, "uuid": "a483ea51-f058-46ff-b401-ea66ad130340", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676172606, "uuid": "03a630fa-cee8-4f68-bc6d-03296373cd39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172606, "uuid": "0b35d8fd-9ff0-4352-bd92-1ebf5aa83032", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c073a7-ab11-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1676232919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232919, "uuid": "db0a146d-ecb6-4d74-b88a-48ae5b85f327", "comment": "Malware payload (NetSupport)", "value": "310eb005787e74125cfd19988396e36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232919, "uuid": "184697d3-7f17-44d4-a6fd-d1e332891eff", "comment": "Malware payload (NetSupport)", "value": "1d3205c80e2291cd3a290a06cb42d5ff80f3b2e4a25c6efe2eddc509b0675dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232919, "uuid": "7eff03f6-de4b-4344-ba15-6a645f06311b", "comment": "Malware payload (NetSupport)", "value": "4e59dac1c9873b6218bb55e95f26ac33ef05f140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232919, "uuid": "4aa01587-7ef9-4c3c-8fe7-75a1d3496a05", "comment": "Malware payload (NetSupport)", "value": "19f4fad5dee3e2476864ef6f439ba74b39e2d32e3a4cff1b096b2ddbd16d6f3210f236cbe68ae11aaa2bc767da5a79e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232919, "uuid": "4aff5b7b-61ca-4415-bfa3-c07fbf92f24d", "value": "T1A5A5120F35C0D572C072153F5E645F91EB78BD202AA4B5DFA3A0165EA93F4B05A33BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232919, "uuid": "3fc59764-66bc-4329-b22d-4692c11a19e0", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232919, "uuid": "33854254-1fcb-47e0-9a27-184cadcd96ec", "value": "49152:ETHPKCtf0EkHbG+c6cjeroadWogH6wW5eLkDwC6Gtu:ETiCtfsc2rECe+7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232919, "uuid": "ec64c6d5-c0d3-4d97-b583-cd0018864074", "value": 2180920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232919, "uuid": "e42df487-5bd7-42dd-8ab7-ab780c14cbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232919, "uuid": "89256c3d-d20c-4dd2-88ec-d8357d85e61b", "value": "310eb005787e74125cfd19988396e36e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ba8b3b-ab25-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676241125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241125, "uuid": "ecc822a2-f2b0-4e3b-936f-16cf609849ab", "comment": "Malware payload (Mirai)", "value": "f3114dc8864b910de659c80c58b6a784", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241125, "uuid": "feb00ced-37b4-41cd-970d-ecea5f08fe80", "comment": "Malware payload (Mirai)", "value": "1d58548510002986581686c990d8129a2de80eaf04cadf26387e2a2a24548314", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241125, "uuid": "45e5eb16-5dca-4831-8da9-845733d74d96", "comment": "Malware payload (Mirai)", "value": "29860affb8bf9bf12f4e4cd51d6880fe8cf4b9db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241125, "uuid": "e940ebb0-3dcc-475c-84c4-3c89e2f0be8b", "comment": "Malware payload (Mirai)", "value": "b95019c31be817602438227b3348df79939aac2917be91a33e89bb6894204691e46241575049ba2d665cb7c37357b50c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241125, "uuid": "2f03717a-acb8-42fd-982d-96d381740fc4", "value": "T18B43751E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241125, "uuid": "5404b30c-14be-4a53-b308-bde77e080df4", "value": "768:bvaLxUxyQpPT5rhmu3rFtmmSnoh2Lt3ug+i1EZi0e4fyMnup//dujgtywaz:bvJFP1jtYF+i1x0lk16gtLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241125, "uuid": "18cdcfc5-3ca8-476c-955b-7d1a26a5e951", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241125, "uuid": "1a05e32b-0148-4a37-b2d2-69145ecaf593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241125, "uuid": "e4583fe3-c9cf-4d31-8c47-fa95d6c20831", "value": "f3114dc8864b910de659c80c58b6a784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229a6ca7-aab1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676191328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191328, "uuid": "18990182-42e3-4ced-be99-c5516fb4e7fd", "comment": "Malware payload (Smoke Loader)", "value": "8ad489a8e94d01c15ad78843e0719288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191328, "uuid": "da5d1e5d-d595-4b67-8086-5757752891c2", "comment": "Malware payload (Smoke Loader)", "value": "1d7021756ccaacb34ee59cf131e3b1b3ae688edd103fcef18c60606b5e14b21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191328, "uuid": "26896f6d-c0f6-4152-8fa1-31f47c019ccd", "comment": "Malware payload (Smoke Loader)", "value": "d645a57c846b41a8c67e1dbd1e20dd59fc01d5aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191328, "uuid": "f6b4c423-aeee-4055-be21-4cbcf7d8c005", "comment": "Malware payload (Smoke Loader)", "value": "ec6cdc8b1cf788aceb6bfff82a45c044ff3f1aa75fc752fe9608775ae9534ff19e0a9e49d037b2aaf10adf74a3b5e82f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191328, "uuid": "1ea82161-a0cd-48e9-93da-960af2bf6558", "value": "T1EF14D00132E28C73D5E781B11935DB546A6FBCB257ABC1CB230606AE7E213C15E7A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191328, "uuid": "fbad638d-4618-46f8-b286-59258ba95177", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191328, "uuid": "5778559b-cf8b-4672-a5f5-0c7a13260682", "value": "3072:7jqm4U+0JCiC5CCS6/7RrrZm9Qj2zZ2VCKMJ1bgfhQARR7TJDY:7GGRjb67dlC1bWhQAR5TJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191328, "uuid": "15dd552e-2135-484d-88ea-231aec9cc3bf", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191328, "uuid": "dba8e8ed-63a6-4061-b188-078b7dc7fa61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191328, "uuid": "cdb3d5b1-b3c7-4ded-a044-2757966cbe4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c092032-aa8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676176821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176821, "uuid": "e58fdd07-338a-45a2-b56c-d37ffd974da6", "comment": "Malware payload (njrat)", "value": "c3b44ce30c006093991500a6d5de5a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176821, "uuid": "b5bdbd3e-ef9d-4221-aa90-91cf977275f1", "comment": "Malware payload (njrat)", "value": "1dd75c7bc7d6b739f18be6f7de5c653bb364ca72089b1622a9f4bea49d2e6c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176821, "uuid": "af373dca-ec4d-4341-a3f4-2b4e1a2d0e15", "comment": "Malware payload (njrat)", "value": "12a58af9d066ea146799d04a076266289b0b0819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176821, "uuid": "b7972668-36a2-40d5-b18d-e95b4b6641ad", "comment": "Malware payload (njrat)", "value": "0b0b66d9767b21fe41a0347805c1cd1b9224dd68ff4e2d4ceb65edd6c648bc02f738be7013255c71ed04133da21b7879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176821, "uuid": "60e21734-0f83-467d-a30a-4978110f35f8", "value": "T17594297EFC7E7653F93C2A70C933C47442E1D1966D23F39A19D508E02B68A0AAF5B944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176821, "uuid": "660f0416-a861-472b-8343-aec8551b380e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176821, "uuid": "aad4af66-a194-4c6b-844d-04defaa18269", "value": "6144:bMdhTPM7rLsvDSlwY0SyBmkBfZ3jKXeRdtJLAyZb6ZDKfMod+Wv7H0FCaqyvQ/:5aBmcJ2uR9Lcd2711", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176821, "uuid": "9eb4bee1-e9ad-497e-af12-1802805adfad", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176821, "uuid": "3e563b35-5f2e-476c-b374-8b19a2113392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176821, "uuid": "5f3b77ef-625f-4903-8fc7-db1a348151c1", "value": "1DD75C7BC7D6B739F18BE6F7DE5C653BB364CA72089B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae36a8f1-aac8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676201441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201441, "uuid": "7621ef9d-a5eb-452c-9a06-3b7911001118", "comment": "Malware payload (GCleaner)", "value": "5f7c45156947142df40790d3133ad0f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201441, "uuid": "acf118ba-04e2-4f6b-a535-1b075bf46cde", "comment": "Malware payload (GCleaner)", "value": "1e13e3535fc04ad7d73f5e962f83f7cde2b613387f60517793e0e9bd0801574b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201441, "uuid": "39e8b5cd-c65f-44f2-b58d-3a416277beb4", "comment": "Malware payload (GCleaner)", "value": "190ca8f10a44bf0f1e6230167d6983f648e6c42e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201441, "uuid": "5aed443e-2602-429f-880c-aaab5a6ae698", "comment": "Malware payload (GCleaner)", "value": "3f8c0123528e27ffdf77818482af00576e39ccc9100d602232219181c28caf7a0769e8c03354f670df53f57cef6b6931", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201441, "uuid": "e5cecf80-487e-4e1c-bb75-3d4fdf88bb68", "value": "T194F5223C7545C16CC280FEB48C2B99E75CEA6DE3E8A4A062B1C97F3F957D1858B1A503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201441, "uuid": "bfda46e4-f0a9-4a2e-8690-23861bc7e0d1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201441, "uuid": "39ccb70b-bc25-4f6f-9174-eb61e009768b", "value": "98304:JHg3h2CINI2Wovfpi0JQBxakZyX8gNSgofyV3v2MR:dPq2WOBihakZySwvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201441, "uuid": "69153e3f-0ce8-4bd5-a666-63f2a80abb28", "value": 3628194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201441, "uuid": "1a95d1ab-bd96-4b98-817a-1a926d9075dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201441, "uuid": "e4e6e13a-bd70-44e0-a651-dddbe2f0c5f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcbff63-ab08-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676228663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228663, "uuid": "a6672f28-c129-4863-8661-4ae0a21b0aac", "comment": "Malware payload", "value": "a15e27798e22ae3b1baf2b87b03a2d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228663, "uuid": "1133c630-3f12-4f95-8e0d-e56e160c27cf", "comment": "Malware payload", "value": "1e347d6ab8cd5523dda6974489677547163b951118e918ddef18c882637ce046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228663, "uuid": "451862d1-9d59-4c37-b2b2-76e9fa157ea0", "comment": "Malware payload", "value": "16ea20a08d29672be0e2704597517e2e7ccd82a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228663, "uuid": "acc238c9-b13e-4437-9a09-3bba404be270", "comment": "Malware payload", "value": "881680e4d66cd17ffde2178d3abbdf92eab7912ea87012f9ee89d0198972cb29bb107041f888c49b4c3811aeb2287004", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228663, "uuid": "c08c1613-73da-4490-b4a7-d676b2e30bb6", "value": "T18204CF3276A2C073D16644751431EAA4662FB8A15BA5C1CB3348DA5F1E303E6DFF934E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228663, "uuid": "839a1995-cc01-43d1-b7c1-31316a2961f2", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228663, "uuid": "f67df6d5-435f-4fff-92d4-df984b5165af", "value": "3072:57U19+Ha/cQ56/Tjjbu84NVn9PpJzUrX8lgn4OO6C748SyL:NCCn7j+N/n5pJQeghHo4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676228663, "uuid": "8ee23d60-496e-4726-ad67-59cdce6c4399", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676228663, "uuid": "c864161c-0dc6-4e0e-9897-f5396dab0be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228663, "uuid": "343edbc2-f214-453e-a932-add8178fed6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1a5403-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676179508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "f166dc21-5671-43d2-99a4-838500241af2", "comment": "Malware payload (Chaos)", "value": "53bd35774b8d36830b5bee75acf375b2", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "ede10819-fd2c-45a7-a59c-508c0d829a52", "comment": "Malware payload (Chaos)", "value": "1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "b611cb03-6612-4603-96a4-cc5d4b98a7c0", "comment": "Malware payload (Chaos)", "value": "c3a26e55ca87614b1eb94975d73aa39979654322", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "a29064e9-1ab6-437f-892e-6c6db4148823", "comment": "Malware payload (Chaos)", "value": "4b8d6c7dea2b61dc56067461bee2452faef25322275b572ff0caa8f35cfe97c99ebed5d8abcbd05fd4b93a9ffffdcca6", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "cfc3c508-5a31-45f4-9b82-054e4490ae6e", "value": "T1E404EE242DFA501EF1B3AE7A8BE4759BD96EB7732703546D20A103860723D42DDD1A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "f616adef-68fe-48ef-9087-c96241fbe99a", "value": "3072:b5BZ6q9elWNIG+9tv+9q9tBFKfpYnmig3/Vl0hpVervREDLUYwEx4:lBZ6q9Ju3HFKDi3pOeLb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179508, "uuid": "7da43ee3-a674-4eca-99e6-733121650f26", "value": 182477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179508, "uuid": "35add76d-efcf-47f1-8b5c-a32e470d66c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "4e1acc7e-4a5f-4039-8e24-80673c0f6431", "value": "2023-02-11_53bd35774b8d36830b5bee75acf375b2_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce56fe9b-aacc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676203213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203213, "uuid": "db7162a3-8a5c-49c3-8f6e-8e538eed1e7b", "comment": "Malware payload", "value": "0726c0703e86fd6d12a10c7b5c5dd106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203213, "uuid": "d0336f32-c905-48c7-bab0-b53e94e1cb96", "comment": "Malware payload", "value": "1f76f90eb1c9018725faadd98f50b98f5869527f7eb64d7b0bf87dc93b92103c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203213, "uuid": "e6f57aa3-faf8-4f2c-9e30-fe296d1bf0e7", "comment": "Malware payload", "value": "7b3d2ad1e8cd2f07d50eb7303f30d28089b88068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203213, "uuid": "84f280e5-cada-4a87-94cc-b597b3cb1824", "comment": "Malware payload", "value": "ddb00fc37ded82d3ade2acb6a239e8055b5c9dcf56a7ad1825bae36131771e38034abc9ad985c8982c2c05c32a2cbc63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203213, "uuid": "decb4778-8c25-4e8d-b89f-a5af950bb69a", "value": "T19EF5127CB541C8ADC2D0BEB4883AD8E75CE65EE3E8A4516270DDBF3F51B91858B0A503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203213, "uuid": "64273fd6-2b2d-42ba-bb59-74df712e14cd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203213, "uuid": "4f425204-a6c8-4612-bd99-9a44acbd739b", "value": "98304:JHkfm+1dqBGMyyLaTap+zrki585pjQ5MqqHTEJv2MR:dkf31ytyvTap+78qSTEJvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676203213, "uuid": "89a0e19e-c5d1-4d0a-93dd-44d8ee8e58a9", "value": 3448536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676203213, "uuid": "461493f4-5841-40d9-b5e8-fefbac5996e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203213, "uuid": "90385967-8897-4df9-af16-e4d3b3fff265", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2a08f3-aad2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676205517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205517, "uuid": "6e26e4e4-fbff-4147-98f7-611c8fcd78e5", "comment": "Malware payload (RedLineStealer)", "value": "81ddb1908baf2038b0ddbb74b3862c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205517, "uuid": "af226003-0091-4251-a72f-5479e2a37edd", "comment": "Malware payload (RedLineStealer)", "value": "1ffeea343a866054e5d3de8685754b6fb6c61ae0005a7a2e9abf1c5a2a98a4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205517, "uuid": "ade84e12-1748-49f0-b1df-44395f84caa0", "comment": "Malware payload (RedLineStealer)", "value": "55678217e50aa1d70dc869374c5043aad48823c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205517, "uuid": "67d22666-11f0-46d9-8d09-3515efb9ad16", "comment": "Malware payload (RedLineStealer)", "value": "ba094d1ce7e3ba7bbcb3becd515f0841117780ce00207e230da53ec892f3f7bc335b68b8768f825ab0c7fafbfe7d2c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205517, "uuid": "202b22a0-4035-42cc-9434-fd23f6eb3783", "value": "T187F41207A7ED9022E9F46B7018F603931A357E215B39824B238B1D4A1DB32F56736B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205517, "uuid": "1aaca2ef-512c-481d-ba3f-fad37a48a009", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205517, "uuid": "c7f1d831-27cc-41bb-89a0-382c749106d5", "value": "12288:pMrNy90jHttfDLrhcH/TGAV6KPNLeZecwq/MeJxzg8B+cPk4Cg95WDY8M+i1T:4ywHttD3hcfTGAg4GwqFxzg8B+iV95Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676205517, "uuid": "e490073a-a89a-40ad-8d97-93c88f864e01", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676205517, "uuid": "a0fe9d11-f312-401c-a814-1fe83cd907c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205517, "uuid": "2bcfd16e-a8a3-4e0f-b294-55887a161143", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ddd8fb-ab0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676230923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230923, "uuid": "9a9bbbc5-e003-4352-a10a-10830a80e0ed", "comment": "Malware payload (AgentTesla)", "value": "b298889e04eba183829e57b19a8e61b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230923, "uuid": "c75e30cc-8f01-4295-94e3-d944267a3802", "comment": "Malware payload (AgentTesla)", "value": "201c931c77f0183e82ceaa2e17de7664131e8fb81ca10e4d5d986815cdc989e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230923, "uuid": "1ffa89ce-789c-4846-ae5f-86559b11b3d6", "comment": "Malware payload (AgentTesla)", "value": "ad1b30960f9f4e25797d34a4ee25fbe1923799e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230923, "uuid": "fac7a993-0da7-4bc0-b720-a57411871b00", "comment": "Malware payload (AgentTesla)", "value": "574e8ad950e1d4ca16a0cede1703c46b888b6dc38de468c1819f4fb979b82ccb08f08ae7a5bab1fd3370a65da4c9884a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230923, "uuid": "7b238c8f-378c-425c-a705-6112ce230381", "value": "T19C257C321103BE8A67B71EC6E64027328C64B5278715D358FDD80FFBAAE6124DE55CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230923, "uuid": "b921e357-f039-4a1e-b113-25d25cbdf712", "value": "24576:qEtwdfBgstbCep23v/IbV/rtqIBFw4t9Pnbg+x3lgyPD5SN/QRsmqzxBI1wfFalC:NK8KWBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676230923, "uuid": "9afa8506-2d4a-4317-9d37-a5cf0ac71c6e", "value": 997336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676230923, "uuid": "db817ca5-18f3-4898-aec7-d8c76d798d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230923, "uuid": "da3c29c3-7ad2-4ab4-9b2b-80fa58004cc4", "value": "Ref SF08866198 - Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44a7bf3-ab1b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676237099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237099, "uuid": "f09df649-5257-4749-8063-926c0950e776", "comment": "Malware payload", "value": "1dd60df728b5ca99d901747d00044ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237099, "uuid": "68bf096f-09c9-49ba-a12b-962973a731e2", "comment": "Malware payload", "value": "2036ffa08f9f6408f0604650c9ae0caf894d7296357fd56d83b4b0c14b4f1134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237099, "uuid": "edbaf3ef-985c-4b5f-97ed-b739267d2ec5", "comment": "Malware payload", "value": "ce55b6aba15945f8449c5fa30ce7eedb77287a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237099, "uuid": "74e9d98e-c21e-4d55-86a1-b08442f39274", "comment": "Malware payload", "value": "ac72c81d8c5a6f931ec951f480ae4c16150f362fdc5cff03d5c0e0728bcbb36fce3abf97f3da0312ce1d2b6fb53ae397", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237099, "uuid": "74216e0f-5cb0-47d5-af99-dfaf464cd12a", "value": "T196F41207EAFC9032E9B4577009F107D3173A7EA05B38839B638E6D1958736A0B276767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237099, "uuid": "acd40fc7-3af0-4326-b643-9cc456087d18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237099, "uuid": "a5c114dd-ed4e-4009-b5a8-c1fae71bc4a0", "value": "12288:nMrXy90Jc1oSg5m0hixGt0qBm9z+eJ+QfcZgdlUUTQypsl0Ld:EyWyojXCGt0qBm9r70wfpsaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676237099, "uuid": "e18071da-84d5-4d8e-96de-06ab081d6c8d", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676237099, "uuid": "65005295-335f-443c-a6d7-fa80f1b22edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237099, "uuid": "f99e45ad-701f-432f-b683-8343a6e129fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86721463-aac6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676200515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200515, "uuid": "1cd87a82-b47f-4c1d-ba81-fcb66a91cd1a", "comment": "Malware payload (Vidar)", "value": "6651a257a47812c9fcf64788e9835a76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200515, "uuid": "87795fa8-5a62-49fd-8ba1-ad801e09a916", "comment": "Malware payload (Vidar)", "value": "203b08962eba219761690043281f81fc2d6e1fa26702bfa4ad30d9849b267309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200515, "uuid": "86b16087-7180-4100-a208-c4b1b16453c5", "comment": "Malware payload (Vidar)", "value": "d8b1f57af289a0f364b440dbb401e209201a92a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200515, "uuid": "a589711a-7ea7-4e28-b38d-2c42440f0a50", "comment": "Malware payload (Vidar)", "value": "aa5618d93dbf903f76579af13eecb5d335a067adddde9bb23e6e5162191a09ff6b88b071b56ad20888e7aa683b037c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200515, "uuid": "396fe948-29ef-448b-a4d5-1b712eaf068a", "value": "T12A753734B6FACAD1D6993638EC47B0F05920ED60C5A19E1F3D897EAA7470392F47025E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200515, "uuid": "f084ae04-2358-406d-afef-e0ede13afc91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200515, "uuid": "4639956a-cc3a-4da2-8f36-05d6801f2a29", "value": "12288:amvBcT9ref86xSX41QuvPp7Gh8ThsMEXCIQ6jL:pvKT9r6Y4iwPp7JVsMEysn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676200515, "uuid": "0183ec20-87f1-4d60-99d4-1c8794c16b31", "value": 1594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676200515, "uuid": "2d6b6c8a-297d-4fc6-b6e5-0d929457e34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200515, "uuid": "3606a11c-3f7e-418c-84f3-8b6ca656c35f", "value": "H&M Advertising contract and Payment information.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91bd26e-aa76-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1676166321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166321, "uuid": "5918ca5d-181e-4104-b264-3f6021d903e7", "comment": "Malware payload (AuroraStealer)", "value": "bc4a3561312ba8ffd09bda2d15b0241d", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166321, "uuid": "c5a161ba-5ccc-42f2-a604-c0257c34ecda", "comment": "Malware payload (AuroraStealer)", "value": "21a4b7100399b6a4fdbec12bc71e1695304f8fb420edd142e864b63beaf8387c", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166321, "uuid": "ba9529a5-8bbb-4952-9d7f-2db7f5e8a283", "comment": "Malware payload (AuroraStealer)", "value": "78e1a24e9e34a1c311cdfb2064170495aba914b6", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166321, "uuid": "be790278-ee37-4c50-87c8-5c7045254d96", "comment": "Malware payload (AuroraStealer)", "value": "18dc703271d069709e80e3d93d578eb40416bd37aef89781308d5da655b1db2998cbb85ace73e45a6a815482ada3e455", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166321, "uuid": "502737aa-db42-48ad-b14e-d893dac7039e", "value": "T1F8262847F89580F4C0AED230CA669256BA713C894B3063D73B65F3B82B77BD46A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166321, "uuid": "92a16cc2-2f6c-44c3-bb97-71162baf1735", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166321, "uuid": "9733283c-11e8-4c47-980b-120cafe56ece", "value": "49152:YK914SFUjxqAQp1uiGTJm7iAliHiWQSaU5EHDntGH5RDHW01w:74SkqmTJm7krEBGZRDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676166321, "uuid": "a7573d72-6b10-452d-9cb0-cc8f88dcbd90", "value": 4655358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676166321, "uuid": "4f571bab-8d67-4793-9129-d77a33e509f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166321, "uuid": "c0685c7f-f62e-47ee-bbe4-cda62090cc35", "value": "bc4a3561312ba8ffd09bda2d15b0241d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72fd5fd-aaf0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676218636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218636, "uuid": "14f3f8b8-1da7-4f29-bc46-7b269544b1a6", "comment": "Malware payload (RedLineStealer)", "value": "512195d5ae55f63630ce9d34c0b2fe44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218636, "uuid": "3c34f93c-eee5-4473-a3ca-0aa9ca9559f4", "comment": "Malware payload (RedLineStealer)", "value": "221af368b4d4f921d160e3ba62adf95e3a6453dba4e923198258aa815f247216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218636, "uuid": "f3c24bf7-d304-4645-9c71-da0690869ab2", "comment": "Malware payload (RedLineStealer)", "value": "48f340e1eb220242d3770d53e6e3c2b8edd2390a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218636, "uuid": "3ef750da-7687-4255-af59-06303b723d4f", "comment": "Malware payload (RedLineStealer)", "value": "37371e7097b00d3eb2c52bdbea9540b4876f1d55d733b4ae9d7b03bd0878c223828879dee534392e328c811250c057cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218636, "uuid": "d9ade571-1506-4e7c-ad06-616561b81190", "value": "T171F4124BA6E85532ECB25BB018F102D30A35BD615A38D32B1BCF7C590D722A5B679337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218636, "uuid": "7370f6da-c2cc-4d59-bdd7-376cd4609555", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218636, "uuid": "bf7264e0-6d0a-4829-97b8-8d2dd6c87df8", "value": "12288:7MrBy905IfZswfiA/898g0hBpCdMVUeJs3/ICmP4RJzLuX1+naZ:KyukmwfiF9t03pLs3wdWJGX13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676218636, "uuid": "b7431c66-2812-4f2f-829b-620d80c1e480", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676218636, "uuid": "6644f2ba-e6ab-4354-aab5-7253ac531620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218636, "uuid": "0edc541c-6bb3-494e-9cc7-f493a7d9ff19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4627e72c-aafb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676223170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223170, "uuid": "fdfc6990-5051-40c0-afb6-7c5b0189d55e", "comment": "Malware payload", "value": "4b27dbfcc02559f03719ce27d8c82dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223170, "uuid": "fa6ac8ce-0962-4e38-89ff-60b7edc2a697", "comment": "Malware payload", "value": "23f863382d97e8fb556df95234d7da5e3c8ec41505d4e809d0376ade814bee6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223170, "uuid": "fe6ad4e7-9fec-4d24-86e6-ab8abe5cc859", "comment": "Malware payload", "value": "d1ebe6a9fe090f47f2023f8454e8dff4db93c898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223170, "uuid": "5f1ef532-5ec0-4cf9-97da-1d9a9cf70dfc", "comment": "Malware payload", "value": "c28d83bf6c3fd6104575a1aa1647b8e12cf1836ca9829b0f667ea92e22c07bd9ade41c69b735200df4ac38649d9e15ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223170, "uuid": "a63183f0-ff29-4a06-97b4-83bb42c89965", "value": "T16A54F0017751E032D2B746B06B71D6A06A3FB8E1E79DC0CB33580B6F6E213E15EB6256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223170, "uuid": "b7831962-2adb-4b54-928f-80bc9e2c6e8c", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223170, "uuid": "03adeb78-9448-419b-8410-0ed04cbb2b11", "value": "3072:Z7ba+rG++Q5ikqGWwTLzRV/f/iQvcLAqwQAH5Ul5BzgcvWNETttgLPgt2tvbYxWi:tWL++HDw3t1iJ1wQQLcu/j6x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223170, "uuid": "5c45620f-50ec-41f3-98f7-6e6337f47d30", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223170, "uuid": "2e54e2ed-1cf4-41d8-8cdb-4bc71e71b885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223170, "uuid": "6cb06510-62c0-4da7-b1b0-4a3ef90b8d44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd0cf05-ab25-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676241140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241140, "uuid": "50eb7eac-dc7f-4345-8d02-79c0b012daf6", "comment": "Malware payload", "value": "d0c83263c37654a9de4fdd854c054933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241140, "uuid": "78238cfc-146f-40ad-bbc7-9b578db20d0b", "comment": "Malware payload", "value": "24873e3459d4281a6f23440ba5f68d03b232d673889a7cf9469ea9e28b748507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241140, "uuid": "f13f1f62-3629-444f-922b-a608fc1870ba", "comment": "Malware payload", "value": "097a532e82d6c7051d1e452ebfa07a75781c262a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241140, "uuid": "f1fb1f35-7331-4fde-91ce-521d762f0373", "comment": "Malware payload", "value": "3658ddbd3b8fc052a7b1b2480b49e3f0a8a5cd1d4318cb142889abb42c6b6352d7c6383d6d53cb1e9ac1627ed11e7c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241140, "uuid": "afcb6c10-326a-4434-a9fe-c4bc2e1f4752", "value": "T1D3764B07F85151E8C1BED230C62692A3BA707C894B3027D76B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241140, "uuid": "64503030-1825-456e-882a-efd99b70b6bf", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241140, "uuid": "ace91046-5268-4876-b0ef-359026285a49", "value": "49152:E+ECNZvZByPkPrb/ThvO90d7HjmAFd4A64nsfJpXvOFlPR5TjWcz5ycyqHpjA8cz:bHWafFV/N0ZvvPEFAzSGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241140, "uuid": "89e55d6f-a8e1-406d-97d0-d05768a6ccdd", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241140, "uuid": "f9a923a4-a8d2-4830-864c-c31d16d99ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241140, "uuid": "a23fb539-a612-46bf-95b2-1282754f01e3", "value": "d0c83263c37654a9de4fdd854c054933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b13abd-aab1-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676191365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191365, "uuid": "cf6a3849-131a-4b08-aa33-128b0d900ac2", "comment": "Malware payload (CoinMiner)", "value": "a1ab8ca7cee41564cde313f0d947166a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191365, "uuid": "47bf5254-e624-4db6-b294-d68f750fb572", "comment": "Malware payload (CoinMiner)", "value": "258c424258da02b0ee7e091b0fc689de0977b7d79e386094c593401222a98540", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191365, "uuid": "7992ebf8-1e8f-4f5c-90d6-e9625610205f", "comment": "Malware payload (CoinMiner)", "value": "bfbb4e15365aaac6a79260467f261405af20c27f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191365, "uuid": "2b4ff113-9c12-455b-95cf-058aa3004c24", "comment": "Malware payload (CoinMiner)", "value": "a6ccd1aa5bb36af2c287595b33359f57e0482340c4717ffc9bb1e5f64ccebfd83cbbbaafe72bf2485173331fd47dac61", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191365, "uuid": "b6e3d929-3c41-4258-888c-d84518517b46", "value": "T169750266F406C5C9CC028EB1DD5A687E0D2E3DE8EBA6907732C0F9DFCAF25214564267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191365, "uuid": "31fdbecb-d122-4c5d-abe4-d95d4e0579cd", "value": "4a891f742cb7b477da96a9adc286acf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191365, "uuid": "35d00f00-a196-479d-b321-a83c7cf074eb", "value": "49152:J8pDHHmxndoP0j1hMHB3iA0+aIoYz6R0X:J8NmJEdHAAlXoJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191365, "uuid": "13babed8-ac32-4a87-b7e5-80fa473dbd35", "value": 1678624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191365, "uuid": "929b46fb-3e64-4e7d-8796-c56d9758a9fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191365, "uuid": "2aac30da-0d6a-424d-8f8c-6ef7c687d8d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ad1cb9-ab2a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676243334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243334, "uuid": "a9638982-8dba-415a-877e-705238857a73", "comment": "Malware payload", "value": "471a28f13dc5155b33ca8bb12bb4cf46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243334, "uuid": "dc20a2bb-9449-4902-895f-9ca3ed568237", "comment": "Malware payload", "value": "25b431ae41a46ff37523e7f7c9cd7abbf752ace212d3bedbe68ae968498ee502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243334, "uuid": "142df20b-783a-418b-8591-29c14338b9b3", "comment": "Malware payload", "value": "0a3c9be74a31a64d7f7f9f934b8898be39902134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676243334, "uuid": "d1f80a3f-ef4d-45a7-a5c9-e4f528656ba6", "comment": "Malware payload", "value": "0b7035d73d1cde0b63a6e533eae10432574fb500c4da0634c5b25a6b22b52f065f040feeb51298139327ef40f266384c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243334, "uuid": "1870bdc2-8a97-4f7a-be85-eb1968c806f0", "value": "T162F4121BB7EC4063E5B5AB700AF303C32B3A7C929A74875B630A6D690D315A0F57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243334, "uuid": "586f3160-8194-4942-b44e-0330a8745563", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243334, "uuid": "29fc5bca-269a-4828-a698-9fbe6feb040c", "value": "12288:WMrCy90LeV8PBeOl3B9clL6gIuMtiI9eJbNBiY8ehBtLaFCTj6R0r9CIqFIQNy:kyQJwYB9clL6xuLbYe/KJSRcIey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676243334, "uuid": "e65d6a38-eb0e-4315-b7f3-8ce9faca44c5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676243334, "uuid": "895dd34c-7998-42c9-b332-7a01a95cc97b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676243334, "uuid": "1b98c04a-0fe1-407a-82a3-8721fc8b357f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771a43ac-aa6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676161834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161834, "uuid": "4218d65a-2054-478c-a789-20d943426813", "comment": "Malware payload (Smoke Loader)", "value": "c64efa0e5d5f9aca6d15a96571bdd4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161834, "uuid": "8209a9af-149f-4d72-b049-51d49a8e3d28", "comment": "Malware payload (Smoke Loader)", "value": "265b73233ef5a900f6f99434bdcddee9b0d4a2be5957b89d351b38048fab96f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161834, "uuid": "dfb2808b-a2d6-47bb-84ba-51d5f1afac36", "comment": "Malware payload (Smoke Loader)", "value": "9896d1c7f6613a2ec9c36f9130c308d79d85cd57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161834, "uuid": "9420bf27-364d-47b6-8442-0346df5a5d09", "comment": "Malware payload (Smoke Loader)", "value": "008081493dc44e3611b7d2b2e5fe73a4efcaf0aa67bf53d7eaeb26a7f493b539f061206db1c996db974364f2f3d4202a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161834, "uuid": "5f4acdf8-e892-40e3-aaaa-f43511490c21", "value": "T1A614DFD57AA2C033D1974AB62531DA947A3F7C7167A682DB3309365F0D302D24ABB353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161834, "uuid": "806cf86a-dc50-4e0d-b789-67ec524c1845", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161834, "uuid": "e4bb150a-f0ab-48bf-ac33-14343b974c0c", "value": "3072:XjqkCw+0JOqjW5CHXnPI3p5EwDI2NgV71wGcmpWbrbG2btG:XGkRv3nPIZaoI2NgFySpWb3G2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676161834, "uuid": "e03d776a-7cd1-4dc7-9d6e-7b5548072014", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676161834, "uuid": "d2fe33c3-dcd1-4d27-b2ba-c9ae4a66fa3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161834, "uuid": "aaf43e69-689e-47f4-9080-5587fb4f1f42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21a4e3a-ab1c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676237579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237579, "uuid": "915c12dc-9e3a-40a3-a8e6-c5bda4d41b04", "comment": "Malware payload", "value": "14eaacdf4b3e2a87b1a6ff33d738c4e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237579, "uuid": "e5c6b2ed-f8c5-46d0-9bc0-fffa2fb32a06", "comment": "Malware payload", "value": "26881b486d615ae1ee2631dd378729f8d6aaaae8aa788ef5552e1517218867b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237579, "uuid": "17b933ea-0eb6-4e04-b2c4-75b08b9a747d", "comment": "Malware payload", "value": "b4da1f9ec763e62650ffaae45eb187127b120a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237579, "uuid": "32a72825-060f-42df-b900-ab040fc38e1f", "comment": "Malware payload", "value": "6c05bfb20407f6885299a62f01c6b41b0d26c986373a5f510bdb3fa776d9795ab717f9f78db58f500e23ae646087288f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237579, "uuid": "d8cf1cb2-1b22-4b1f-a255-e871d2647f56", "value": "T197F41247FFE89033E9B5573015F707C32A3A7C206B24869B378A5D6828726A4727537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237579, "uuid": "c7115b26-69a9-4fd0-a570-f5f701bf320f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237579, "uuid": "b8d66dd2-6321-459d-b165-2759ccf8b4df", "value": "12288:4Mr/y90rprySuVShfdcUKPzPFsUkEheJGwev+wuLlEVrWjh0C3yxQme:XyYIxVQ6SGxviLDjh0fQme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676237579, "uuid": "f6dbdc7c-69dc-46c7-b7af-6830fdf95814", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676237579, "uuid": "b1884fb9-63f6-4c8e-a0da-cd2ca79ff90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237579, "uuid": "bf001408-87a7-4227-8970-16c6acacc3b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dbd98a-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676179635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179635, "uuid": "184b43f2-8569-4005-8286-3bde3fd8d8fc", "comment": "Malware payload (Kangaroo)", "value": "03905dfddbfc1c943dfcd8e1a9a6a4b1", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179635, "uuid": "1399eac0-3107-46e4-b48e-24aa73c68429", "comment": "Malware payload (Kangaroo)", "value": "289780ac1b2d1ba4250cad5bc29d351de3fd363897f1ec64be083c096f0cf495", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179635, "uuid": "16cb5232-e74b-4d16-bd70-436b089bdb4f", "comment": "Malware payload (Kangaroo)", "value": "23a136946dd9dd75ff9559e8625b11fc75a7c643", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179635, "uuid": "41d0a7e9-99e4-40a1-a3da-1d5542abc1fa", "comment": "Malware payload (Kangaroo)", "value": "f1fe17aca978a3dc4f95630aa00a43b300b197dbc9055f291f2832c12b8fe2f3eb785877e5e35976bcfe4ef57eeed166", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179635, "uuid": "6e42f5dd-3351-4161-8edc-ecfc75cebbfa", "value": "T19B62E8471FB80D66FBF1DA7014FE7806C1777829AB39EACB06586C0819B25E0E57C7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179635, "uuid": "e13f14b3-1f9f-483e-b65b-6be58d15fb51", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179635, "uuid": "76e59526-7110-4812-9f28-b8e0cb0bb461", "value": "384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zdkWwhWc:1du9CaxEovcm/BCvXdeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179635, "uuid": "c6160797-e681-49f9-bbb3-d0b63136c232", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179635, "uuid": "ece17ddf-b99d-4d37-a9ef-4fd25d33a678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179635, "uuid": "a51f662c-4b2e-4217-9ecf-300f34c6e552", "value": "2023-02-11_03905dfddbfc1c943dfcd8e1a9a6a4b1_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b994d5-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231731, "uuid": "f13f2d6b-6500-4103-b78e-ed5ea27754cc", "comment": "Malware payload (Mirai)", "value": "0963f963b996327ad0771c328f2d73d9", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231731, "uuid": "65dbd029-1499-4593-8c55-d520d07b826b", "comment": "Malware payload (Mirai)", "value": "2898ef41e5939775ab204e0f3433b9d4659f75ffb59dba3fe71302037016a3f4", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231731, "uuid": "12e936a6-b489-49e6-9b89-e695c4f3462b", "comment": "Malware payload (Mirai)", "value": "76d1ea4b1546bd7a880d6f17e89f0e0fa0a58b77", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231731, "uuid": "846613c8-2b44-4eb7-a2ec-c8cda8850dc8", "comment": "Malware payload (Mirai)", "value": "ce5a2a6df13ecfb83a9b6a2dd86a37f1b9a0692b1a77deca6ddcebbd33d96e7b11589dfb96a30efc769804b8d71c9296", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231731, "uuid": "4eb9b903-58f8-4ef5-8212-17356c628cda", "value": "T1351302D5A208869BF94D4AF1AC36A23BDEE0C61E54045D6196ED3822D54B3EC37AC3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231731, "uuid": "f259578b-528c-481b-bc96-c828f47b5b33", "value": "768:F+3VfMSlAdWZe6/qgVbg3UeZWSinvdayH5LAKbZimgq8I6nbcuyD7UHQRj4:FeVfMS3vqgSkeISinvUg9ADmgq8/nouJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231731, "uuid": "2c7528be-6537-4289-9072-a69d0fda3d3f", "value": 43144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231731, "uuid": "65e11daa-a076-402e-b0dc-67023b355040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231731, "uuid": "6da72ac7-dfcf-4351-bb22-0b0764e3e5cd", "value": "log21.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0541b0c2-aae0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676211465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211465, "uuid": "5fde8d74-a5e4-4158-97c6-605133a049f0", "comment": "Malware payload (Formbook)", "value": "e288f509d080c3ff3317619a713dec18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211465, "uuid": "0b47e91e-2b6d-47dd-8316-5b8bf800fa79", "comment": "Malware payload (Formbook)", "value": "293e7cb3bc8c1198885ba5d93bf9b1978ba2c9b6316a97840fe35169d93cab8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211465, "uuid": "99f68dcf-005f-491f-b0b9-c48384ddb489", "comment": "Malware payload (Formbook)", "value": "aec8c5fba18e449827b4f4ce9a710516e0b402dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211465, "uuid": "a856576a-b24d-467a-8963-231d363bf4ed", "comment": "Malware payload (Formbook)", "value": "53c89e7be1add0e5e15d1978bbf24fd183675dfdab5f7cd975e58a8fbc187756d14dc65f3e131f5a425614ab29ceac76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211465, "uuid": "f94f9389-d70d-4b70-9b41-9a600633bc21", "value": "T187359E587330669EC4328E36D4540D18AE113E696A3FE22FA05FF1D8D63F6839E159E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211465, "uuid": "25e42f82-b33e-48fa-a45d-ebd6be1e7bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211465, "uuid": "7c83ba10-80ca-4613-8d50-d10eee0ae173", "value": "12288:zBAvUVgCa3up/v0QBMgnQ2E5k9ckbl6Weh3ih9HvAR1pJtv/OpF4WGPk+cMDOq/j:6vUVh0WfukmUwBYToNq0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211465, "uuid": "5122384e-6391-4ff7-9613-6dc2eb0ca05c", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211465, "uuid": "d0b2ce60-ee55-4dea-a299-a6c9ece85d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211465, "uuid": "c7be6d92-dc0d-4484-a62b-6c951b6fafd0", "value": "Capital Tenders Group LTD PRICE REQUEST DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535ec119-aaae-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676190121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190121, "uuid": "c74a9287-b5db-44f5-8eeb-b9c708677041", "comment": "Malware payload (AgentTesla)", "value": "b9a1127db3c4c3fd7ff10416a69c8aea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190121, "uuid": "3aed9edd-e05c-4121-a744-62b44e66c29c", "comment": "Malware payload (AgentTesla)", "value": "29c562c44604ece170da8b50d8d952961024f7d2f8c2301bbf28d31d2ba79a5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190121, "uuid": "864165e4-c3b3-4020-86b7-acbc42c8f54c", "comment": "Malware payload (AgentTesla)", "value": "cb750f0e8a3a89229185be90e8c1b2c438ce57b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190121, "uuid": "b509b1bb-e803-4eb1-b395-fdc7f71021ac", "comment": "Malware payload (AgentTesla)", "value": "116b9c6714f86e73e6132d792f6dee22d8212d14f4b5bc5f56177a09a2ad0695ce4ee75ee1b02521a4f88430af54cf3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190121, "uuid": "76f8e58c-d784-42a8-af89-024edb070d69", "value": "T11E350829987616D5C734F63186E1C430B2AE6D963723E95D9CDA3ED22F722827CCE10D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190121, "uuid": "ffa80a03-8396-4c8d-b5c8-5d7132441711", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190121, "uuid": "026432db-ad35-42cf-9959-2ef7981670fe", "value": "24576:3fgjseHKNTn7tunA+/kSOBMfmBm85JZejoLthiQ3GzoqzT1q:3oO1J4stgQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190121, "uuid": "5693e857-985a-413f-9d5e-19fa73f96bb2", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190121, "uuid": "00fe5a74-f192-44c7-bae7-ea274cfd5050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190121, "uuid": "cdffc13e-c983-485b-bdf1-cb8e2ef21287", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff38b0d-aab1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676191511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191511, "uuid": "2e671612-f6c5-42a0-9f42-d093361e212b", "comment": "Malware payload (GCleaner)", "value": "d94c441361994b43e16ca854c2634b78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191511, "uuid": "322a609e-5de7-4553-b0b3-3fd9c39bb7e9", "comment": "Malware payload (GCleaner)", "value": "2a3437f7efe5e2b17d1f0ebba60c83a33b496883bf704f8204a00be96336cd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191511, "uuid": "f9ff7057-4228-4338-b035-715e10546ef4", "comment": "Malware payload (GCleaner)", "value": "eef5445f8d7f9453c9581b68015b26ef69735191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191511, "uuid": "39b3ea6f-53d7-46e3-bee4-ca29a932fb59", "comment": "Malware payload (GCleaner)", "value": "0745f614caf8d60cb99a02066438d58b661a110e11e6a4f10deaef39137c7ae78b9bfc55b3ae71f2de12c784a06ce30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191511, "uuid": "e85f648a-0ad0-464f-b043-2cac85248905", "value": "T1E0F5127D7155C86DC280BEB48C3BC8E71CD76DE3E9A0A522B0D97F3F42792889619607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191511, "uuid": "b84c2c9f-30e7-4748-b914-b31ce12e5ad5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191511, "uuid": "20e9dcaf-4365-49bd-b0d6-c5ad5e3f3125", "value": "98304:JHnQGWH3UkZ5onZceNUiptm1uMUqQnyBi1v2MR:dn5WHEkEZHNUi+jUTnMi1vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191511, "uuid": "1fc794f8-288b-4a26-aedb-e5913c384b3c", "value": 3615495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191511, "uuid": "c7d530c9-fa56-45d3-84a3-4c56ea4a470c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191511, "uuid": "877c8f8c-8e31-4490-986d-cab794563c51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba556f4-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244225, "uuid": "a26db094-2a8f-481c-9976-7210a3001bb8", "comment": "Malware payload (Mirai)", "value": "23b429e1a55a81b49fdfe27aba947d43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244225, "uuid": "405f306d-8b95-41ca-b20d-a674599d2c31", "comment": "Malware payload (Mirai)", "value": "2a4cfcac80019866415d390186343cee5e9f63ab4801119f80ea1b09df1ea8f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244225, "uuid": "110debec-d491-42ac-805e-54cc4a692c76", "comment": "Malware payload (Mirai)", "value": "f093361d0e51c4e2340291a3bcc6608eaad5f0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244225, "uuid": "ff847f7e-c05b-46b8-9e24-f8e1dcd3b21f", "comment": "Malware payload (Mirai)", "value": "8be0edaa9f2f70141238da51ba5da2a219653c653394c4eb9edf5e717d85a6bbeada79233742db66f48ec55fb0fa3b4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244225, "uuid": "6105e18e-3557-4f0b-bf83-b84894df103a", "value": "T1E0D2E1108F059872C1D81D73AA1C498452462EBDFB47F5DE4239837454D64919BF9FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244225, "uuid": "1b3e793b-425e-4cd0-9b8f-350ea373c903", "value": "384:2EHeVfN9zCERKVtG7i23iMFd6WvF1yWTvymLZtxKdtn3JcfqWxcNduGd5ojKmdGt:2eUfrCO7hK+4W9LDxItn3CBeNIK3Uor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244225, "uuid": "692c24af-9ecd-4184-8a4a-1fc167d09c46", "value": 29460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244225, "uuid": "2a7c742f-ca81-4ae4-8b1b-eb20ec0e7cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244225, "uuid": "880128f6-8f96-410e-8d0f-8d98c7c3d448", "value": "23b429e1a55a81b49fdfe27aba947d43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd78a10-aaa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676187909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187909, "uuid": "a7a67e6c-6d62-4446-b35c-cbb6cf685464", "comment": "Malware payload (Kangaroo)", "value": "86f734014a06d860549052fe2223d462", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187909, "uuid": "49cf0ee0-8ba6-47dd-8803-eb0d9a6ea290", "comment": "Malware payload (Kangaroo)", "value": "2b3865a354159aa3050788a81395fa7aab1d99765f0d87ac57823214cdbd6e4c", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187909, "uuid": "eb48a000-f1c1-4a7d-bc59-6b21f7d82589", "comment": "Malware payload (Kangaroo)", "value": "896b92f754a758868bd1b2f2565aca2bb04719c5", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187909, "uuid": "7334a40d-eab4-48e8-9383-03d357d6bbfa", "comment": "Malware payload (Kangaroo)", "value": "34b013aa338c20410de25383074cb6a8f473ee902eb43f7eedfa2d36af51cfc9f3b1a98d1e8eec262fe9825c38efe767", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187909, "uuid": "1adc6e30-90ed-460e-a749-67481984d80b", "value": "T1CC82F8471FF80966FBF2DE7014FE6806C17B782AAB38EACF0658580819715A0D57C7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187909, "uuid": "c571d352-eb65-4708-96fd-50c72736e81f", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187909, "uuid": "ed5d853f-6aab-4feb-9c27-5a26e528d639", "value": "384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zFXWVhWXWh3:19u9CaxEovcm/BCvXFSH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676187909, "uuid": "4cd6e847-46aa-49b6-8695-70673f8369a9", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676187909, "uuid": "93364140-a9b3-4e61-8ac3-5a72304ea69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187909, "uuid": "ea216a85-87d9-40cb-b407-61d780803627", "value": "2023-02-12_86f734014a06d860549052fe2223d462_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8735882c-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229722, "uuid": "02f2dd5d-e8c8-492e-8122-d378eb7b4fa2", "comment": "Malware payload", "value": "5ab579c3ab567551674e6f32fbd7d755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229722, "uuid": "f23560f9-af32-41cb-a4b9-57f852a81c73", "comment": "Malware payload", "value": "2c8718c2665ed9d280daf5fd102686229b39cb10b174eda0cb0204f6a7e01d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229722, "uuid": "cc54b4b8-becf-4ce7-82e8-ded2aea095b6", "comment": "Malware payload", "value": "611e6c13b63633292add15cb2c61b0e635d27543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229722, "uuid": "33399ddc-813b-47dd-96ce-dfdb98aab891", "comment": "Malware payload", "value": "21e3fd4a36a2bade8d32120a6f1b83da72e41f77aef98556cfa6ecb07c3641e0c30e0e00e9c226b57f77bcb5679420ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229722, "uuid": "06c10b73-82a7-4710-9a34-d803b486df75", "value": "T14465220239C14571DA7229352DF66B74AA3DBC211776CDEB5344AB6EAE200C0DE3B727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229722, "uuid": "a997ddbf-5dc2-471b-825b-04aaf51894b5", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229722, "uuid": "3562d99b-bac3-4814-8ac2-a928120b4540", "value": "24576:I/XEXjJSFHUKeoof0V5AefsCYSHPlN64MSQ4oPw6UEoaKkrD3OohI:I/oSEfkpPP364MbuEo63+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229722, "uuid": "71e7cd3a-2927-43e7-abde-63ac589b44cf", "value": 1534647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229722, "uuid": "bd465623-603c-4b46-a761-1df1d13d688e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229722, "uuid": "5f6ab76f-0779-46e5-b360-3f7b30f9f4fd", "value": "5ab579c3ab567551674e6f32fbd7d755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a1eadb-aaa4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676185698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185698, "uuid": "bcd5f1f8-a6b6-47fa-b0c5-a131fe418388", "comment": "Malware payload (RedLineStealer)", "value": "328d85e1f52745c33fe3cc00648a8f2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185698, "uuid": "eaae62a0-0cce-4509-9d7c-39e8c78d3aae", "comment": "Malware payload (RedLineStealer)", "value": "2c932b46504d2910b68ef6c14ee3a9b943dd09e9af33ef45a93aa30122286ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185698, "uuid": "1c647931-b0f0-4e3b-9377-4ba2e3da5b5c", "comment": "Malware payload (RedLineStealer)", "value": "5765ec05ea7b12e957c5844554a80f81dae7e8d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185698, "uuid": "6897b556-a39c-405b-ae39-43f2e3406a93", "comment": "Malware payload (RedLineStealer)", "value": "9107a4d56ba0a73c29b792d0b7aeabdbb0ad4f66d73f808d2beb5b44c2eae4f6cbff0d2c4823fd5bed3b976644681a67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185698, "uuid": "c7bf301f-93d7-4c7d-893d-9a3f9612dc45", "value": "T14CF4121BA7F98022E972533019F707D32A7A7C514B3407AF278AAD190CB26E1B53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185698, "uuid": "9c0e9db0-2132-4794-988b-766afe46ad07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185698, "uuid": "c8a80621-1e31-4fc2-bec8-9c1b5506fbd0", "value": "12288:eMrxy903y3fXXq++OvW8GHjpISpRhFveJQ/bTAjFm7zwPJVDZhHV11:/yDfXXjnuFHjphpRI+bcjFm7zqLV11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676185698, "uuid": "302ce687-7e32-4f4d-ab24-b7ab8d2f08de", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676185698, "uuid": "a091119e-c7db-47c6-899e-0646fbaf81bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185698, "uuid": "b08dc359-30ff-47cf-a593-695660fcfce0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59601ffb-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244248, "uuid": "0a8a1415-8700-4b12-9405-6007bfe75101", "comment": "Malware payload (Mirai)", "value": "d44fe6124b8df1c61d869806b9f8a048", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244248, "uuid": "7e9a4c3e-ebf3-4334-9643-9165b3f0f519", "comment": "Malware payload (Mirai)", "value": "2ceabf24f0e41674e7d1dbce784fb47b9aeabe729fc064d0e134d8e0fcc05223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244248, "uuid": "f15d8c5e-5a35-4a4c-a4df-7df879fef274", "comment": "Malware payload (Mirai)", "value": "33d548b040ecaf8c1afdca0a43636d71eab3d1ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244248, "uuid": "a4dd39b3-d587-45f6-a0cc-f2617e4692e4", "comment": "Malware payload (Mirai)", "value": "ae73fed46b220764d6cfc866f75a9f9b9e7347bb6791f1daac03f939901a9d1fd7eee39d1088242555121c97c664767b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244248, "uuid": "f87d8b01-dffc-4b53-ae65-315cfecec2dc", "value": "T114736ED5B8004EBDF95FD6BD81224A08F92173005FA30F2BA66BFC936D72199AD46C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244248, "uuid": "e7419d85-cee8-4c01-9c73-1f3c376e8ebd", "value": "1536:NEpK/b5ai5cdJgU4p0AizvyCqdgAPdan3QXMKQsC8ffFky8/a/A:aAnEgU4HibyGmMO9Rfen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244248, "uuid": "e78ed463-f7d5-4c1f-b5eb-da7fadba17a6", "value": 80256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244248, "uuid": "902a81c9-f370-4352-981f-99129109763f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244248, "uuid": "2ea77f97-730f-45f2-9c4b-4b84517a3418", "value": "d44fe6124b8df1c61d869806b9f8a048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae84f65-ab2d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244734, "uuid": "ed3e79d1-c16e-4a8f-9db6-08613cf87cd5", "comment": "Malware payload", "value": "e1ec340366adf6e3521ec394cabd27bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244734, "uuid": "788714a8-3d84-4303-9762-0b76d5fa3baa", "comment": "Malware payload", "value": "2d452a4a4daa8d786df962c93c6c9da6ea12845eefae71219cf4a7b3af4903dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244734, "uuid": "e92687fc-c8a6-4c05-b21a-9ba1d8da2df4", "comment": "Malware payload", "value": "8c815a53f31047d94c3cd516db85ba9bb189c594", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244734, "uuid": "d97820bb-0401-4d49-b19b-d5ccce689ebb", "comment": "Malware payload", "value": "ef655a14c65b992e9882058ee02ec6fa8b0562fa10ed06ca78aed78bcf6b2610b7dc40f67bb9eb8646cc85e500531649", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244734, "uuid": "ab019498-a5f2-4b7c-89b6-35b644971301", "value": "T1E3F44D0EFE80CD2BC8D5483148B386693BB3D892BF10CB57615C766D7C2729A3A5B5C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244734, "uuid": "f7e3dde8-2374-4ff3-8bea-4b604c296c7c", "value": "808ef01b1df8ccc7e620508eacbf5713", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244734, "uuid": "2dd2804d-bd8f-491b-bdfc-18ef5b83b272", "value": "3072:/6I4/Opgh6qUC0Uf44kW5WTU3aYUABXtQY98:xpgI80Uf44kzTUeABdQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244734, "uuid": "1fbd546f-5df9-4ce6-a42c-2fb79242cc3d", "value": 773960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244734, "uuid": "4f48fd82-ba09-43ff-be97-d394e13c28db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244734, "uuid": "97429b69-08e6-45f6-8ac3-4eb83428f356", "value": "SecuriteInfo.com.Trojan.Win32.Hider.2458.10819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf6932e-aab2-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676191827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191827, "uuid": "81d4851c-018e-4bfc-90ec-6cceb243b623", "comment": "Malware payload (DCRat)", "value": "058e501ecdce1e4235d4731b177d74ad", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191827, "uuid": "c1c949ef-59ac-4c6e-bc58-6933b617eb10", "comment": "Malware payload (DCRat)", "value": "2e8d7c5565e54888c36b0664c06a263d5be284a1ffbbab31c7d1f991ad3d60d6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191827, "uuid": "14c76360-1311-4a79-b942-2ff33d333db8", "comment": "Malware payload (DCRat)", "value": "1d192f04eb57128492e86aa58eba6413997daae1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191827, "uuid": "dc43944e-6db0-40d7-81be-57f82c21ea40", "comment": "Malware payload (DCRat)", "value": "25640f59978dbc4694bc50279d7a19733423db92231fb08ee1dc60a817f4ef3bc9243a426bd8f2578b1c71f569cf1993", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191827, "uuid": "c4c23ce6-641f-43b6-a6df-46a231d5dddc", "value": "T149757C017E44CE22F0581633D2FF65184BB4AD102AA6E72B7DB933AD55123937D1EACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191827, "uuid": "d61ab18c-68e6-46f5-96c0-64f8f4270314", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191827, "uuid": "63b6ba15-b57d-40ab-b767-c65132792f66", "value": "24576:B2G/nvxW3WFeOdvLfKcWNKuSWpY30O9q98no7pwV7rIm5k9+:BbA31O1LyXao6SwV7r75kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191827, "uuid": "b5bdf3aa-6129-4552-b680-cef54acdeb0d", "value": 1556107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191827, "uuid": "ecdf4636-baa1-4f49-965d-7f8fe3960454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191827, "uuid": "df3f9be1-6cae-416d-b4e6-edac53de58b6", "value": "058e501ecdce1e4235d4731b177d74ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797a6a9e-aa90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676177300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177300, "uuid": "4e1906b9-312b-4026-a61d-da2e29d4301a", "comment": "Malware payload (Amadey)", "value": "93008034480a1b3d5c14633d79c7e43c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177300, "uuid": "1f2670d7-001c-4b7f-beb7-62985d481d44", "comment": "Malware payload (Amadey)", "value": "2ec996f29b80d09d993c1fd250d06af3ce7fc8ef0721b1ba993bd5ec94c66ee0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177300, "uuid": "c0bc182e-ea7f-43d7-9661-0a4ff5869062", "comment": "Malware payload (Amadey)", "value": "dcb98198f0cf01ad3fcb8a9a5ecdc039dcd52429", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177300, "uuid": "8d0320cb-5a01-4ed3-a6fa-bd7405058000", "comment": "Malware payload (Amadey)", "value": "8bf16e69f112952c2ac60f76dbf8d76f45e4c92b028378b3be83aa8b1d438e0fc201c6b379654ca75b71222d818ef491", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177300, "uuid": "fde31a04-f6f3-4f29-94c5-d37e06775828", "value": "T175F41213FBEC4033E9B55B7108F647D326367D605F34829B628F6C9E08B26A0A539367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177300, "uuid": "1e8e4726-c01b-405e-ae29-b894ae1458b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177300, "uuid": "4dd839a5-9cf4-4991-adca-0ecefccd261b", "value": "12288:BMrQy90g0VkqTw38QIY6Ry1tPeRCgGeJZWjO+AOpLefidvIKNoV4n8+EvZ:9yoVvTw38Q+QPcC8MvjCfj94n8/vZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676177300, "uuid": "443c34b3-a002-4079-b1b2-db06347a268c", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676177300, "uuid": "6b33d243-105c-4d93-bfcb-c34d6cb4e87a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177300, "uuid": "f7ccc5a0-c72c-4149-bd4d-4950a9c0ca1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a272fa7a-ab26-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676241794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241794, "uuid": "c525a6c1-31e6-4b49-a6e7-b203c561f949", "comment": "Malware payload", "value": "59b46458597c95c8c26c32f67e6814d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241794, "uuid": "60f9b805-7c4c-4f93-a388-33123f1ac818", "comment": "Malware payload", "value": "2ed86afc113133c4428740efcb3941bad88a6813c97dbf86c0e04da4aec9ab4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241794, "uuid": "10291b1a-89f9-4d47-9b4d-ecd17f63e03e", "comment": "Malware payload", "value": "d309c88a0e51d8f0b0682f9434125bdfc6ddd58c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241794, "uuid": "51e2939d-bedf-4594-b28a-b9c23cec2b86", "comment": "Malware payload", "value": "dc6c143590377010b4f9844853caad4920318d01c4a59b8910f171072fed332a25532f8e3bc4f873d6b84f193687280f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241794, "uuid": "a18f2b64-835d-4fa7-8fbd-8bc3652068f9", "value": "T168F4124BABEC5132E4F497B00DF613C31B377EA05B35C25B124AAD5A0933AA5E1347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241794, "uuid": "601ec85a-84a3-4cec-9195-ffb347980803", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241794, "uuid": "79cd1a3c-afc7-411e-991d-38b6a2baa930", "value": "12288:yMrzy902FIYTHaaJEh/puCWweJ7a8l/3ywfC2jgR0rek4qpNp+u:JylFIYTHhJEh/0Cofl/iwfYSiyNQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241794, "uuid": "1ad7ebd3-50a3-4293-84f1-ed263d5e41ce", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241794, "uuid": "c42e295f-99fd-4dda-9118-7df5ceab5cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241794, "uuid": "f4524d11-5d5f-4049-8cdf-f3078a38c2ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84c8d26-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229455, "uuid": "b6d6d209-a1ac-4a38-b7a1-335e7d661025", "comment": "Malware payload", "value": "0abe8fb60d377ed8e1b17cb13ae02117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229455, "uuid": "3c4eca8c-a4a2-471e-8228-4df36671425a", "comment": "Malware payload", "value": "2f4f6cbf7c51e68083325f84c9bee6c9465ffe6740be9bc044fa660ff4abeed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229455, "uuid": "7a1a5734-ef3e-42b9-b988-a7dbd779e055", "comment": "Malware payload", "value": "33767cb48f981dffa79eed99b0426b91e18e2cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229455, "uuid": "81028863-d2c5-4a8b-9670-880c86fb4d96", "comment": "Malware payload", "value": "fa23e0a7196f040855d121608c7b7160f5f9bc50be6a9a2774b84e30861cd08389cfbeac2037935560a9ba44d7b5dbe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229455, "uuid": "03b26e38-f928-4beb-a980-427cfd040a57", "value": "T169F4073E19B613EAC334FA7146E18420B6DEA1927703F969DDEA1AC54F025C17ECE61C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229455, "uuid": "511ee73d-05df-46fc-997f-11d4e4c1813f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229455, "uuid": "672213ea-b2dc-4268-bb21-a6c4e66990fb", "value": "12288:+95PbMf0lkDkA+Wz8XDckER50vEYuYJg3a6P/xLHTu+C+2SlLVseHKNTn7tunA+W:+9xbMfmBm8GCEYEa6P5LzjseHKNTn7tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229455, "uuid": "14ce1919-e7fd-4b1a-919a-c8bda68c1bb1", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229455, "uuid": "7879c596-8b69-48c9-8d1c-3659c1b34ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229455, "uuid": "891430a7-9804-4c0b-99ee-e652090138ca", "value": "statement of account jan 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d98bbb3-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676179508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "72897126-e3ec-4c12-b9d1-19238467ad4c", "comment": "Malware payload (Chaos)", "value": "bbe2e0f186145fe66bf06909cfaf03a7", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "3742c6d4-dda7-4c28-85f3-f5f5c206415a", "comment": "Malware payload (Chaos)", "value": "2fcee69a2cce325c17a9cd127f1dd99c53f2034c48fffe3cf8e770eea356ae11", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "bc85de87-1d61-45d0-8706-a48e865f22bf", "comment": "Malware payload (Chaos)", "value": "19c9425cf3c6d5a53281b9544eaf6d1eff179767", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179508, "uuid": "3444a93c-abff-4093-8b18-b82594d16b98", "comment": "Malware payload (Chaos)", "value": "2a7886c3e34f7e33b0e0eb88e4ad7f4f2852b9ea783b5b37fe35b30d454c42e2e7d7232a5927a0151b5007f3412b2298", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "d31c3830-8545-4daf-a928-2aacbf7abc8b", "value": "T16FA2C60867FA4A39F6FE2F786C7211505775B997ED3ED74D1C8E404E0D22B8C89A0B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "5e931771-8372-4684-bf40-3ff0b9367547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "8ab8dc1a-89a4-4d74-93a2-ba8cf56a1972", "value": "384:K3MLWHn3kI9dmSEjxNWpOWsB/hkEJEr91CzTZet:On3kIqZxsp3MEr9i1et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179508, "uuid": "a5eb56e4-c95e-44fa-8ca6-e25678e2c55a", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179508, "uuid": "11e9ab99-c435-44cf-9b67-0b8dfbb8be44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179508, "uuid": "f6fcc506-0e0d-49a9-a28d-46d77707f7ee", "value": "2023-02-11_bbe2e0f186145fe66bf06909cfaf03a7_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117f8b94-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676231672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "95253c19-91a2-4db4-b668-61b120c37071", "comment": "Malware payload", "value": "56479e959edce7131318828061e9d542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "d2a91ed9-022a-41de-8227-b8607e0ffcca", "comment": "Malware payload", "value": "2fd6eb718e1556450e3c507c0eb29b0adc4e98f7a49c88a158faaaff2ecbe46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "5fd27de6-29e7-4e7c-bbc9-336230268c5a", "comment": "Malware payload", "value": "96361dffc20dc20fe85312b17e0ef583da4730f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "6e371254-e0ae-4709-bf18-cb132f2f2518", "comment": "Malware payload", "value": "3e0ed96beb36d2d4281b44ae86fb49c8d514f9878b01259790522b12679ea66ea0c1b4e82077e11ea1ca48fe05e9ab4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "4063ce3e-9055-491e-84c4-4717f2bdb0ca", "value": "T1F0F41207F7E84036EDB157701CF703C72634BD61163946ABA386AC561CB26B1B2367AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "26c0c58c-b1a7-4ff1-b34f-71f6275ef470", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "f02e49de-9544-4fc7-a166-6d1f5f0bb443", "value": "12288:tMrpy90n6tSyDLphZCcGY8EzERaeJvLxF5ZP9IdZT9BZukL:wyI6gyhahEgNvLxvZP4ZTpukL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231672, "uuid": "c028d122-a14a-4108-bc9a-93945881441a", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231672, "uuid": "f0fca72d-9f90-4813-9f33-9c9e3a0638f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "4e3680d3-9ccf-4fc7-a76d-664873b3f574", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09c7fd2-aaae-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676190278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190278, "uuid": "9acb3232-343f-4e2e-ae2a-2f816f26afb9", "comment": "Malware payload (AgentTesla)", "value": "1a431097afb48954b94defec865d84f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190278, "uuid": "665be2ab-f053-4c88-8c88-7796b814f971", "comment": "Malware payload (AgentTesla)", "value": "309dd7ed63e9360abcb589290adda980a24e8a327d0090c6c839e306bada6558", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190278, "uuid": "06e9ea12-2ca8-4471-8eeb-a75449293ac2", "comment": "Malware payload (AgentTesla)", "value": "eaafb2d6af27cec988ac6829ff528066771fe736", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190278, "uuid": "e14cb8b7-fb39-4ec6-b7ad-65f4da0968be", "comment": "Malware payload (AgentTesla)", "value": "c89c102139dda29c13401912e193340dd9eb107447e7935d94fcdccbeca36ffd5155b6fbd0b21266ea95ffd52dca8aff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190278, "uuid": "1334fd59-2f55-47d7-8cdb-73bcbb7a30e8", "value": "T148E4F104FB98DA0FC3EB267919B9D37003F5AF561812C9063E91734A2F337956E81AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190278, "uuid": "29c3174e-3559-466e-9df7-f5b6c94d6454", "value": "12288:PuAskehLWn7dfWXeea+wpfXGJAHqvayEgfkxguPZW7z0JIZmDzOOua61A:W9LqYef+MHCGg8xgqZW7z0JIZm36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190278, "uuid": "a18ff3ab-3029-4d4a-9a42-d802660a4187", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190278, "uuid": "93d41e59-cef3-4cee-b3b8-3d793968d8a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190278, "uuid": "038ed132-e718-42e5-a87b-e290a9e3fdfa", "value": "Debit Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082b814f-aac7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676200733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200733, "uuid": "d4dae095-e701-4f17-b65b-c66cb32539dc", "comment": "Malware payload (Amadey)", "value": "e3dea77b45a2c91904c12b25ab6782fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200733, "uuid": "4bef683a-1528-47a0-988d-a9ee7106cdbf", "comment": "Malware payload (Amadey)", "value": "30b4fad5daf35b7311889756a1b30bd1373726c7df44208e2d286679533652ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200733, "uuid": "cb32ffc2-20c2-47df-9c81-f535b6a7e312", "comment": "Malware payload (Amadey)", "value": "722c5d2d4c9277cd36a7835e06be5ff2121e9841", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200733, "uuid": "0e4d60ce-2a90-44d3-b712-a24532bb7897", "comment": "Malware payload (Amadey)", "value": "9dc2b6fb19440f2212d19d0be432d5314632641380149606152e563da536525a389a7fcecdfa5425d7c1d7e8b70b6b57", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200733, "uuid": "245adfc3-7286-49da-be74-f0dd536aca11", "value": "T134F4120BA7FC9422C5B5573099B203D32B327E619B38C64B37897D4A1D32AB4A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200733, "uuid": "5e385b1f-4825-417d-89bb-7172d5e023cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200733, "uuid": "760b445c-767b-4f45-b508-31c107811d9c", "value": "12288:PMrBy90dfFJylLc/gBrQHtLncyhE3FpeJwUXbesP+BZSDFB8ipSBr+2ebZ9:qy4fqL2+QHtj/W3Mzeo+Bwn8glJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676200733, "uuid": "a292467f-7062-41bf-b4bf-c1433aafb5a5", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676200733, "uuid": "2f6ec735-a198-4646-b466-f579a98224ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200733, "uuid": "a47802cc-49a0-4600-96cc-3a72e43f4ff9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a19814-aad5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676207090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207090, "uuid": "0389d741-ab6a-4c76-acfc-28d66bab094c", "comment": "Malware payload (RedLineStealer)", "value": "e387e2ec9ca634e0cca515b6814b0f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207090, "uuid": "1dab1948-778c-4ac0-87f7-8e1ef10c67ef", "comment": "Malware payload (RedLineStealer)", "value": "3159d0d58b8ca3afa47a242c4035316f4ebe42c6a57a0c1a2fbb15b3f3f057b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207090, "uuid": "e4e5accd-d879-494d-9bc1-64d06204c5f2", "comment": "Malware payload (RedLineStealer)", "value": "d8bac20c3e559884a66766491c13c4d743e5b689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207090, "uuid": "6cada771-239b-4dc2-91e8-0f14fee7bee3", "comment": "Malware payload (RedLineStealer)", "value": "799fafe0a4ce6a87cc82398e91aed5f430b5091f17a59d099fd5620598d9fab9ae2d70041cf6bc978487b8d85a587451", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207090, "uuid": "7a76b560-7192-4ff7-a7ac-582ed5af1081", "value": "T1AAF4120BA7E95032E9B063305CF703D31A3A7EA16B38125B578F6C5C49726F06535B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207090, "uuid": "54463bd2-337b-43bd-b9b1-7689e22c92bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207090, "uuid": "84e67297-b108-4201-b45a-ea1a7f466876", "value": "12288:4Mruy90rkA5s9b3pPIDV1Yn0tU0eJReYlMpN0AivOggSzOQKZYj:WyXA5s9bs9wfupWgUyZYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207090, "uuid": "04fc1d40-485e-4472-9f64-67050dc8b59e", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207090, "uuid": "4d97fc8c-472c-471b-a926-6efd0f14af9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207090, "uuid": "167a3763-243b-4907-afa8-e569e869a223", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ffcf1e-aa8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676176521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176521, "uuid": "8979264a-5434-4a9c-83a9-accafb5a9be3", "comment": "Malware payload (RedLineStealer)", "value": "c36fdfbb792cab255db68cfafafcd3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176521, "uuid": "16eb2245-7235-47aa-ab88-8b9ca693f7d4", "comment": "Malware payload (RedLineStealer)", "value": "31ddf5956fded14ee87efbc23c13d639f7b13fe02d0e2c3441dc086608f5f22c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176521, "uuid": "66f785a2-2424-44de-abb7-d6a2ac20a504", "comment": "Malware payload (RedLineStealer)", "value": "d76705702293f26f7c013a963922561309fcf5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176521, "uuid": "f57c42b7-ddac-4c40-9aa1-20bc907796c1", "comment": "Malware payload (RedLineStealer)", "value": "f781650e2f2f0d468f6d9fc4d2e2732b75480a13ce42357c429020f243daf29e791fd047894455d33d3a05f12519ba2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176521, "uuid": "231a92d6-4490-4813-b3bc-060386efb59c", "value": "T1D0C4124B77EC8165D9B417B10DF602C30B3ABE606A34874B274E6D6B0D73668BA35363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176521, "uuid": "0520e616-73a4-4a02-86dd-195eaa3e2bc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176521, "uuid": "2931d035-def9-4445-81b3-d0c72411fff0", "value": "12288:JMrCy90UGFEdLSjGh8sF+6MaTQmNRW8bf2IXJr9w:LyHJdejoHTQmNRW8bNrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176521, "uuid": "50c4ea02-157f-4686-aef5-78be27755acd", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176521, "uuid": "21b88798-f1e6-4c2d-aba8-8b2fd3893ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176521, "uuid": "a5a306a0-d5c2-4dbf-9047-03f8cc8ec128", "value": "c36fdfbb792cab255db68cfafafcd3e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad69bd9-aa98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676180658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180658, "uuid": "d677b206-ad59-4a90-a14a-0d38ce62f857", "comment": "Malware payload (Amadey)", "value": "63c6b91f3ca91c6f32ab04f7f7afed02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180658, "uuid": "645ed38a-9a3a-4e29-bd6c-2182e961f450", "comment": "Malware payload (Amadey)", "value": "3204ba584bdfa9e4c2147e45d6b16a379ffb3f0e1f4ebb945d2da6cfc33bff65", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180658, "uuid": "e4370b1e-f21e-4378-af5e-a4b6f4e71e64", "comment": "Malware payload (Amadey)", "value": "00a3d568cf90ba28a76d9f9fb96fc84cb251a49e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180658, "uuid": "1ca99102-f2a2-48be-9f74-a5a2b47287c3", "comment": "Malware payload (Amadey)", "value": "3ee7eae631eb790aa90698e16fcf56266304c710da2ce23055df7e993454d69be21332d20652a1c29dbe2710c24ad47f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180658, "uuid": "32180f88-dee9-4eb7-8b1b-318e87603b83", "value": "T1A8F41207A3E8D032D5B95B711DF607D32A357ED0173483AB338EAD590C726A0A27A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180658, "uuid": "ffd29aca-bcee-4eb9-b11b-a37284f074e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180658, "uuid": "a93f6f9f-25bb-4236-85d7-0d449df75ffd", "value": "12288:oMryy902eIb7XsUQIz3ZOzOU3f0szeJxg2ti9KepmMwsF7heHjEG+nZ:ayDeejs4LZyrf0JrmKepmMw67hpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676180658, "uuid": "85b3dfc0-db1a-4f10-9025-b68da4c62783", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676180658, "uuid": "2b10a039-1163-4540-8cd3-b400d54f7bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180658, "uuid": "d8c1a4a7-24fc-4ee5-9795-8872014d0d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f037d9d-aaf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676218863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218863, "uuid": "c1410764-5eb9-4b0f-8f60-af84b8120ed1", "comment": "Malware payload (RedLineStealer)", "value": "4c5f97039623945310a558084c509228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218863, "uuid": "22f9a5b1-db58-46ef-8611-728528114c7d", "comment": "Malware payload (RedLineStealer)", "value": "3224a1358c0aae2a90a98eff720c35dec5aae73612dc359395e61ef87cec1638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218863, "uuid": "e771f42d-ef51-4276-8e8d-1a6ca5552fdf", "comment": "Malware payload (RedLineStealer)", "value": "9182d5e764318cf704afaa506c4b49c1c2d316dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218863, "uuid": "12bdfc04-cf2d-42fa-90f3-30e5e1c59381", "comment": "Malware payload (RedLineStealer)", "value": "29edd617737a2485236f10ce797d9cc94624640681f2649f5838fe010cf43c55f00b87e3ef5a88800865d9692310e60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218863, "uuid": "842018aa-5c58-4659-951a-c0228a5c0c67", "value": "T1B0F4120BF6EC8532E9B0A37059F603C3093679506A34931B678E7D5D19B2BF1623276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218863, "uuid": "cd947fca-c118-452c-b1bd-5da100c9f312", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218863, "uuid": "e39bcc06-de82-4a6e-85b9-69d726fb918e", "value": "12288:FMray90SVSxOZSS0ZZ6/VNzweJhze/HnaUeq7g8:XynVSxOZcZiPlGT7g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676218863, "uuid": "292166ee-c7aa-4f4e-a5f2-bddc75846095", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676218863, "uuid": "0f814064-b7a4-4fba-8611-5217c36cee9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218863, "uuid": "1c0a79a8-c037-4da6-a703-0527d20fab41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcb4563-aab3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676192471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192471, "uuid": "e4d5b89d-fc51-4359-a09b-793547f73a69", "comment": "Malware payload (RedLineStealer)", "value": "39e82278c674dda0152782606f18a988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192471, "uuid": "9b5aab66-4ef1-49a1-b5b1-2b3dee396024", "comment": "Malware payload (RedLineStealer)", "value": "32941a74048292a6272206d987bad3b24e037cea7e5a1c58f4c9a402ab4a545f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192471, "uuid": "a249b0e6-cf45-4b9e-b9d4-3c31ca221606", "comment": "Malware payload (RedLineStealer)", "value": "1b01b5e19d6aaf523922bfd081e816d99d489ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192471, "uuid": "41da1ee3-4dac-4632-9504-b9bdcc49ef09", "comment": "Malware payload (RedLineStealer)", "value": "831a1361b24aacb611ed75a7e99ec932e36912d93f48c68338daef6c3f5d2b0f8384a8bf5ecc1d5f28fbb721b8147787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192471, "uuid": "7d398149-0b06-4202-b70a-c49bcd7b4f52", "value": "T1AB54F01236B2C073D45B46BE6435DAA06E6FB8711BA5C2DB63040BAB4E703E24F75396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192471, "uuid": "67d521b9-ca2f-4246-a1db-241959368bac", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192471, "uuid": "218a4af0-bcf4-428d-a03f-0ca8c5b56b47", "value": "6144:EGHRN8bCayzTnNuQxQwtXK2pbln85r5MmBIxhe1rGSD+NBTJD:EGxtPNZL78xIXe1Sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676192471, "uuid": "ab06b6e1-9c2f-4064-87a3-1efe26c8d46a", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676192471, "uuid": "d514a266-981f-41c3-ae86-14a6471595e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192471, "uuid": "6ae5894f-2727-4be8-b37f-fe2259103970", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a05a51-aac0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676197942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197942, "uuid": "a2576835-ba8e-4c21-8224-d70307b429e4", "comment": "Malware payload", "value": "fd8c51f31993121682a90601fd5a0774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197942, "uuid": "289e817f-ad77-4efe-99be-9d99e65974af", "comment": "Malware payload", "value": "32a2daeeb4fb1db9c4c8dd49b5389a53c580ae3dd3168940753920c5c6aefeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197942, "uuid": "8137e296-03ee-41ed-8a2b-7bc4d1b96c0e", "comment": "Malware payload", "value": "c4d6923b6f33d4e1d9f5843f1b2eea60b5dcab08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197942, "uuid": "0c9542c0-a91e-456f-bed4-299b11c06df3", "comment": "Malware payload", "value": "67c626d2f1bbb83719f9ba1c34fa30d5d181147d413bee7d451d9d64efaac2dba1748f6b2790d138ab50f94d494b3e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197942, "uuid": "27cf1a87-5300-4a9e-8a64-71bd5f5a7901", "value": "T19F54F1E17A91C073C16A49740820B7A1297BB8716BA1E1CBE358067E5D7D3C23FB635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197942, "uuid": "8e90b395-d3ee-4a54-aceb-a00dabbce92d", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197942, "uuid": "abf07d9d-96bd-4e67-8e08-168e1a52f88e", "value": "6144:rUjk7vj+N+CMARSRJb08b7I/w06cEHqns+:rDj0+YRod07/wh4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197942, "uuid": "b6f98a22-0e73-49f1-80c8-944469429529", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197942, "uuid": "daef3744-1e12-4f0b-a20e-a0c329d54d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197942, "uuid": "7ca96c81-49dc-49ca-85b4-61e650095b71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de3b1c5-aa7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676169013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169013, "uuid": "2538e928-bbd0-49b5-8502-0829667443dd", "comment": "Malware payload (Smoke Loader)", "value": "d7429f0b315581a8ecf2bbd4b4dc7b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169013, "uuid": "4c0d7aa2-7eec-41b1-b12d-b47088214f18", "comment": "Malware payload (Smoke Loader)", "value": "3311925608c7d88bb699d63f39647f30c237c9abfc74f5b3e4e7190d6e8bdeb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169013, "uuid": "4c2b17c7-3f0f-4d13-ad02-b42e68940923", "comment": "Malware payload (Smoke Loader)", "value": "cf2fd4c421b04cd64076939ea5f514a5b6a5c1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169013, "uuid": "de599ec8-889e-4461-955e-bee2a62b4f7a", "comment": "Malware payload (Smoke Loader)", "value": "1e122c0d2ccd800a18d82d728e85985d06f0b4d0fb78814d9360b074e7abc87429f6a9b561869a86ad60e1554d7913cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169013, "uuid": "57f045ca-21f6-4c1a-982e-d1126518e848", "value": "T1B314CF1136A190F3F5A386B42A31DE916AEFBCB09765C0CB3395169E1D303D14E7E3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169013, "uuid": "7c3eaf8f-4474-4426-9855-ca24f9401658", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169013, "uuid": "5732d2a9-ea71-40d4-8bba-2e074e06c422", "value": "3072:1jqfU+0JeNFyC5CV5vpdBLrTcvExKrLc0AOfOXeqtId88AsCEtG:1G8RmF4VJlKjfpr+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169013, "uuid": "61f6ec9e-521d-4dcc-9c01-1e4b3f1b1ffe", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169013, "uuid": "54f2bd93-033f-48c6-a6ed-82b3641a5f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169013, "uuid": "cf765fe1-f018-4e6e-b9d2-57bdbdb835bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c83b221-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231825, "uuid": "796651c1-478f-4136-926f-56da4b508dde", "comment": "Malware payload (Mirai)", "value": "e27fcce34a2a4066cdb632cb159af49e", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231825, "uuid": "d4fb5497-8927-438c-9486-120557abb4e4", "comment": "Malware payload (Mirai)", "value": "33c816efd9bbe9d87edf15abaf761ad810dbc64faea8d5428bb696b719d8dca9", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231825, "uuid": "a69f1f06-de70-4b0a-b836-082ed63d9e4c", "comment": "Malware payload (Mirai)", "value": "1a6b4a3679538605a41bba321ced0ae794cb5ae5", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231825, "uuid": "2bad4492-1353-49bd-acfc-89b803a0c574", "comment": "Malware payload (Mirai)", "value": "f572bf3c4213ce5b90fb271184db5d4d16f36031d5affeaf3fbc260d3a4806e721493f7b9d6587c81e98f6477fc5a55e", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231825, "uuid": "63054932-48fb-42b3-a185-6923e9ef3a9b", "value": "T141445C32663A5B1BC0E0E57A10F78766B2F707C82574824F7EA20C5D7F696603297AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231825, "uuid": "4e4e5a4b-e5b1-414d-a045-d1cc213816cc", "value": "1536:kC9VzQu4Z9u0QOpWObU/E64mzPr3486xyzp2PxZTQFRt9+BaCR3fCsZ7Hs3ntdkz:k4dypzC6OiyRvyaOfts3oq+j5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231825, "uuid": "383e14bd-8b19-4488-97fa-cd9b4d9535f1", "value": 262780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231825, "uuid": "0cc836ce-c2a9-4c4c-89bc-3ed8e8767b6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231825, "uuid": "75eb0d4f-55bb-4807-b8d1-b88469a5be77", "value": "log21.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab1aeea-aac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676197945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197945, "uuid": "bc4a50b5-38cd-425f-a426-d17a84eedbfe", "comment": "Malware payload (TeamBot)", "value": "a291f52688753bfec2f04434a6275823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197945, "uuid": "93114d6f-89bd-4818-a100-b2b0ff9d5239", "comment": "Malware payload (TeamBot)", "value": "33d43eb2e8047be7c86e56799bd59a46f51ed8d040d79afc33071ae755c8a443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197945, "uuid": "4d15bdab-6a29-4eba-b360-2f8f8b747027", "comment": "Malware payload (TeamBot)", "value": "56f088a229ca6e97b6f9bf97953d22eb0317d7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197945, "uuid": "d5d19a70-3fcc-4a68-a75f-e6df501885c6", "comment": "Malware payload (TeamBot)", "value": "3bc73e14caff0305ae5a95daf79ec16b7cbce770dd507f8b5dc05f3ebf5e2a135a1de67baf9b1d5bbec7c33a7feafcb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197945, "uuid": "97880c49-f0df-4f48-8d03-f99434960f04", "value": "T1D014CF2176EDC0F2D59786B41931DAA56A3BBCB1A732C4CB3314266F1E313D15E3A362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197945, "uuid": "6e793f9b-2fe1-49c1-8bb0-2a6667441eb8", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197945, "uuid": "fc64589b-fd9d-42e4-8209-8bd431cd4542", "value": "3072:ZbDL+FA/Rsf3wCt30TLmZ/0JqDecKGTFparxxmM:N/u390TL89DecK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197945, "uuid": "ca47da7a-5813-4be2-9799-349bba1097e8", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197945, "uuid": "5c687640-cb79-4acd-9da6-f6f162b8fcf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197945, "uuid": "754e0e88-b3c7-4e08-9a36-609f56054a28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ece7578-aab7-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1676193925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193925, "uuid": "e40f7c8d-a89f-4f88-ad03-78ea908f981c", "comment": "Malware payload (N-W0rm)", "value": "0a0f39f830c524972eb295b5936aa662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193925, "uuid": "e8def3bd-c64d-4091-bc18-6b36e68ae858", "comment": "Malware payload (N-W0rm)", "value": "33e840613fdd40de4bdce504915ca916f467d10bc381be34716961315bbc7e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193925, "uuid": "e1002782-a57a-4086-a3b3-7af81238943c", "comment": "Malware payload (N-W0rm)", "value": "b105f5e91f06ffc2754a44b94914524cc0ec0ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193925, "uuid": "8cb5d418-26d3-4f64-b50f-588f5c824ddf", "comment": "Malware payload (N-W0rm)", "value": "12bfefd130b4f487bfe69b9bd028ca36223133d93046c1a84cf42a59165bda1d76a499bb8b39f85f195830651b034d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193925, "uuid": "f2a6b5ea-bda8-466d-ad84-1357a3853eda", "value": "T1FC46C001FA429036E9938172DD3DA33D4629AA591BF148E7A3C05EDD5EB12C07F3269F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193925, "uuid": "b774a588-a1bd-4933-85ab-2cb3fc053aef", "value": "bde0db652855a1378dec0b99a5f38626", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193925, "uuid": "5c45506e-606d-43ee-a865-3d0346784b91", "value": "98304:ZspkzuYnHDsB7V7UUE/8EI79WFynJih6/BEO:Z2Su7V6k7wQJc6iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676193925, "uuid": "9b0cd006-b54c-4293-bd64-bc82daedf048", "value": 5398536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676193925, "uuid": "287f3627-021e-403a-9756-372e40c64991", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193925, "uuid": "1c45aa54-d44e-466c-b39d-b985ae54541f", "value": "0a0f39f830c524972eb295b5936aa662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ee50ac-ab1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676237509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237509, "uuid": "59c52919-42c5-40cf-a0f0-6d7cf54e2803", "comment": "Malware payload (GCleaner)", "value": "f7e53bee2114e9ab4970667e4c9b14f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237509, "uuid": "21a82c1c-aa68-4219-9444-0047612c3479", "comment": "Malware payload (GCleaner)", "value": "3426e80a244e6bbdd649f8c884355b127c20eda9bd834f1aefe6198224fc4b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237509, "uuid": "9d2765cd-68a1-4a23-8909-94740aff7501", "comment": "Malware payload (GCleaner)", "value": "517db6b84f8a2c13d57673cec139e6b263781379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237509, "uuid": "132716fd-7ac0-4cb5-8860-f539b50167c0", "comment": "Malware payload (GCleaner)", "value": "2cdc380af8bb9bd360a87b57d8d32710ae73f9c3bc2229006e8dc4d3fea0247514e5dbfef82aaad34a6ca72119af89ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237509, "uuid": "91dd0e66-1e57-4580-8958-6b4d14b014f6", "value": "T16AF5123C7505C4ACD280FEB4893AE4E71CDB6DE3E9E4A06270C9BF3F55792859A0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237509, "uuid": "898b1cf0-c59d-4fff-af37-167cb07593c5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237509, "uuid": "2d0d3b7e-e9bf-42ce-852f-56cdaf7f6102", "value": "49152:rdHLOEFqU9IHjMSN4xgSrf35wwytA/7TuG6y7p2Ng2hvVIAkNlCGmynsxMxxMnWZ:JHlcAIP4Xf35ZTCm8PW/Cj5Gv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676237509, "uuid": "6d2fe23a-4a78-466e-a0e3-d6a1a4d34fa2", "value": 3459085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676237509, "uuid": "472cc57f-238d-4270-bedf-71179b4cf598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237509, "uuid": "d6be48f3-27f0-4001-b393-78297aed9c14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ae58ff-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "12dcd32e-b45d-403a-b17a-b5fb283dd218", "comment": "Malware payload (Mirai)", "value": "3aebb568ce8040a3f8acf5f7d679d7bd", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "507d96a6-c2d6-44be-ba8e-d7eef3ba54f3", "comment": "Malware payload (Mirai)", "value": "348a34ca2fac56f68548b9041e618e81dd5460eafba31c054476e3e473ce3c31", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "6ed87e1b-d78a-487c-9520-54b4a09a0449", "comment": "Malware payload (Mirai)", "value": "2e289c4996d025225072c80ffb4facf095af84dc", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231672, "uuid": "89453bc8-06c1-40d5-8ff1-f40782c616fd", "comment": "Malware payload (Mirai)", "value": "06f07d71c331b8d22a03560b3a1adc42db8a22ef334a792aac1657c2a257f72a181fba33aef87ac63292d66df2f59be5", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "4118cda4-e824-48ac-bb2d-1a58a1df61b1", "value": "T13013F13012115AB3C330C97AFF6545A736A9567CB7CFB18B13579429108B86B0FBEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "b0536cea-ca28-45e9-9772-aa82206cf56a", "value": "768:MGohoS6lKk6VMT25KhEu1y2FDztOIVzpta1bZBuDAsn9cc7s3Uoz2D:MQS6lqVvEhEu1y2FHwEpshZ8Asicmz2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231672, "uuid": "1a6ff316-cbbd-4380-a545-01b768b99b8e", "value": 45168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231672, "uuid": "688b671f-c1c7-44f5-b5e9-aceb260fafa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231672, "uuid": "2757d739-029e-4a5e-b14b-4e633e9d203c", "value": "log21.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f9c031-ab2f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676245631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245631, "uuid": "e4c85935-0219-41a7-936b-df094f4cc866", "comment": "Malware payload", "value": "e495c8e4494c11a899a706567f904b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245631, "uuid": "c8759f1c-c02f-475d-88df-733a0a772478", "comment": "Malware payload", "value": "351f5c8033dfd1f9e97c8dbed3a6fedb403cef9d8841cf300fe7fd252cdd0c56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245631, "uuid": "a93fdecc-b5a1-43f2-8ab0-08fb2ae6449a", "comment": "Malware payload", "value": "eacfb930bf62d970d7c4696897d7dee1a2cfe584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245631, "uuid": "2f4d09d0-6a7a-4b82-a91b-a3764e79267c", "comment": "Malware payload", "value": "d6943cfaa6c0b1d1a08aaf8845a15fff04b365391aaed8e24c6e5d3548e7a244f92bcda4f73f1c627778122a90cade36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245631, "uuid": "7f310190-e6e9-422c-a869-9e69bf3ea1e0", "value": "T1E8F5127CB155C9ADC2C0FEB88D2AD4EB1CD62EE3D8A4A41370D97F3F52792845A1A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245631, "uuid": "70364f4c-026f-428b-9133-ef9267037553", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245631, "uuid": "7b97c8a7-6cff-4307-9b05-7ca7390dc6fd", "value": "98304:JHDJWkr0LDInmsYY4vcXzljMXKlAlxObB3L60v2MR:dDJtCDIF4vchjMX4u0vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676245631, "uuid": "389c02a9-7156-4c6e-bc32-d330675cce81", "value": 3585980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676245631, "uuid": "b2b7d08f-6c82-412c-a4de-f4d7274e0d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245631, "uuid": "5e5df637-2d22-49c1-8b47-a5f414647493", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e10230a-ab03-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676226646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226646, "uuid": "7664f504-1805-4f0c-a454-10e8706a550a", "comment": "Malware payload", "value": "c5b934a198057faaeacb8faa25991519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226646, "uuid": "ec2b5bf1-f030-4059-8667-7f2e02cbe11a", "comment": "Malware payload", "value": "357740f595322fce6a092a040863e40994b0727498c82ef3b919dc8a87fea382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226646, "uuid": "191f8302-56e3-4359-923c-7b4b89a09ff4", "comment": "Malware payload", "value": "5f1c855f158adddddd131bdb188b6a27f54569a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226646, "uuid": "1265bf20-a6da-41e6-8aa1-8f4d23f19743", "comment": "Malware payload", "value": "7f0ed9e52abed4d738a3bc41f7cfd4ae035a1d70daecab7812173498d18f6f8d35f34636f6eb9b7197a4af083e5099d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226646, "uuid": "9dddcc43-6f29-4035-8ad4-ceddc2359fe7", "value": "T1C0F4121BA6E88032E8F5677018F643D31A36BD616B38836B178FAD1C08725F47636767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226646, "uuid": "39567c41-9b6a-489e-9931-14be1f4bf824", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226646, "uuid": "07f3111c-b8db-4438-9d1f-9394ee25f024", "value": "12288:yMrUy90P4Ci681hIXByjs5oMIaYrX6eJgKxSS0U1ww4Pe6/ZXqOPOFED:2yqM11s5oX3r7goS/i4Pei5WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226646, "uuid": "6398babe-6d09-4e02-b9ab-df7933bd91af", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226646, "uuid": "530e419c-e6dc-41e4-b6ac-3ed8a3da887e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226646, "uuid": "2853d423-c4c7-4df7-8166-2ba70fba764d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba547108-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676231955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231955, "uuid": "842fb142-716e-4393-b9b3-448f42796368", "comment": "Malware payload", "value": "753c7d5feac0eb610401ad4415f45ad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231955, "uuid": "31ab31d7-ed66-468e-bcc7-d48c157f86da", "comment": "Malware payload", "value": "3822ebb3be228cd9a6a6c189f4717ef69c693710fb33b5658f4f997813e1a13e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231955, "uuid": "3c1eab68-a221-447c-b281-7b58256079d4", "comment": "Malware payload", "value": "ea8bf2f2c1691f5cd4f6eeedf5bdf6f4804c41ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231955, "uuid": "e9f833d2-04bd-4fc5-92ee-2366758e85fd", "comment": "Malware payload", "value": "a9c311716e6246aec30422d68ac839382b62dc2f8c2a38157ade6e262e26cac41f522e98e8180f01647a0c3f96a7ec14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231955, "uuid": "926189ed-2f1a-45a9-bc77-de47ddfdfb87", "value": "T101F4121BE6E84062E0F157701CF606D31A3ABE51563483DB570F2E9C0873BB4A6767AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231955, "uuid": "5c5108ac-a398-43f5-adda-60b6e5da3c1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231955, "uuid": "74f9754f-a05d-4f4a-b22c-b956c80c95d5", "value": "12288:BMrZy90j8fQW9ZFf0pJob8W58eJDn27kMxUilB6oki3SmglvCPC:MyBnRgJob/PMxR6o1Cz5Cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231955, "uuid": "473306e9-a50a-4de5-a6e2-3100480a6b3d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231955, "uuid": "250186e2-6978-485c-ba88-b48b543b0d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231955, "uuid": "1b1fd04e-711c-4dbc-b4ab-3f7a51609223", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609483f6-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231805, "uuid": "451df243-4e7e-480a-bb2c-5fe304116b40", "comment": "Malware payload (Mirai)", "value": "faeb4ffc05f96f7a5c9d7f12d890fe9c", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231805, "uuid": "7caea4a5-b5c4-4c67-b3e9-837791e66db2", "comment": "Malware payload (Mirai)", "value": "389b68a6a49e646e2c73f26ba02f5e9e490e80c0f48bcc79d2ae731b8c3bfe69", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231805, "uuid": "47c481d6-5871-4ccf-bddf-eb9f30eac59d", "comment": "Malware payload (Mirai)", "value": "9530e32cf3c6fd9401323aa641672d748df9e7a3", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231805, "uuid": "0ff4d5fd-1d17-4325-99b4-16b5f079ccb1", "comment": "Malware payload (Mirai)", "value": "ee0c71dcd8b73651dcd184d358836b1bccd601455aecf7e5c9cc8d36b2d6724f78497ab4921c2227f8d9cb7ee290923f", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231805, "uuid": "e8a1228f-52c7-4c3e-a7ce-9bf8e4c591e5", "value": "T1E713E135C6ED1ACADF7F3EA08D4995E366724FDF4992D09812093D30511BA81E7CCAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231805, "uuid": "b2465bef-945c-4e94-b098-6e76de8ec4b3", "value": "768:62B6rlwK+kTObfm+Eqs3B50Y00AcDKP3WerwKghzbfcWUO5Vr2C1cPq0SBik4uVI:bQlxdMfm+Eqi5v0jOkavJtS73c4u+qgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231805, "uuid": "ea84fe4f-745f-4886-bfcb-1411f08cfc5e", "value": 45408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231805, "uuid": "1950a564-80f5-4557-ba67-fe15f9231074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231805, "uuid": "ba7cf5de-b3d7-47b2-a525-c4327f65d01f", "value": "log21.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ebe0990-aafb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676223212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223212, "uuid": "152dcb1b-74de-4faa-ab13-6c4e86202350", "comment": "Malware payload (Smoke Loader)", "value": "64cc9b367123e454ffa669d52db7df28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223212, "uuid": "eae2efa4-c29c-4450-b455-60d26aacbc09", "comment": "Malware payload (Smoke Loader)", "value": "38c21848248fd04dca7349e2ec787f405f19ed7ba3d107f1e744ad58cc7e1590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223212, "uuid": "3973d9fd-704b-4087-b5c0-705af982f698", "comment": "Malware payload (Smoke Loader)", "value": "80c35c06dd29960b069a8518450464ab09b6cd36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223212, "uuid": "8d19f612-57c1-4228-bddc-5579b27e6928", "comment": "Malware payload (Smoke Loader)", "value": "e477d3d47265bd1ff9ddaec2d03d211f953c0b1336ecc2b3e3dcca9943b9df30dae841cd6a9a1cddefe95516634392d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223212, "uuid": "4c5c6c3b-eb58-4cf5-892f-5aa79ee1f27d", "value": "T13E14DF117A62C072F16742B10530DAA1EA7FBCB15761C5EB23481BAE2E333D14F7936A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223212, "uuid": "dce77494-eabe-4746-a660-3ac80c479d32", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223212, "uuid": "9deadfe0-d95a-48f7-9d19-cf9c83950797", "value": "3072:Z7dLB+HHU56tFy0Pi1U+N32qF98VRZ6fv0OHw7CxsX:trCDm062Rj6fVHwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223212, "uuid": "ef7fc1ec-dc0d-44e4-9e79-50dab070f7cc", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223212, "uuid": "b5020ce2-801a-41dc-9297-68f861bfb97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223212, "uuid": "f3eb4cde-7c4d-4ccb-a6d1-d07e28f7bbb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0601f735-aa6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676160786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160786, "uuid": "a512ba03-4f2e-47d1-bb20-28e1851c8bc9", "comment": "Malware payload (RedLineStealer)", "value": "d6615f0b1f1e6114dc772b9d0648611d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160786, "uuid": "31931227-703f-4c3c-b31d-7a8d4b86b8ee", "comment": "Malware payload (RedLineStealer)", "value": "38ecd29b560629e620411bd00e652549463696189cf91ea07d6ed559113336a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160786, "uuid": "ac8c21dc-7355-4958-8330-c1b63a0c1a96", "comment": "Malware payload (RedLineStealer)", "value": "370125d2caf68d9e188ef560bcaf3690f59ee41b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160786, "uuid": "835cc2e5-e134-4a11-b0e0-2e08a81f9843", "comment": "Malware payload (RedLineStealer)", "value": "3a82ddebf7c5610ef70f82056a2893ff40f8f8680d81039b5b9fb66d0a5c88f84208e8e8e49b25b787a0414b19d9f6e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160786, "uuid": "8fc2e029-0c38-4f4b-9e28-8892d8dc409c", "value": "T157F41207BAFC9022EAF56B7018F703D31E757D616A34925B538F6C1909736B122363A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160786, "uuid": "57fe5a12-fbfb-41fc-8c47-1de081e20191", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160786, "uuid": "23ac6591-2953-412e-85f2-1b7344812d04", "value": "12288:oMrYy90Z/xXVcVQ569mo37lveJ5EtIXqXq0Qn+o2nC+G:wyK/JWV+6oo37WC+aa0QnFKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676160786, "uuid": "fda90e14-a4c1-41c8-8e1f-ebcdf8039d38", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676160786, "uuid": "8a8654b6-c47b-48b8-9a2e-4fb376ba1d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160786, "uuid": "cdce4fdf-78d0-468e-acd3-31e91674811b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241be1a6-aad5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676206792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206792, "uuid": "4c7adb76-59a1-46e1-8b53-9caf5990816c", "comment": "Malware payload (RedLineStealer)", "value": "75b4fcdf0bf73a515e8a9f2998ea6652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206792, "uuid": "34a5f132-ee73-4d0f-a07b-8c416796c397", "comment": "Malware payload (RedLineStealer)", "value": "38f88ca03dd9d4294cc05067168f294a3b4af8e242612b9abe3f19a039798596", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206792, "uuid": "f9d4d435-bec6-4b1f-bee7-f60f5911723a", "comment": "Malware payload (RedLineStealer)", "value": "1d0c4641b914b38238803a2db80466dece0ef3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206792, "uuid": "081ea81c-0abb-4141-a7ba-220ef36a23ff", "comment": "Malware payload (RedLineStealer)", "value": "b3b956b1790eb8ba5c0ccacf3099a117bc43b8849ff5b44ada8059de6f94aa6a4842950d267452f734c0d560c6818239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206792, "uuid": "5345d606-b700-4217-9342-71feccad6490", "value": "T132F41243E7F95032E8B1577119F607C31A37BC60AA34C29B238BAC5958727E0B536B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206792, "uuid": "e18d9abf-049b-444a-ad22-d87f27f62a76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206792, "uuid": "81fd370a-f63b-4f93-a272-53da4b7b82ff", "value": "12288:dMrpy90ZWPfbxrL2VgC9bLBlMzeJz84WPOM6dLgPlnrHLO0C7P:8yEWPfbkjJ9lRwDb6ePhrrO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676206792, "uuid": "8f42df9d-961a-49d7-b8aa-2c21c26f05e8", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676206792, "uuid": "3694ed7b-92ac-467d-971e-0db9de4b0aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206792, "uuid": "5d2171c3-90e7-4ff2-b195-7dd341bcc4ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a176f553-aa89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676174361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174361, "uuid": "094330f9-7e8b-4f67-969a-09652fbd85f6", "comment": "Malware payload (RedLineStealer)", "value": "6f1a189c1bf9f2945d3d6627d7f21e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174361, "uuid": "26873fb2-d9bc-4ed0-9aba-4a755d328153", "comment": "Malware payload (RedLineStealer)", "value": "397f73808789a11432ec367218d1538fd5f854822785fe5eb3902926c57cde51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174361, "uuid": "e0f8c552-8e2c-4643-9407-c7f03093753d", "comment": "Malware payload (RedLineStealer)", "value": "041c98017f3d64da6ebfd09d120ce78039d95792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174361, "uuid": "7a8dcea8-1a66-46eb-9571-cb8fb6ef1cd7", "comment": "Malware payload (RedLineStealer)", "value": "5ead51ee3343c42c29f83179dd4868e088d5e93ba04c3c075ee6459686e7f3bb0408eccd6c0cb954433f621339232fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174361, "uuid": "4082fd2f-ed60-42ea-bc41-82d59cd7ab59", "value": "T180F4125BBBEC5032E97A977029B307C31A357D614638926BB78E6C180C716B9B13137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174361, "uuid": "93d4beaf-620c-43f3-85fe-b4f3e0ad9384", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174361, "uuid": "5945c864-1b26-4c13-8962-09240041f27d", "value": "12288:rMrHy90+S2/4mLQZtOx0A86AcQKH66KweJ8UMdTEvFYmIANSBeDsU:IyY44mq9Ag6titMlgFYA4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676174361, "uuid": "6de88ff2-f532-4ebc-a3d6-92e3f649130d", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676174361, "uuid": "dd17ab0d-bb31-4c40-92ce-6dfe2df6c251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174361, "uuid": "03897c6e-364d-4183-ab20-5d68dfe67972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c578957-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676179506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179506, "uuid": "3498df58-7db3-4991-b639-a979f7f6c404", "comment": "Malware payload (Chaos)", "value": "4c19104c6df0817095be0846b1607de6", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179506, "uuid": "e84024ef-a085-42f4-9281-c992e87b293e", "comment": "Malware payload (Chaos)", "value": "3998d0e987accc2837c6bf87fdb2796d0170ae2a79383b78fd778531410e337f", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179506, "uuid": "f31f5012-664d-41ab-9f2b-fae2f3946676", "comment": "Malware payload (Chaos)", "value": "ae3bf7a043cb10e8b206261af6af1558fc3d518b", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179506, "uuid": "3579837d-9c4b-4467-ade3-789540293169", "comment": "Malware payload (Chaos)", "value": "6646ac485fbb42855d6be3565af15ba0eb05154e256bbc12350cb114a5bb1864fe24b5b7526399bd651cf7f50157ef05", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179506, "uuid": "358acad3-d696-453b-bbd2-73e14c501a72", "value": "T1F1E3C0103AF7513AF2F76F785BF4709A8A7EFA636E16D55C1486020B0913B48DE60B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179506, "uuid": "f68e5bcb-16b9-4299-8fcc-e6fef6b2cfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179506, "uuid": "7a8db119-5bfe-415b-88e3-a3cf6cf9ca59", "value": "3072:o3kkKmAr9iVE3E04sMsXVpBWwLJwvkywY2ZDja9eIBdvhGkJJ9QuxIMb68J5K:y8r9it04XYVBIkNYcaeUvkkD9QRMb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179506, "uuid": "b9b8470a-7870-4882-88c6-2c200bf32906", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179506, "uuid": "2f393782-bb90-4cae-9c97-8927c4dd978a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179506, "uuid": "63887a5c-484b-4ee2-b92a-762553b85521", "value": "2023-02-11_4c19104c6df0817095be0846b1607de6_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb87956-ab2e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244977, "uuid": "6b2ae6b6-3ac4-4608-b546-3fe4567880c2", "comment": "Malware payload (Mirai)", "value": "918954fd91a718f71a022c1d7ed31121", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244977, "uuid": "5c01dc1e-2000-4b69-b284-075fc3250af3", "comment": "Malware payload (Mirai)", "value": "39e11d68dc52233c19bc5be19b8ca5cedd9739af9ce3f3293036e40079316dd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244977, "uuid": "117e0f30-e47e-4d6c-a8a2-1735d6cb36f2", "comment": "Malware payload (Mirai)", "value": "f1fcb47993dfec3416c7bd8eda43922d24f41120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244977, "uuid": "80e93363-9693-4cc7-91a3-ea13dbc0143d", "comment": "Malware payload (Mirai)", "value": "b693c7942a6f0c6ee84de5fa92a45c9ce226801a31dcc0a7dda1744826932d7882757bdaf29d40f930f083e4a5b4e9b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244977, "uuid": "63bb8c61-1c48-4cf4-a982-83217633da22", "value": "T14CE2E1B4F0950F44C9BB2FF1198891E933D5A743AA52C9E341BC9FA025CB543A620FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244977, "uuid": "ff14be1b-1a2c-4786-a059-dcf999424334", "value": "768:ZDxyCxflfxVyFpzyvBqpU3MMg/469yn58tgMrL4uVcqgw0RTWXiU:LyCaf+vku3MyEyqzrL4u+qgw01WXiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244977, "uuid": "7f1e4210-a094-4b73-8db7-09e738b654fa", "value": 32180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244977, "uuid": "5f612974-a828-425d-bde6-3991078e9a16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244977, "uuid": "2f176e4e-f1f7-4db8-a853-cd281c632003", "value": "918954fd91a718f71a022c1d7ed31121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac9b127-aae9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676215501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215501, "uuid": "5d09d6df-c18f-4891-8c0f-a96a83662239", "comment": "Malware payload (Amadey)", "value": "72624f48bc3463419df3fefee952886f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215501, "uuid": "4a1191f8-236c-4647-8a94-c83e47485450", "comment": "Malware payload (Amadey)", "value": "39e9fee64d70cda681219cc9b2c3cf2cc72ae952d41925e2ff5db5593e045921", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215501, "uuid": "9593b9cc-0f07-41aa-8134-b7a6df8c7181", "comment": "Malware payload (Amadey)", "value": "e9c8c016f3c9a6401ceba5067299131c076dfe80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215501, "uuid": "1cf421d0-4926-4460-b63d-0b30a002a272", "comment": "Malware payload (Amadey)", "value": "5b089691bdf1e33a94abfbf84c2724424fa35effe31fccb82218fe67f035b4c2c92ebc6d21be558eb480fa92d21611d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215501, "uuid": "e6145e6d-f211-405a-ae53-c7902ed333f7", "value": "T13CF4124BBBEC9431E9B06B7119F603E30A31BD605E349717278E6D4908736A9623937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215501, "uuid": "b9f55ea3-dca3-482e-9702-c26c9db59fcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215501, "uuid": "7a43c5f8-30eb-4e04-9256-7c726f939ad2", "value": "12288:NMrOy90NVZ3J4tIGsb0C0SowFLXtvjlHPNeJEN/fZmPJR2bLuX1Qnal:jyo4Ov+Jw9dvBWENn2D2+X11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676215501, "uuid": "6fc8f240-82c9-4374-9324-ad7ae791fdf6", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676215501, "uuid": "4816c2a0-e26c-4ed9-924b-4bd811664004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215501, "uuid": "84857445-2273-4c54-90f1-652191620782", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a39203e-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676235552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235552, "uuid": "577ad71b-a77f-4c43-b161-2271c341706e", "comment": "Malware payload", "value": "ac3ab963acd3e648a0997988ffd8fce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235552, "uuid": "0d4f2831-34d8-4059-b689-2332da407891", "comment": "Malware payload", "value": "3a2e82a5154b066f55c0ea8f9a84cb3452b4c7ab77adc897b6870c0a5f43b2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235552, "uuid": "ff278e93-99f4-4c21-b607-fc7e31ccf43f", "comment": "Malware payload", "value": "c3d2446260d6e055139806656e83cfa5350b2b7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235552, "uuid": "3f65c327-814b-4618-976e-de3c1bd66487", "comment": "Malware payload", "value": "7508e0d90c493522ace0368e02ed23537564d8eeb4e32a03b41bbf98331b4729b83f000576d2c5cddced7c40f5ac8671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235552, "uuid": "019e1ad1-937f-450b-a510-c8a4c7804d5f", "value": "T131F4120BA6E98073F86557B02DF606D31A357D515B38835BA34EAD5E0C72AF4B23132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235552, "uuid": "ecb47cc7-a6fd-487e-957e-c71bc8f6f261", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235552, "uuid": "84d8252e-075f-4100-ac50-57e4c9ce7c05", "value": "12288:FMr6y90MTEbtPImDU2OR76T7XYxun3wnQr5/eJiK/NxyVbai6CnOcaUR0:LyxGa2ORW3YxikQeiKnuWi6COcaUR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235552, "uuid": "83531f2b-b427-4a8b-8654-389e548ae08c", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235552, "uuid": "e3ab90a0-000f-48fe-9aa0-3c5e71eb005a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235552, "uuid": "7cd622b9-5318-4f93-b071-10464d19f317", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b8d1c6-ab0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676230921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230921, "uuid": "4e08a43b-db8f-4769-b674-fca7d53e3fb8", "comment": "Malware payload", "value": "3111ae1b6a9e1c173eaf3a7bda34ca7f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230921, "uuid": "d9d4bc36-dd78-46fc-8f46-19388da0edb5", "comment": "Malware payload", "value": "3a8e672d0d59855db74d28528c41684357e7e534312f8feb3908c5e4d5856678", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230921, "uuid": "ff333c88-c4d9-4759-857a-378902e2cd4e", "comment": "Malware payload", "value": "c2a6e03871105706b5889bd1078a402efc67a268", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230921, "uuid": "8b62e886-9908-40ba-9276-48d17e56676e", "comment": "Malware payload", "value": "a352ba4ef7b47f75077ea84862bbb31c7744ac58e562c390b7500262f4fc637fb151a86b706e33ce498c1bf6ac5e7421", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230921, "uuid": "151fe054-eb58-4383-9d04-37fe0e1f2ff6", "value": "T163335BDDAF2527E77809CA455C830DC83E7EC124DF1D046F18A5168B760F1DBB62A2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230921, "uuid": "f18a7bdf-516c-4c6c-bc30-fd9b33bd3c16", "value": "768:r+1VMDvbrLLMAedsaNLQnxeP+Fs4ofdESVBrps/7hk1+N52K:rvLLYAeCaNMxefwDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676230921, "uuid": "4d15dc87-368f-4ea6-b68c-866f90b01c02", "value": 54185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676230921, "uuid": "6b410d10-2059-4117-ba79-18e821b847f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230921, "uuid": "12758e1e-da9b-4190-b84d-e16ec3a3f7d9", "value": "Payment Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d669214e-aafe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676224701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224701, "uuid": "0a73f299-8af2-4c02-b4d5-78d8a3e853ab", "comment": "Malware payload (Mirai)", "value": "8d254387f162513937157f031c357725", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224701, "uuid": "fe7fc07b-6f07-4b6a-b281-a9a4e2affc3b", "comment": "Malware payload (Mirai)", "value": "3ad3113c6cd2bb83ca386bf997e28728768982e3d1f176bcfd788781270a0675", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224701, "uuid": "3e37bc48-c9a4-4039-91d6-bdcdc9e18c76", "comment": "Malware payload (Mirai)", "value": "5e59ec4432f527ce082ef93b4e3d59d518fc1f74", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224701, "uuid": "11f392be-e06c-4c19-bac4-e06e6722175d", "comment": "Malware payload (Mirai)", "value": "56227d60ab94e2ac93cd01db2055a408b3aac9b6cb2e475fa44fda3bbd6dceb7fa148d87f0d2694c3b92051dd15e231b", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224701, "uuid": "96e7d564-228a-40b7-acb7-39039cfc48c9", "value": "T15F630282B410A0DFC1942C77F67B80C1BA67879952BF31E01D821F18933765A91AEED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224701, "uuid": "7ebbea60-b554-4b3d-94e2-426138a4e6d2", "value": "1536:ZAlRhyOvekjfNDs30nwdWI0IpEcECfLjnfGIQiDWG77:EyE/hs3TYI7ECfLTfvDt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224701, "uuid": "4a372870-a668-462e-9d6a-33702fa6f06e", "value": 69028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224701, "uuid": "2c806058-b84c-4448-82c1-572cfb69971c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224701, "uuid": "4202ba41-85a5-4bc0-a04f-1b4598cb5a4d", "value": "log21.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555ce170-aa90-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676177240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177240, "uuid": "ece38407-8fbe-41ce-a3cd-f38d93982f72", "comment": "Malware payload (GCleaner)", "value": "0aa4d457842133c1dead22d023077362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177240, "uuid": "1dc7881f-6578-4a54-bfa4-1b1dca1244ef", "comment": "Malware payload (GCleaner)", "value": "3b4b7b45470aa4736dae7d2a7c92173e844c8c9af98fe2b9055e89bd5e64ac49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177240, "uuid": "1302eb75-f238-4623-b331-19feac0f2768", "comment": "Malware payload (GCleaner)", "value": "2fe29cece180dd585d324db7b1e004687ac7a3a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177240, "uuid": "109ec324-1c0e-4eb0-b2e8-19be9504ff57", "comment": "Malware payload (GCleaner)", "value": "4f9db5e106cbb51017e04197cb822a5083345a8ef2fd450b2c4b4d2f07f7b0cb1d6121d9dc92aa937bee69ea0d9eb19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177240, "uuid": "0a5957bb-42e6-4b34-89f6-fea27c326df6", "value": "T193F5223D7245C4ADC190BDB48D3AE9E71CD66EE3E8D89122B0D9BF3F617E185960A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177240, "uuid": "ddeb01ac-348f-43ac-a820-801fb067e5dc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177240, "uuid": "98ce1529-513b-46a3-ba6a-88706f9ae1c6", "value": "98304:JHjOZj07VBjWIw0952iLRLrDWlFX4/S/69bv2MR:djCj07VBjWTgDLGlx4/Y6RvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676177240, "uuid": "cb8c31a6-049e-4408-b909-32afb8b0f66a", "value": 3589101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676177240, "uuid": "6674ed78-1a15-4496-9430-5943c581b44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177240, "uuid": "e5aa2086-857b-436f-8ca7-fc813c4d4cf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d325a5-ab29-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676242928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242928, "uuid": "5fa72541-ec9a-4542-91eb-0f1871a9fcf0", "comment": "Malware payload", "value": "f05659dbf1678d80895c0bafdf02768c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242928, "uuid": "6180fc72-b37c-4a19-a27d-e4ae7c72994d", "comment": "Malware payload", "value": "3b68f08651a7c1c5452c69ce2d53c99964c5d7e4c8f404ad22daea2d999aac97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242928, "uuid": "68652193-5fb0-484c-a29a-fb3462c667b4", "comment": "Malware payload", "value": "c0e3288b8210083f054df8a7dff925e0c361abd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242928, "uuid": "859f5c8c-46c5-4ed4-905b-45af9be2a545", "comment": "Malware payload", "value": "43f60e0fef44f11514a5908f5942c75afd6976719aa316a608a60a701fe00ef2716e3d03e64ab6e1662ac4e8fceed8f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242928, "uuid": "08060392-322f-4e29-8f5a-f2550b68d11e", "value": "T139F4121BEBEC4032E9E867701DF603D317397DA14638C79B634A6D6919726B0B23432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242928, "uuid": "050baa7c-62f9-4e10-a792-707134cb1897", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242928, "uuid": "ed366646-2fc0-4f7a-8cac-8c8f5c0c2180", "value": "12288:7MrQy90V31GH3itxAy12xiXdeJkIwr6K9CEjvR0r3kAq0q1:7ygAH3GRKj2l9lSTDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242928, "uuid": "2ab1cdfb-98e7-489d-8914-b57ac3d3297b", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242928, "uuid": "997bcd36-94b5-47e6-aef8-10689bad7036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242928, "uuid": "466f7a88-cbed-4c48-9969-f858e2a59047", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc9e1dd-aada-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676209303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209303, "uuid": "ade7584a-808b-4c05-ba53-4b6fb9c48a52", "comment": "Malware payload (Amadey)", "value": "9876d4761c919a0452dbe64960173837", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209303, "uuid": "87bbef97-6a1a-4adb-9037-b194ddec31f2", "comment": "Malware payload (Amadey)", "value": "3c212a9d311ec93551de54d5788cc7ac693bcc37709552091997550f1da4a1f1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209303, "uuid": "59b75aca-4eaf-4f98-b2ba-5392ef2519d8", "comment": "Malware payload (Amadey)", "value": "bd417e4f03befe795d946a18499764bfe5cf1c93", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209303, "uuid": "874da15f-275b-4e39-aa4b-9bec1a82738c", "comment": "Malware payload (Amadey)", "value": "1ad3da553dd7960dd081d13c4955622e4179699de51e23a593557b68e49efae2e7046d93f1b687779f82b46e720fe192", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209303, "uuid": "ab46893e-6593-4fce-af3e-0bb47af87baf", "value": "T13FF4120BA6E9A172E8B467701DF603C32A357DA15734839B628B6D1A1C737F0B231767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209303, "uuid": "bc92a9fe-fa80-432d-a30f-a7c262447aa7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209303, "uuid": "f5ade748-8501-49ae-99c0-cdaa6f2d8af5", "value": "12288:sMroy90Db09nsAUgEh74wjt9Z24JQB1GeJyzxwBxcsksWghRiDcwb+i0:0yMgX47jB9Z2AAyzxwBxLRhRiDck+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676209303, "uuid": "e91d8c34-a2fd-43d0-99b2-1f669c7155e0", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676209303, "uuid": "5ca14b32-8ce8-405e-9dcc-c0a06d302359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209303, "uuid": "4941ac13-2945-4303-90e7-aa66adfe426c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defdc36e-aac6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676200663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200663, "uuid": "ce850a84-6553-4798-beb5-9701aa3bb03d", "comment": "Malware payload (Formbook)", "value": "da04faf8442e57cefba667c4df43f349", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200663, "uuid": "720f2a38-42df-47ad-bece-123da7c448d2", "comment": "Malware payload (Formbook)", "value": "3d0cd442aa76cc1b53f8c30feb2b70af32b50589ddd5d6968d26af6316676928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200663, "uuid": "7c4e7228-c0bf-46d0-a738-6af12c421ce0", "comment": "Malware payload (Formbook)", "value": "d81eeb54c4b4433f200e2e0634808cd1f113dfbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200663, "uuid": "58ec48d2-9a06-4b9e-866c-ae47bf6163e3", "comment": "Malware payload (Formbook)", "value": "73a520d7bb5131b963cc622453673fa0c70fd608d0e910b57cd14b7943efd00e5d74d8570ddfebdcf4a4c86fc0af2b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200663, "uuid": "342e1187-bee0-493d-b646-6e686b3317d5", "value": "T1485412257BC0C657E89103703E3A555B2FB4A56FAC5CAB0F77A09F5939232C0DA0E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200663, "uuid": "58bfee10-4018-41c6-8e24-13265c3c51c7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200663, "uuid": "53055bd2-223e-4594-a7cf-5afa55c8ae91", "value": "6144:PYa6vkDlGfvokAQ8wFphMKR6OnhddOiDNad4mvy+lI:PYt7ngMrR6+FXDwd4P+lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676200663, "uuid": "f734848d-c14b-414a-b205-131a7c70ac10", "value": 292946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676200663, "uuid": "7256f034-d537-45d9-acdb-2bf0829b3974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200663, "uuid": "c394d6c3-a03b-4425-87e8-f227491b3dc8", "value": "TT Swift ($ 23,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44057e3c-aa7b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676168191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168191, "uuid": "8e69cca5-2a6c-4029-9485-d8817979dd4c", "comment": "Malware payload", "value": "7fad1a7af7c69ce0dbb5e9c6ad1d6ea4", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168191, "uuid": "0c773319-27f9-428e-b410-642dbc024f82", "comment": "Malware payload", "value": "3dccae659859d42322b97ebabd21a0f8848b8da98f4fa4351d2ab78625d41471", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168191, "uuid": "e5f6a86f-365f-4900-94b6-337fb549561b", "comment": "Malware payload", "value": "09297dc07ca8f5ef01df8c1ef8054cb7c78cce6b", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168191, "uuid": "d75c023e-2366-4077-b703-2883d0ed14b8", "comment": "Malware payload", "value": "6bb6771f3f42d0a9ffa0f28778b7ef7480f1a720ff3f8e0f9842856d3a89bd6ddeb7d462687887a1eb32b33fb5546e8e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168191, "uuid": "05ccb245-691b-4d3f-a0a8-f3134e21907f", "value": "T12337335E466859DBF8DAB13B4C1FD02D959AEE051368D18F039C975A0CEBAD02D3BF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168191, "uuid": "9169a939-f35e-47f8-84bd-da12293e3db5", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168191, "uuid": "f1e22722-9af7-430c-841e-bb3b279fa7e7", "value": "393216:Uu7L/OtASFuznSyY+k4tO2dQuslN/m3pDl9AJ4ZoWOv+9fPV4aXlC45RL4BYJite:UCLuFOY4tndQu4KRS4ZorvS3Jk4/0Cgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168191, "uuid": "36b52272-f7ae-44d5-b757-2b52cef78291", "value": 22400353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168191, "uuid": "432c4a52-bbc3-479d-9407-a3de8fbf26c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168191, "uuid": "f984a64f-7952-4aea-b569-eda4a5031df6", "value": "PonysGW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433e3a89-aad7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676207704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207704, "uuid": "7d7dc422-9608-4959-8dca-b6bc33360ad3", "comment": "Malware payload", "value": "e51f1b1ba72b2715d4fb160e42658278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207704, "uuid": "5094f01d-3bac-41ca-aba7-3329f28e796c", "comment": "Malware payload", "value": "3f41abb9383dcc80dc2f51e2e05e51c84d2c97dc6b6594582003791daba8a7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207704, "uuid": "e3699ad1-1da4-4d40-9592-0865570dfb34", "comment": "Malware payload", "value": "f18d35697cb88aadb2abb5af8e03b9c237e96fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207704, "uuid": "e2fdd43b-cec2-41d1-a259-a9459adf09dc", "comment": "Malware payload", "value": "324f7069ad3e1ced670702eda425c02f07b7d3eb8dfc6ad918dd72d87727079880926643a5ec339c3db612127ddc8047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207704, "uuid": "fdc83d22-ff7b-4e10-a74b-c99bae3d74c6", "value": "T1CB14E12136BEC0B2D99785716431EBA065FFB87397A0C1DB3348196F1E703E15A3A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207704, "uuid": "58fca300-d16a-447a-832c-c0a1451a2cfd", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207704, "uuid": "e54a05ad-acb7-4b02-91d0-1fc6b207c9b8", "value": "3072:x7LY+rGh566cUvzTI+rhFVgNv7fRKyNy:lEL26c2zTrrhDgND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207704, "uuid": "b4aef9a7-1b22-442c-a91b-b3ad4f166fd1", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207704, "uuid": "1a1e111e-38a4-4a91-9954-0359c026f6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207704, "uuid": "6ce98f44-b85a-4a84-b745-d959452087d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e34b655-aaf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676220177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220177, "uuid": "96c9ca1d-50b4-4be4-ac06-2231c067107c", "comment": "Malware payload (Amadey)", "value": "0a49303b0265c67f9ab6d9cd488c64d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220177, "uuid": "745e9e9e-b497-4494-a97d-5629bc08c280", "comment": "Malware payload (Amadey)", "value": "410f5846263470bc979d70115ec186fad1503c440c888ee1b54f621f1a763468", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220177, "uuid": "5b8347da-8f09-4049-a5a3-e0d63b107136", "comment": "Malware payload (Amadey)", "value": "4998cc14d9519db93735e1cbd339a713d136fed4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220177, "uuid": "d5bbf112-76d6-4749-bfaa-3e66988bb57a", "comment": "Malware payload (Amadey)", "value": "87de8628c4071a1ce0bdd6f7c2d6c96aef9ff385abd271f1bfa194177d238abae22b6fa75122277947b5090028f40ef2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220177, "uuid": "1a677b3b-539f-4be0-aaf7-7d3416829c8a", "value": "T1E1F41247AAED9432E8B0677148F603C31B357E615738836B278E6D5A18B27B0627137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220177, "uuid": "8392eb27-1760-47a2-a057-ad5f1c33ce6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220177, "uuid": "bfba1cff-6afc-4a9f-bbb9-11ba9c915a61", "value": "12288:bMrxy90ReWbtWdp5F+k3z8fWdvBbaMeJVCzpXqZJFY9Yseq9VD:Gyk5btWdp5wIyWxBbkVC1z9N9VD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676220177, "uuid": "8e8c119a-ef83-4416-89e8-89b534e784fa", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676220177, "uuid": "64e71f98-8dac-4207-931e-2597c0ae9d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220177, "uuid": "b8fe2825-fe24-4715-a521-67a21a157462", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48280ddb-aa91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676177647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177647, "uuid": "889df6f4-e0cf-4c85-b97f-d0132d4f0af3", "comment": "Malware payload (RedLineStealer)", "value": "e030542bc9e6dd53246da6eddd504afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177647, "uuid": "cf2b0749-c64b-4fdb-a810-8a25ff87dea9", "comment": "Malware payload (RedLineStealer)", "value": "41e2af0f5ba6ff20207dbe5ce231ea8a6a260c62c96511b102a6c74788e98923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177647, "uuid": "295c965c-ddfc-400d-9171-96f0c392901b", "comment": "Malware payload (RedLineStealer)", "value": "047edce7f422ec71f932204ce9f900c2c0b758bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676177647, "uuid": "31a72d79-8478-432d-8c29-d22075353745", "comment": "Malware payload (RedLineStealer)", "value": "3218f9bea226d4aafd106393f4383a1b8ebaa267d0c872f41466433cc40ff37b2cf422fd622de87be9f4cf63561f64b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177647, "uuid": "411d1ee2-88b6-4838-a99e-742b7ad98876", "value": "T1A9F41247FBEC9072F8B5573108F647D32A36BE141A38435B234E6C4D28726B1A675B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177647, "uuid": "c6e3bea8-c9dd-40ce-b78c-2205a14199d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177647, "uuid": "f7240f7a-1e0d-4b10-85c4-1cdd909e9bcb", "value": "12288:kMrJy90xsAQVahaXDfWxU2KjHjfeJpANztOIOuvIcoo/endHOS:dyssNVSaXzWxCHcqyRMenxOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676177647, "uuid": "0f990a71-0683-420d-973f-30fe48e0c7a4", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676177647, "uuid": "15f0d4a1-c4f4-45d7-8687-afdc591aca6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676177647, "uuid": "af107e99-6e86-4e78-8f6e-9ba4a17b9c6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c54b736-ab1e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676238240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238240, "uuid": "9979a041-2d6f-4938-a2f5-baa540c5721b", "comment": "Malware payload", "value": "ef3c4eaa964a71c25cefaac5e6f015e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238240, "uuid": "096a7074-0b14-4cd8-9232-1bbdc19daf47", "comment": "Malware payload", "value": "421f0c71c513ad5f546ba47b36a4f401fdc05d924ddd5912c8f2f944ebe59765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238240, "uuid": "6a97ec1f-55cb-4d88-a5ef-37d29f262c31", "comment": "Malware payload", "value": "994b8466408e54ebf7141b5261baaeb99cdb50f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238240, "uuid": "20006a4f-8138-49c8-8712-16a1e1d99695", "comment": "Malware payload", "value": "9274ad8b26c6bad6bce7316c4690c59125cfd142fab0fc1608a2ee71ce40632d72e7169a005f6c1e559c0bceccb8e23c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238240, "uuid": "921a434b-cee1-456f-aade-9ca65dbed15d", "value": "T13DF4121BEBEC9032ECB5277018F603D31A3A7E109B38865B628F6D592DB15B5713136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238240, "uuid": "a31ad65d-3eef-4dc2-8c37-fb3b8cc07ccd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238240, "uuid": "01c326d2-3213-4574-941a-dcd74b85453a", "value": "12288:1Mr1y90hv7BGVJISDlLQj2PiRwUSzeJVR2i72UR3DXw:0yEv0VBDlLBPilRV3bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676238240, "uuid": "194ce12f-8f5e-44c7-b003-a41bb11bc82e", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676238240, "uuid": "9ae197b6-a073-404c-ab87-d8ad6c46cde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238240, "uuid": "fff147ec-76f0-4e21-bc2c-310efe3d8019", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4c5f03-ab13-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676233519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233519, "uuid": "a5187625-bc7a-4003-a1fa-7c03e359c8e9", "comment": "Malware payload (QuasarRAT)", "value": "0888711f6725d8db88b8e690f5ba7e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233519, "uuid": "2b92d5aa-de65-456b-b897-e890c6f6c228", "comment": "Malware payload (QuasarRAT)", "value": "4245bb44ce88dce8c77ed44dba40629ac6e489767b46521a45cf7f52554ed1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233519, "uuid": "5914dcd1-7d0c-4173-a753-912767e88776", "comment": "Malware payload (QuasarRAT)", "value": "6e8e8d80c71a254ea1f5adc3a8e65ca5e55d396b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233519, "uuid": "529f4bd6-b115-49c8-989d-a0cf64da771e", "comment": "Malware payload (QuasarRAT)", "value": "cd0093b160030e46ff5d734beb172d98d609322bec9c89850e9858d94224be2d575d69bdc7d9e74ea389a3d97a90aa36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233519, "uuid": "e7476f18-2277-43fd-81cf-dd5082c00b3f", "value": "T11F44120DA75C9E67DC5FE7BC771C07898B4DD042208AB397CAAF9598264D3690643CF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233519, "uuid": "7caf936c-cb91-4057-be48-f6bb4815a43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233519, "uuid": "92b0624f-8384-464b-805e-8cbff75318f9", "value": "6144:aUzkj3q7QQ0lpcQ079Z2cWItjm3CgGxIL6DUIU9:TkbXQ0L+79Z1ti3CgGxm6gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676233519, "uuid": "db73bdec-635b-4c52-a641-dc8712cf422b", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676233519, "uuid": "594d21aa-488f-481d-8940-0d7c16f98842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233519, "uuid": "394d3fc6-8745-4f15-8b05-265675975419", "value": "0888711f6725d8db88b8e690f5ba7e85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714deba4-ab06-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676227967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227967, "uuid": "1d905ba7-8668-4213-a54f-4039d849cd3c", "comment": "Malware payload (Amadey)", "value": "3ec5a47cacae2c213d98b8ac00666865", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227967, "uuid": "5e5477aa-dd6e-4867-ab83-a2994dc26d8a", "comment": "Malware payload (Amadey)", "value": "42879f043b3c0142be9fd2fed75472c792f1548992ad94e7322acf27fb3e8de5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227967, "uuid": "43936e55-0279-4d79-9e6b-53ccdba23c0f", "comment": "Malware payload (Amadey)", "value": "296a67c72b70f88733c1113c05f39ee5e14000fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227967, "uuid": "9fb49878-0e8a-4273-bb38-44a920d5d4e4", "comment": "Malware payload (Amadey)", "value": "329c5cb44c9fc8a844e4ae88824445d7284c159201bb375a4364863ba962f2e3811d7fcbd2ec867ae2ac4a5767a66256", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227967, "uuid": "2eb6db6d-eff7-4c90-8db6-f7c422228816", "value": "T1EDF41207A7E88072E970577158F603C316397E616B3893AF57CAAC6A1C725E0B23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227967, "uuid": "c8909ac1-d964-4483-abfc-9875908e533d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227967, "uuid": "5b66a06d-5e98-43c5-a65d-23f118732367", "value": "12288:YMrcy90gZRx3xyBZFM2fBtjQm8eJcQq3cgbi32655Peh/CX0TgoSiWe0:UyJTMZF1fB66cJ3X+2655Pel3gUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676227967, "uuid": "51429881-ae2b-4178-9e9c-d977abd2fc18", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676227967, "uuid": "bbdd10ef-5a92-46be-a44a-a44e4b92a44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227967, "uuid": "3a546349-0965-42d9-9978-18bda972e4a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ea0dd2-ab31-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676246339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246339, "uuid": "08b1cc8c-8acc-4164-a690-306b2e824d70", "comment": "Malware payload", "value": "bef512c5e836f9dc9341ac97ac00d7b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246339, "uuid": "306207d3-afd0-4add-8ac7-d4df055acdd0", "comment": "Malware payload", "value": "428d2ae060f9135794acc7ed731e458b94f8590b3577ec5d15b3aeddb8ed2303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246339, "uuid": "83c85b5d-550a-40b4-ba80-89569b45aa1e", "comment": "Malware payload", "value": "124e51c24e8eb96a7ecd6481c4d43455ac84ea8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246339, "uuid": "22b00d29-255d-41fe-9f61-7dd3c08161fc", "comment": "Malware payload", "value": "eef8e8bd3d0de5d7cb12d609afc59096a49bd71bc05160f4a07167965d641126c8c814b1e7d720509b75944ca6d0d777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246339, "uuid": "2ab6883f-0035-47b3-bd0c-7f6f6f16f332", "value": "T1ADF4124BA6E89433E9F477B159F717C317327EA05638829B534B681D08726A1F2703AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246339, "uuid": "3baaa399-b08c-439b-a9a2-7649077505a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246339, "uuid": "e56b320b-39d8-4f75-b274-b1ab6cd1c9d7", "value": "12288:JMrpy90PDFteDRbfGaccY3cNozD/eJ5UkW9KwrTYDinMnsmmmr6jKK:EyI30saccuI5UkW9JnusB/2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676246339, "uuid": "15da48e5-a029-4db3-870b-5377aa7e357b", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676246339, "uuid": "0dc98999-7d3f-4ef9-a6af-571b8f9b92ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246339, "uuid": "24b4db1c-d97b-4893-bd6d-d6e3973e9a67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce2e235-aaf1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676218914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218914, "uuid": "260e7285-f88c-4c34-a66a-463e51f4ae42", "comment": "Malware payload", "value": "0d0feabd5380197e53851ccbba9865f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218914, "uuid": "04c83954-c369-4e52-a4d2-e58837a0f8aa", "comment": "Malware payload", "value": "434a55ad813b1a6b02c52f969ad2101dffb037871b160ee82090383a9961ac07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218914, "uuid": "8b7c40c4-220b-4fdb-9579-870d7e3630e5", "comment": "Malware payload", "value": "562be0fd7bde3664d78fceb5e8eadcbe0d79ff6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218914, "uuid": "19d9ceb6-966e-4430-be17-995f30cc2d3e", "comment": "Malware payload", "value": "2c4e26c44afd257c7357d2ef04aa087fc31d134608414f91fb8224bfb14483dd60609b0f5c5b450c414f321a2594cc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218914, "uuid": "5cda5870-bf38-429b-a380-3518c60709f1", "value": "T1D235D001B5D1C472D5B325320DE4D7B99B3EB9204A619EBF67E80FBF4F30281D621A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218914, "uuid": "01c541b2-fe78-4c9e-a1d5-e8622d711642", "value": "482f298d05f21a8742e0277338b51a7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218914, "uuid": "2552e424-7bf8-4494-9d8f-fd264c35e95c", "value": "6144:xsvgcQ1AJ1ohTEIKMit1yxN/lTfQT8iAhvyQAOPtzfiLPF0flbv1NeGYToV7Kw:ggX1AJ6tEIKMu1yxN/GT5QpwJ0Mc7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676218914, "uuid": "7539f697-86aa-4808-b33b-3870f57fc8e8", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676218914, "uuid": "a741db0e-1a96-477b-a054-a1ea4c90483e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218914, "uuid": "54499e85-2abb-41e0-8ff5-b78ad55737a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4f04be-ab05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676227424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227424, "uuid": "d03ea135-f8a6-4a43-ac99-e7f24b490f50", "comment": "Malware payload", "value": "3004538bdcbd6622a387b8d433eedfeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227424, "uuid": "33651b71-41cb-435a-bd08-cca168d4b595", "comment": "Malware payload", "value": "43834e6b6154b76cf979f1363c549d2e2d2eda1d43292c7bab5efabdd9f6220e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227424, "uuid": "8cb7df6f-a454-4969-a10d-a4111226489a", "comment": "Malware payload", "value": "caed03a7a65df73bafccf0c638704c599d55306e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227424, "uuid": "fdc45805-4181-4c88-9879-a5c27ca4a069", "comment": "Malware payload", "value": "b969ab62fe4b7f5653427f93a09041cbee12223277c61432e3a2fe3b893bcf6fc95ac1c880a70cd39b7b50eded733244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227424, "uuid": "a474aff9-3768-48d6-8bca-b92b29b55392", "value": "T166F4120BA7EC8552D9B1A3B05CF643E31A367E604F38836B178AAD591C734E4A331757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227424, "uuid": "3021cb5a-5915-4662-bf53-ae02ea56e563", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227424, "uuid": "ef5496af-bcb6-45ab-8308-f69f4f7379d1", "value": "12288:+Mr4Sy90UJeBiEuuYNVNDWElIAxD35jYIjeJplasIPee/6XwaU/5po:1y/kiTDjN5x350xpJIPeOH/Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676227424, "uuid": "6ed7915b-05eb-4f24-bd26-58d952ab3e9d", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676227424, "uuid": "270b46c5-c326-4ebe-9995-0a0d0fb02081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227424, "uuid": "99d2f220-1137-440e-a989-f0ee98d61dae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e953e06-aa72-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676164478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164478, "uuid": "8f411273-88fb-49fd-a5ba-fc8ea85397cf", "comment": "Malware payload (RedLineStealer)", "value": "74cb2f45a777e39b5e3e44f360498924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164478, "uuid": "9bb31184-2c55-4da7-a140-0673f4590725", "comment": "Malware payload (RedLineStealer)", "value": "43c45bcf673eabf7e406f7a9c52d806f6b11c704dbc7020f296dd4814278fe7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164478, "uuid": "9a759ed9-6114-447c-a886-9a367c8263a3", "comment": "Malware payload (RedLineStealer)", "value": "e9b670173a258b978b96d4dafb2ed8ffca448e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164478, "uuid": "e34c4b73-5c33-4eeb-96b4-70f7a31c18fd", "comment": "Malware payload (RedLineStealer)", "value": "c261d7282c368688bb413a617cfb47b9cb4e78782f4eeb6fc415bb3485f71031e85b14029cccfd8d83b951d40bb33a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164478, "uuid": "7e8c75a3-e6a3-4c8d-bd9f-7e511664a510", "value": "T18DF4120BB6F89032E8B05BB11DF603D31A3A7D615774426B738AEC580C726B4A636777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164478, "uuid": "6375c91b-bd7c-4715-8f35-978ad698ad3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164478, "uuid": "2811465e-a265-4623-9638-67b92eb224ef", "value": "12288:UMrQy90TJI4MZi/9VQGyhDzQq5w3Sl4ASeeJhv3OmhDsoWUtn85E5BUd:ky/4Qg9VQG8gqWA4Aqk3Qt8ajUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676164478, "uuid": "be0b532b-2c4e-4737-9efd-60e80c683233", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676164478, "uuid": "7ff009f1-0b68-4148-9122-053c2bbebbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164478, "uuid": "a38964d3-fbae-47b8-80a0-450b2dde4cc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca2387a-aa73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676164904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164904, "uuid": "388d816b-53ea-4978-8442-acb314617ef5", "comment": "Malware payload (Amadey)", "value": "0aa866014807c995498bc2bcbfd3c088", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164904, "uuid": "f148c32e-c82c-44b1-8c4f-b3546ea9914b", "comment": "Malware payload (Amadey)", "value": "440fcaf7f11dcb34e2ee9140c5ad940a85a23dd53fb7cada3fd8669ce08ed2d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164904, "uuid": "11ba7c55-7350-4bc3-a645-26d4b669f215", "comment": "Malware payload (Amadey)", "value": "92f0336d4de6e186c65ec4dff95b3f84aa776b0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164904, "uuid": "51ca4c2a-871d-4848-9060-196c46c0b79d", "comment": "Malware payload (Amadey)", "value": "dd87b284d820c9498f4490990f65428ce5bb97227933df81f6c3ec0533326425deb206637afe9a27f83c81a763343d48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164904, "uuid": "a3a03411-3198-4126-bfba-d5e391862607", "value": "T199F41307BBED8432E87567B018F643D306327D629B78C65B638AAC191CB1560B63673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164904, "uuid": "b5c5d19b-4026-46f8-be36-982a34acbeb9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164904, "uuid": "c523136a-0e1d-4ab8-b3e0-2f3cff4ff941", "value": "12288:vMrBy90OTj2smCQqomkEs3ZMu0H3eeJ7t5OYhDODWUPn2y:WyPffVQqZNs3ZMVPKZXv2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676164904, "uuid": "a1dff629-0969-4c38-9fe0-2f9c5f0b5691", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676164904, "uuid": "9d13b74f-73c4-4369-a0e7-0f0c38ff9537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164904, "uuid": "a210346b-7118-4c69-9262-ad972be98ee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95295db6-aa80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676170475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170475, "uuid": "6f68d9d6-492d-435b-a8af-58d0c2e523a8", "comment": "Malware payload (Amadey)", "value": "fa70653403aaa2dd9fe496d330573e74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170475, "uuid": "ea6ca30f-f5b6-478c-93ec-e22a266ca687", "comment": "Malware payload (Amadey)", "value": "453ca04e45cbf004d3961bb9bdf2b6eab184d1bd6924764bb9f91ece2754613f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170475, "uuid": "dbd936ba-e4a1-4183-ad34-44ea4fdef702", "comment": "Malware payload (Amadey)", "value": "188c4eeec31ab49a6388d946904a9ab4c7b2d4d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170475, "uuid": "f377e0f0-a8a9-4964-b93e-573bb3eaab65", "comment": "Malware payload (Amadey)", "value": "14bc7664dfaf6e2d0cfbd966851233095a384d14612bf7f286df2b108c299897785b805f9ae6853cd1fdd302af8ae624", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170475, "uuid": "1d118d3f-ee7e-49bb-a97d-366b5e7d0560", "value": "T1AEF4124BB7ECD032D9706B7048F913D31A36BD205A3453BA374F9C5818726B5A27936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170475, "uuid": "c21c0503-4f2c-44e7-a96c-e7fb435d6c43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170475, "uuid": "ec6c54c6-443d-4744-94d2-aae4ab257a33", "value": "12288:eMr0y90gSCkVkemajIzTXHpJwH9eJQWjA1N//RJqK4Pp1:Cy9mVkpYCXJJwe8/iKkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676170475, "uuid": "68fee055-8f80-4e57-86ac-386ab56c6889", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676170475, "uuid": "73fee89b-cd7b-4c64-bdcc-38851bb6393b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170475, "uuid": "a0ddd617-64ba-4fbd-baeb-0587671a8af3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657665b7-ab01-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676225800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225800, "uuid": "22dfd572-a4be-495d-9780-2ad4baf70822", "comment": "Malware payload (RedLineStealer)", "value": "009c359529a3f37abb810f15571b5c7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225800, "uuid": "7a92f63b-71ac-457d-b6e9-0e6ac896cf17", "comment": "Malware payload (RedLineStealer)", "value": "4674e32e64508cf23ecaccb6182b4607c08a81a11143593d7d9f7e1885fbe96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225800, "uuid": "388f3d08-83a0-4241-93a4-7116219647b2", "comment": "Malware payload (RedLineStealer)", "value": "b48cf0c761b4a4b493943c54535e22493d1f0ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225800, "uuid": "55d6d140-9069-4c59-884f-beb9c3e12736", "comment": "Malware payload (RedLineStealer)", "value": "7d7ca14a3bd9cc68d850f95ef47da164d3b1083be19ffbf9384414d87f7f95d6f6db8db3ffef77dbfe9331f3baf7aede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225800, "uuid": "6a701a03-f88c-4d8b-8619-b282066cfd39", "value": "T1C6F4120BB7E88062E9F167305CF743D31A317E605B38939B238FAD6D48325A4A635767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225800, "uuid": "5c31f2fc-092f-4190-9609-a10792bcb0b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225800, "uuid": "a9d30056-a864-4ebf-bb72-f2aa03d9b698", "value": "12288:TMrGy90ncPgKXVom1a0l38gyEZZwoHQ6j9eJS/u6+Pe8/IX2KPo4bsl0J:ByMHsV7a0ZME/wo7K8u6+PewCLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676225800, "uuid": "55637e72-0a54-4114-84fa-b70964ecc6c6", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676225800, "uuid": "60224569-9860-4f5b-9820-ce9518fdf3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225800, "uuid": "b5cb833c-f266-4dd7-953a-8dd5b9e29250", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce2c0ba-aae0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676211505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211505, "uuid": "816b3998-2582-4864-8a65-b0bd8fb7fc47", "comment": "Malware payload", "value": "8d419363276793eaf3f80e155045322c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211505, "uuid": "2ba12f86-e545-4443-a1ad-a13cde3d594e", "comment": "Malware payload", "value": "469740d2b4b45f2212e937df75eab2285049b20f7786a0a79b1758d00651b31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211505, "uuid": "4babc60a-bcaf-448d-abb1-17f2bde7557a", "comment": "Malware payload", "value": "725ad5b6373d5af850d0e1e3da785670b1f41b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211505, "uuid": "f9526b2e-43d6-4ef1-a91a-11a5548f58e7", "comment": "Malware payload", "value": "4ba10aad379f82fdd256d8f8779b727a1f57c714d885f397a58056b67e351b8374464c1aa3217ce578c27ff0fb505e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211505, "uuid": "bca44c69-acd9-49f4-b4b7-7fdc9f591a33", "value": "T148F41207E7E88472E9F6A7B009F703A31A3A3DA01A344787674B5C5D1D32AB07936767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211505, "uuid": "5a99b1a6-f472-4264-bcf6-4a13a31408d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211505, "uuid": "5b77dec4-04a0-4592-a6ca-85d87e442991", "value": "12288:VMr/gy902jW6PV4Ved07qiMht2R9ZlpeJk7Z5o4zbgERT1wQ/u:FyFZKVef/2R8kt6pERBwQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211505, "uuid": "572e89f6-3fed-4d79-bf21-beb11a97d33f", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211505, "uuid": "733ff44e-82c8-4399-ab0d-3e75d37910ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211505, "uuid": "eb6a1e8e-8589-43ae-b509-04c543a8097d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217b2a14-aa6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676161261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161261, "uuid": "73507420-b4f3-493f-a776-30682c344860", "comment": "Malware payload (RedLineStealer)", "value": "a3d8d5e959bfb97c0701fd8a1a48bdb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161261, "uuid": "6d2d543e-841a-4344-b50a-eb3094ccb6ae", "comment": "Malware payload (RedLineStealer)", "value": "4724639c66361e0125c0f706243717e42312001fce6c71ada7c567a32b1cad9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161261, "uuid": "5c63874b-3012-4d25-b931-6efa64965ad4", "comment": "Malware payload (RedLineStealer)", "value": "6e1feec2cfd676c7f715976cd3d53650e195bde5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161261, "uuid": "077b95e0-0b1b-41dc-850a-6a4164dc5ad6", "comment": "Malware payload (RedLineStealer)", "value": "2037dba49acbd8ba63172d967dea77871269b4b3095ba9754068e905fa3a26cce5ad7e928ef366ce8b4db875a62434b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161261, "uuid": "8488e9ba-24c2-4ad7-84bc-ea2b1eb3dcce", "value": "T10DF41207ABE85022E9F467B055F703C30639BEA04634875B578F6D5D2D32AF062763AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161261, "uuid": "f89a2531-542d-44da-bae7-18d768a1c8d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161261, "uuid": "5ec50b85-9193-4d89-87b3-14a578003906", "value": "12288:0MrUy90WAJatREemWtCrcuosHR2jYIGeJWHeOMlMl9CotSGQt9j:IyUJAREzW0tHRd8WWql9CZGQjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676161261, "uuid": "084f7d21-d39d-4d94-a54b-7b7210900ab5", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676161261, "uuid": "8f5a5d5e-e73c-4e3a-86ef-cb1e27755c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161261, "uuid": "e9dbed34-0b36-4b9d-bf1a-755e3ec0ffab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70188ac-aac4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676199737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199737, "uuid": "ef6eb047-7c3f-4650-b564-f013d19eeab9", "comment": "Malware payload (GCleaner)", "value": "40f7ce4d624c3dd66e49f0b59ada4de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199737, "uuid": "62c3738a-bca7-4e6c-8413-745050d9a5ee", "comment": "Malware payload (GCleaner)", "value": "477c3cb5c188200b3f24e9f2f436aab33b29b045228189fb48627a68e685dc45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199737, "uuid": "2ee68ee3-c3c7-4a73-a3f5-6a7c1ed1a6ce", "comment": "Malware payload (GCleaner)", "value": "b9163955f80860b4c19fa6ea90e9992012e2a13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199737, "uuid": "2782fadf-3fe3-4f4a-b4a8-45ee5e1a019c", "comment": "Malware payload (GCleaner)", "value": "41d13f9609d8987cc936b0f8e863150aa896ee752c55c1abf3a8e0a3b7bfecf1481d4aaa70c4dbd4c170b37ac40363e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199737, "uuid": "e9edf99c-0cde-4551-93fd-73a20d13ec3c", "value": "T1C3F5127C7105C86DD280FDB48C3B98E75CDB6EE3E8A4A06270E9BF3F55791889A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199737, "uuid": "23930c3a-f8eb-45e2-9b9d-cce3d7bf2cd5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199737, "uuid": "f9036abd-6338-4566-ad5a-2d8f7544b620", "value": "98304:JHtaP2QSvAbu20U9GF1sqyVK91EUXp3WEgOs2vxv2MR:dtKvZ0gGF/uC1EUXRVBs2vxvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676199737, "uuid": "c2cbc736-ed68-49b9-8360-8e1f224c52f4", "value": 3438125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676199737, "uuid": "ac1a1f07-788e-4b0a-8eed-5e06269c7d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199737, "uuid": "6316bdd1-509f-4add-b940-3e4dbcad1ebe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a86c77-aafd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676223923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223923, "uuid": "37c018af-de8d-45c5-a270-a35ecba7b427", "comment": "Malware payload (RedLineStealer)", "value": "c090995b6f5d9aa37dbdfe0aa1cf7d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223923, "uuid": "2b8a1145-7fc6-4b3b-8353-402eed557e74", "comment": "Malware payload (RedLineStealer)", "value": "47a20ebc7f81cc8b99991644291d40b89c376f8fb820099317f6dca973f74063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223923, "uuid": "ecad1b82-63c8-4401-9a59-213cdac76bf9", "comment": "Malware payload (RedLineStealer)", "value": "94c430817d92e665844bd4d44a8a7f16bdebbb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223923, "uuid": "873d2d86-6997-4a1a-bfbd-6358eb45d6bb", "comment": "Malware payload (RedLineStealer)", "value": "67c769921b488eb020b6624e50b9ca51210c6bfefe19b108b9bb80217ccfc5310b1cbfe7f077ad31fdb2b481eef2fb9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223923, "uuid": "5b885937-3304-4da7-b143-0e7d73d5fe8d", "value": "T16E14DF113691C072E14B41B4A8B2D7E56A7FBC71D7A1C0CB33482AAF6E313D15A7E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223923, "uuid": "4c33f084-4bb0-4d14-a32e-12faee460ebd", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223923, "uuid": "94ac3bd6-5075-456b-9e08-8f267ab9855f", "value": "3072:R7wvP+rGmn56ZVgbwcnVygHXTlRmPAbC7rplto:FGLN4scTX5shl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223923, "uuid": "52e287b6-e3c0-4f04-9003-6c12abc11267", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223923, "uuid": "e00f8489-61ec-45cc-b0ef-33b19ec6efc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223923, "uuid": "6bdf1615-6954-4522-bfdd-1d52de3305f1", "value": "c090995b6f5d9aa37dbdfe0aa1cf7d83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fc85d7-aa78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676167181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167181, "uuid": "bf566a25-b66e-4fd5-bc98-67eac70aa21f", "comment": "Malware payload (Amadey)", "value": "64b356fcbc24bb86295877301ae8ec33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167181, "uuid": "27a99cab-71fb-4551-b9f2-2035162a2135", "comment": "Malware payload (Amadey)", "value": "48c062ad52b2964527e860dcb8f7d740abb6a8be6054389ec5835451aea55bb2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167181, "uuid": "a6223645-c68f-4cf9-9ded-069aa912c329", "comment": "Malware payload (Amadey)", "value": "6fdfd1b6497351be84303a701155e15942e4f4b0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167181, "uuid": "1f309176-25ce-4f30-92bc-7b9c6bda078e", "comment": "Malware payload (Amadey)", "value": "3ea5508b831196755f6500bce1431a3ae99982ffba8026b15b23bd9e6dfad1dc868c3f9f8dc307a23e918abde6e8c7e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167181, "uuid": "07c443e4-ddb4-4341-a4c6-e79a28d4364c", "value": "T11CF4121BB2FC9432E8B5537019F613C31B3ABD115A78C36B630E6C9A4C726A52339767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167181, "uuid": "86fd980d-5627-44ab-bb06-e20459ac2baf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167181, "uuid": "58c86cd3-3de0-4560-8e8c-8aa0c5a3283d", "value": "12288:PMrDy90Hq/tUYiPIVQZL42Q5NofQWPeJhOkRw1qJPeXrsKdpGva+51CrXMH:kyEAgLH+NofQvhDw1qTl8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167181, "uuid": "c4b99102-33a2-4f3b-8a81-06c60981dcc0", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167181, "uuid": "4bf47cb4-2e9b-4f28-ad82-298bf800ad07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167181, "uuid": "785c1541-15ef-4a71-b937-44dfc60fa4fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da67787-aaec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676216714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216714, "uuid": "9b2601fd-0875-4296-b3e3-e9c2d8af7eab", "comment": "Malware payload (RedLineStealer)", "value": "80d473e74ef0af5caf09840c6c96cc77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216714, "uuid": "55286e51-da1a-4286-bf28-3f15e37417fe", "comment": "Malware payload (RedLineStealer)", "value": "4919c96d698adde51b74c720400a6d8614ecc259b629c1c2652adb250ee8e5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216714, "uuid": "bb9255aa-554a-494c-93b3-d333f6ed07f0", "comment": "Malware payload (RedLineStealer)", "value": "7aea2f983707eb92e57f0361a4061e98a75ad52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216714, "uuid": "1295dfd6-0bf6-4a2a-9fa0-46e6b5b82aa2", "comment": "Malware payload (RedLineStealer)", "value": "86f63865d71235101034def2b18bc15a1ff7bee6a54753e6f1285a52a221ca67b65d43c25ca036e20e01557eb2033a28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216714, "uuid": "88bfdf57-713e-4bf9-98e6-3134c42970bd", "value": "T16B04D61037BCCD11E1BA5A3F6961A06047BFE8026942F65B76C367CD0E32B40F957AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216714, "uuid": "6ae98d0b-94e1-480f-8c62-7cec342670f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216714, "uuid": "52ac670a-3ed9-4f68-8179-9478ad38ccd9", "value": "3072:PxqZWZRanU2n04Mi+BYeF9FvhLTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOus:5qZg41U1vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216714, "uuid": "4785ad2f-e0d8-4719-a700-03c36ad27799", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216714, "uuid": "39ab5ccc-4829-4b58-84c9-70948e93deea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216714, "uuid": "8b9a6c88-ddc9-446b-815c-aa2562eae8a4", "value": "4919c96d698adde51b74c720400a6d8614ecc259b629c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e3e64b-aa92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676178046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178046, "uuid": "932a8cac-c1a3-4594-98a5-e1cd3fa3ea86", "comment": "Malware payload (Amadey)", "value": "58d006f142bc0bdb7d8cac78f9a12d69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178046, "uuid": "45070b57-68d4-49ff-ad6c-fbea054b4293", "comment": "Malware payload (Amadey)", "value": "49c4b37a938e23a86d7890cdac6694a361e3c98a9d7a5965fed980f14262b247", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178046, "uuid": "34715047-13af-4829-9d3e-4582bbef2260", "comment": "Malware payload (Amadey)", "value": "d04d3b29b2dc0552ecba06a59392ff618faf2791", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178046, "uuid": "87e9feb3-7fa0-47d9-a7ff-ae8bb27dad54", "comment": "Malware payload (Amadey)", "value": "b949418c3f266fb2b1a369abaad3feb36556fde951a014ffe5b02cf72749bdaba372762ad10cbf992cc2c86370f6d00b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178046, "uuid": "cdb34f65-6efd-4236-9c95-bf8e7467768c", "value": "T1BFF4121797EC94B2E5B0777019F707C31A367E20477483AB728B685A19722B0B235B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178046, "uuid": "7e8878bf-8319-47ae-904e-992f9dcec756", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178046, "uuid": "098dba69-6f26-4867-af76-d809c0981b1c", "value": "12288:VMrdy90SS6bC3QfpxrHR9HeJJ+5WHK9zrm2FOvIeXoBonel2:My1bFHbRqWJlxroneg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178046, "uuid": "2a582368-851b-4be0-84c2-0a5e6e562999", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178046, "uuid": "821e9b9a-9597-4175-8727-77ea80f56690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178046, "uuid": "51a97e7c-d3cf-4297-9dab-b7ba799aad1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e24872-aace-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676204129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204129, "uuid": "a1e8fb6d-8704-48b5-a85d-1409ebdf07eb", "comment": "Malware payload (RedLineStealer)", "value": "07d52176e5bc7df098caf0bdd68f3d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204129, "uuid": "5748e355-3cbe-4318-92de-141d26b74a5d", "comment": "Malware payload (RedLineStealer)", "value": "49cfc720753207c902d919e16f54b52204d5afefddbd699e8a831e404d8db416", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204129, "uuid": "a05070e2-916c-47cb-9d30-1be96f8a46fe", "comment": "Malware payload (RedLineStealer)", "value": "eef33e67e81c90bceced36311faa12fe2e423dcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204129, "uuid": "6b318510-d596-4337-9bfb-902549ff2bd1", "comment": "Malware payload (RedLineStealer)", "value": "f66d33ebb90147179ebbb74fb4b77afd65f2b2ae04749fdaf84012e15be5354387543aeb48c4bef91434b906e7ffb827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204129, "uuid": "683f38a6-01fd-44cd-9886-847f4970c7a7", "value": "T1AFF4121767F99433F8B0277158F503C31A3A3D50AE34929B238F6D0A1DB15A4A6397BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204129, "uuid": "ac05995f-9e52-4dc0-8e39-638b6554de82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204129, "uuid": "4889edd7-d929-4ad1-b74e-aaeafb9d5220", "value": "12288:iMrJy90hRQYoh07IeA+DGjvHRhfotX5z3odJ4308eJJQJhfWXdcCkN11VeyBg3rg:DyQRQYoh0lA+DGjzgtX5Eb08y80N5ivu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676204129, "uuid": "a0fe6dd9-505d-4af1-a04e-cd33b18dcdd4", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676204129, "uuid": "81d134d9-f176-4201-ac91-b42925fa4489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204129, "uuid": "e827586c-2d66-4efe-9051-cd8f460213e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861dd2d3-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676244323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244323, "uuid": "153a8097-2ef4-4917-9c0e-998cbf906502", "comment": "Malware payload (DCRat)", "value": "4317474e222d93132a11de7d70b14a65", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244323, "uuid": "c5c950a2-850d-4c22-9342-0d30af118e0c", "comment": "Malware payload (DCRat)", "value": "4a09722a07ab823b7b0200f3ea8cd93a2b5d3320953596b87633e115f7dce9b4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244323, "uuid": "a5d552ce-e1c1-42da-9bca-c120a07c782e", "comment": "Malware payload (DCRat)", "value": "5bb067c80134188c9c0a0ae69654443d0f08d96c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244323, "uuid": "5d7b9252-396c-4858-95a3-cacf53f8df4a", "comment": "Malware payload (DCRat)", "value": "34227f6d63d55f5d813d61fd8784f74a0febb799f3544bbba2d5520c37baf0e83fe1d94545f995fd1ada60d4187174e0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244323, "uuid": "1180bc2f-31eb-4ff3-9f6c-eeed39775026", "value": "T1193549017E44CA12F0191233C2EF458457B4ED61AAA6E31B7EBA3B7D65123937C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244323, "uuid": "3bef3553-40e5-457a-bd3c-5e71b7328715", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244323, "uuid": "159732ae-1dc4-4ec8-bab6-b1c46996f2c6", "value": "24576:+2G/nvxW3W0FL6Dw3X8LH2dh9gsZNDtv5:+bA39Z8Cdh6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244323, "uuid": "3ee4f84b-7758-4866-a260-2d7ee3e3454a", "value": 1156163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244323, "uuid": "118ef08d-f093-4311-bc33-3fe9ac4e8372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244323, "uuid": "7694591f-99ab-42d0-8457-a5d323b9a57b", "value": "4317474e222d93132a11de7d70b14a65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0993ce-aa99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676181306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181306, "uuid": "e33c9727-9c8f-4e37-9c1c-142d58ce7df9", "comment": "Malware payload (Smoke Loader)", "value": "07b454b666680d4d202bf158ee98962f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181306, "uuid": "c5321e04-5eae-4b8c-9cf9-cc70a3e7d63f", "comment": "Malware payload (Smoke Loader)", "value": "4a7e597413e7f2136cfbb0e85d655ed014597e4de4cea37df8e255f5bf82a119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181306, "uuid": "17e0463b-5562-4fa9-8ed9-ef8693e4f640", "comment": "Malware payload (Smoke Loader)", "value": "b968dcec9ebdff4abe990e947be379f1b5cfe4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181306, "uuid": "de051f70-0086-4106-824e-ebb395e23ffc", "comment": "Malware payload (Smoke Loader)", "value": "2307fbecde624fbd85ad05dada346c9a0b1fcb9cbb40675fed1926807cc60a2b13ad80712c3c4169dc5c662642924304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181306, "uuid": "d82a1f4c-ff38-4d85-be89-a66659328295", "value": "T19A14E02139A18073D59346B34971FA50EA6FBCB1FBA2C2EB3309065D1E313D25E76396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181306, "uuid": "7ca38185-db53-4bad-a0a0-6000afc32d5a", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181306, "uuid": "6648e96e-9204-49d5-83ec-889292bdb9d1", "value": "3072:rjexQ+NpC35CKYX0An6EI7v5S5iOXMl6m2A8le5:riGi7KYEM6EI7vU5ol69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181306, "uuid": "052cbfd3-eec1-4e7b-ae66-f339fc7e460a", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181306, "uuid": "1f72e744-810b-4e7f-9a45-b0a312bd0bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181306, "uuid": "e0e151d0-8159-49e2-9f24-813264fc46e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260cd789-aa8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676174583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174583, "uuid": "7d1b8282-9f25-454f-8977-c6bd3f9168c8", "comment": "Malware payload (Smoke Loader)", "value": "f74fe8e447ac69dd6cb6a6629cef65e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174583, "uuid": "c8ca66e4-b806-45c7-86f6-c8725a648eba", "comment": "Malware payload (Smoke Loader)", "value": "4ab0807db7ea56e5bc20c7ec5c8b245c062a013f0b14b4b390ecd891561ddfe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174583, "uuid": "232963e9-01e2-464b-83e8-c5df279861f5", "comment": "Malware payload (Smoke Loader)", "value": "a60257595f0c4db929f800df64fcec0ebb00c0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174583, "uuid": "d75707dd-ab22-4067-bfc4-71f6ad4496b0", "comment": "Malware payload (Smoke Loader)", "value": "814172d56acf6ac886c231dd5f6b03a0703cf951d0f733b6c28181ba8d943a4cad7837cb0f99d8b52f9b209e1dd151e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174583, "uuid": "ed4d970d-7586-4bb0-8810-014ad69a5a3a", "value": "T11114E01076B1B0B2D593C9B15832D9513AAFB8B197A681DF3F881A5F0E303D14F76396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174583, "uuid": "98eb76c3-88cd-4e03-9381-ca9c4a70d02a", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174583, "uuid": "7fd83225-d85d-43f4-bbf1-7d5e468058a4", "value": "3072:rjqWR+0Jech5C7uQ66gKQmFmrvoqPK4pHCUy0hfmg9P/bxTxmtG:rGoRuwKrml3CU3hD9/bxTxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676174583, "uuid": "07c89a5a-91d5-49b4-9f8d-e528d06d85ca", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676174583, "uuid": "17b0e90c-fe26-435d-b370-9daa224d891a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174583, "uuid": "25f1d4ca-9e01-43b8-bc29-8141c3c156da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8420408f-aa72-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676164433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164433, "uuid": "9b2c2857-f7f4-4f1f-8b22-46ff48157818", "comment": "Malware payload (RustyStealer)", "value": "8897f5b7dd89d15c46e34d75f1f4a3a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164433, "uuid": "d4385e1b-7229-4d5a-bb4e-1aaba97ed2b1", "comment": "Malware payload (RustyStealer)", "value": "4b1debd053ea865534e1520201dc24a4a3d1a06c3ad84056b665def091c1287c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164433, "uuid": "465dd686-28ea-4456-b0dd-9d58f274ddfa", "comment": "Malware payload (RustyStealer)", "value": "d41a7787a445afc49e065c55b7788a88d22518e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164433, "uuid": "2b0ea6fd-a318-4107-b3b2-d49b63b8fffb", "comment": "Malware payload (RustyStealer)", "value": "4e0cd21638955b225f81c36782812bfe1ba5f5e981aa2c3896f74fc42e44cc717507655f876d159fcb9026f542ff0a22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164433, "uuid": "9221d2a5-e07d-4a4e-a927-54a6f46ee190", "value": "T17996334714CB91F9DBC838749627EFC27BF3477B8D258C2D7C85978AB012BA67062252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164433, "uuid": "720886e1-93a6-4ea9-a1b6-4a5cb565d4d2", "value": "881ebfb4b8b20e1f3b3657fb82622ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164433, "uuid": "a3ba7142-86ae-473d-b050-b93548c8f0ac", "value": "196608:t9kLUB56IYtNu7knTDORnqH0X3wMVTSN/DexmqYaC2XL:bon5TDORnrDMlexm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676164433, "uuid": "b8865518-e3cc-44ca-bd40-430ab55addd8", "value": 8701032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676164433, "uuid": "f40ff4b2-b7db-4153-8992-f6475c7becff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164433, "uuid": "519b98a1-11a3-4349-91fa-088ff29f3fd2", "value": "8897f5b7dd89d15c46e34d75f1f4a3a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905811a3-aade-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676210839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210839, "uuid": "7d449e18-0b9a-4d9c-9f1b-1df79a8c05bb", "comment": "Malware payload (RedLineStealer)", "value": "78dc26e2e6c01bba772ce0eb6e60bc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210839, "uuid": "69b6a2e3-a2f9-4357-802c-2127edd2c0eb", "comment": "Malware payload (RedLineStealer)", "value": "4c4c3a2105d89b04ea8e7c5a74efbd7f3e2c85efac7bf45e6d79110aac004fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210839, "uuid": "e3e5966f-3596-493a-9622-ca1f7130b526", "comment": "Malware payload (RedLineStealer)", "value": "864dc9acd74d9d7067ef4a4dc0d1e4216b8418bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210839, "uuid": "2cebf20e-dabf-4b26-9662-7d1b06db88b9", "comment": "Malware payload (RedLineStealer)", "value": "4b18a5470bbae21bed0c341936c59de1c1f2bb863111904cbf6e56c824d43450a78a9348ebad36cd8bf5ce442862bd24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210839, "uuid": "804dd2bd-4e68-41b2-b29a-e07f35597e39", "value": "T122F4121BE6E8D032E9B9A33058F702D31A367D618B34835F638B9D5D08726E17236767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210839, "uuid": "cc4eb0f8-1a48-4d49-9a5a-0263d2496d08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210839, "uuid": "7f05503f-ed51-4ad1-b1e7-ac67504381ca", "value": "12288:zMrhy904ueRkf9YSBRq/fNeEISlj40TtHLiNZhtczeJVcyFPeiY28JvWnBlOHY5g:CyNkf97UmStzI/hN6liwWnBlUY5EiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210839, "uuid": "f5e00533-734e-4a37-aaab-be1ee6be6209", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210839, "uuid": "3139974d-fc8b-4c0c-ad25-82c1115b2933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210839, "uuid": "5d7a65ca-5f42-4db9-81ba-2bff67a701f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bd2b52-aaf9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676222390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222390, "uuid": "c087a8a5-094c-414a-9464-731b87a19634", "comment": "Malware payload (RedLineStealer)", "value": "5df1d03348cf8d82eed53b0c03384e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222390, "uuid": "f1ff1ccb-6e3e-44fd-a633-744bbcb5a7bb", "comment": "Malware payload (RedLineStealer)", "value": "4ccd8d9e083be4c3340cd7fee34782b26f1497bdecad3846c2563b2f8dfcc32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222390, "uuid": "ee29e928-c501-4b68-867d-57396e6fda0a", "comment": "Malware payload (RedLineStealer)", "value": "ca784f25eb205149cb1bc057082166aa2c6ad7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222390, "uuid": "34b1a424-1dd8-4984-9f55-2f4044f0bda2", "comment": "Malware payload (RedLineStealer)", "value": "08893861b3316d65aaa6daaa2d3163347073f7a1369ff672e2333d31fe0c48be4fb7705576bd95d98f4a260b8a67a97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222390, "uuid": "8a7f1496-29a6-46cf-8292-340e2cab9069", "value": "T1BCF4120BA7E9A022E5F05BB049F603C316327CB1177493AF274F6C6A0D766A0B1757A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222390, "uuid": "1ff01c27-eacd-43f6-8fe7-f69556392c52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222390, "uuid": "0362a807-6926-417c-90d5-514d3af84683", "value": "12288:cMray90GQBKx5XFud959ajseJ610Sa68KvWO/TS1u5H:eypQQx5X0TqEV8KuO7LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676222390, "uuid": "b93584e5-b3a8-4e96-96f7-272bccca5dcd", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676222390, "uuid": "4ba8c122-e73f-4bbe-a7aa-fb3fee5e53df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222390, "uuid": "fd4d6540-2a4e-422f-b5db-2ce6214f4e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351cd72b-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676211975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211975, "uuid": "e1a5df3b-9289-462f-852c-7080f2391578", "comment": "Malware payload (AsyncRAT)", "value": "da931a33c6dd88f17bd73fad95cc726a", "object_relation": "md5", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211975, "uuid": "8561c57c-6f97-4aab-82d4-a68c1e2d782e", "comment": "Malware payload (AsyncRAT)", "value": "4d3992da2f6fc16a3a19acbf990696f61309078a4255b1f7f86a87c8d02d8f14", "object_relation": "sha256", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211975, "uuid": "3d65639d-3db9-43ce-b4f6-f35b9cbce84f", "comment": "Malware payload (AsyncRAT)", "value": "475ebaa95e75c75f3129b536b9e5725af84e9766", "object_relation": "sha1", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211975, "uuid": "91ff1ecd-88be-4c86-af80-17b14f943de6", "comment": "Malware payload (AsyncRAT)", "value": "0b0112a85d9e7db1458c2e8a2db7402b9c30c1ebff5caa8b1432d7d533d358e45c5727fb4ccb717bae705bb775334637", "object_relation": "sha3-384", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211975, "uuid": "e43d2ed3-0bf1-45b8-a464-d4319fa472f7", "value": "T1825502F022A49BC7C2B967750770982059EC3D6429F5E95F3EE0729F23F5F820B94269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211975, "uuid": "12990a8b-780b-473f-bbad-602392661527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211975, "uuid": "c89f44a0-b99c-4f0f-9272-144a9cfe98ca", "value": "24576:yJe3Dhbuj4kHigeS/RXIa+AAGigeecpVr64FD/yWXNiepHM1lngU:53DhM5X6AAVVLDh7Mzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211975, "uuid": "9f71f888-3043-4dbf-9119-e0eba3a0e15a", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211975, "uuid": "e97673d0-a684-404f-be0e-57c679519646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211975, "uuid": "68037b4c-93ca-476d-9280-da38b9c00861", "value": "U767J7I7IMII7I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27175462-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676229561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229561, "uuid": "d1e586dd-e417-4c8e-a5bd-82efa682ccbe", "comment": "Malware payload (CryptOne)", "value": "1f6273d93d693846d5f72698088e7fe6", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229561, "uuid": "83258867-f6fb-41db-bedb-09a37411c327", "comment": "Malware payload (CryptOne)", "value": "4e3f6b70dc8e75203afcc4a9a6171ed55f00ee492fa564cf2ccd3a0a4c7259eb", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229561, "uuid": "a6ccde79-6b7b-4f19-935a-7f31e6e9194f", "comment": "Malware payload (CryptOne)", "value": "510aa7649e63fb26f32022c6f7a6884b942e951e", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229561, "uuid": "a7bbd0bc-0ebc-4151-8b38-52d166a8beea", "comment": "Malware payload (CryptOne)", "value": "a713d93ccded85b66d401b5fbfb566e6eeac52fd53b93f11ebeadde888fa6c8a99f9f39c97229efa9dea2b11c93000f2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229561, "uuid": "3d977b10-626e-4db5-bd5f-fd4fd6faf020", "value": "T1E3752221BBC1C872D9B618350AA5A7217B383D305B798FDB57885B1E9B311C0AE34B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229561, "uuid": "2aad005c-2a13-4ab3-9d3f-b8dd7d729cb8", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229561, "uuid": "9b11d229-aff2-4626-9eb1-84086988cb1b", "value": "24576:JLllLl7tEtJbM1P2G8PMo5i1fI2t1CkYV7RpkQdC2R9RJtqRhWFwbUgFgVuZ8:hllL8Jb/Goh4BPtKdw2R9sRhWFM/FO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229561, "uuid": "9c353903-61ac-4a40-be77-dfe5830a4125", "value": 1612073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229561, "uuid": "eda8a427-7e28-4d87-a0f6-1e5ac5a1242b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229561, "uuid": "01729055-2505-4e3a-91b4-5ca264caa168", "value": "1f6273d93d693846d5f72698088e7fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451f6dc3-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "c0b54b69-b1f8-4aeb-8659-bee6557e62df", "comment": "Malware payload", "value": "13046d4905496c4e4105bd5b89d1b2ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "f3be75d6-59f2-4a51-92e2-51f4b4419b62", "comment": "Malware payload", "value": "4e63448a4843f6f486481e2d0c9b42a66c3c596d9ba6076a9a5c88ba58cb0b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "13ca4031-fe0f-43f6-9d9a-ac5fd886177f", "comment": "Malware payload", "value": "f244399d78ab45c72758cff635cbf48495de8b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229182, "uuid": "e381e773-858a-4b5f-9288-537154e3847f", "comment": "Malware payload", "value": "cc031539d4e765a54475c28cca6193a72668ae9809c5176411997bf5a97cc28d18f9dd6354a6a8062ebbb4b21e22598e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "e6a4f8c2-06a7-4891-b67e-582e74312130", "value": "T1E8F4120BBBEA9032E8B447F00CFB47D31A35BE616634535F538E2D5818725A0B63976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "33a49c9a-53cc-477e-aa6c-6e5acd7d49e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "d7004f53-4f38-487a-ae41-f2247515ca40", "value": "12288:hMrky90xs9yVsOLQtX91yHr2SFgMxByu8eJP2O4EeVT5qdjfVq7X4g:NySZVXs9erdgMxBVcVqdRqL4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229182, "uuid": "7b8ae154-4759-4673-ac29-8c678615cd56", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229182, "uuid": "d8e39990-253d-4c2c-b33b-ed54d507c4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229182, "uuid": "820e021f-e196-4ee5-9444-7ec9a7cbf363", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feeb310-aace-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676203913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203913, "uuid": "c00c65af-d5c2-4e00-afb1-3308b15fe683", "comment": "Malware payload (RedLineStealer)", "value": "b66c88f1d9910e26a5da257d28a7bd4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203913, "uuid": "8474253f-f69d-4633-8d05-8673f2a39feb", "comment": "Malware payload (RedLineStealer)", "value": "4ea6d4c6f0347df77aac4a572b93e6f710dda9908f1ddb3004c3c9feb2e58dee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203913, "uuid": "c8b703cf-b45b-491a-b92f-453e465d269b", "comment": "Malware payload (RedLineStealer)", "value": "4a070e5f5bd4dc3da93ee657550a349abe0ca3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203913, "uuid": "e63f54d2-39d8-4fc1-8416-5e66bcb3dcf5", "comment": "Malware payload (RedLineStealer)", "value": "04a8aa5bc4489b17cea91724612a8385d73f77cecca3200582a1310197656c9ae7781f32f85ea6e0f8db2cc90b8f873b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203913, "uuid": "a929425f-8968-406b-8fb8-89aa9bc8ddb4", "value": "T161F41207A6E9D421D9F91B3018F913D716367E202F34C39B278E7D591C726B4AA3932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203913, "uuid": "189e50f9-b0e9-437a-8339-d9670e96cb3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203913, "uuid": "4406ca87-abab-4ff6-95fc-0482d6f3debb", "value": "12288:qMr7y90LRf+7EGoaTaYkiAJdlWxFaJCtHNleJoNoRudYq7ZeDMB2+TiG97C+xag:py4RfjGfaYk/joLXtHEoNoRIUML92Yag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676203913, "uuid": "28c579e7-c724-440b-8912-16ea9c9b6658", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676203913, "uuid": "030ab7de-0659-43d3-869b-e04a53c8e05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203913, "uuid": "40e6a435-8fcc-4f84-9384-57fe272c3f2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2d4a08-aaab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676188906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188906, "uuid": "cca159e1-3ca6-4aae-a737-e11e169b2edc", "comment": "Malware payload (GCleaner)", "value": "d05821a95cbfc9ce60b275521d2600eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188906, "uuid": "ce735b29-a454-4d41-90a0-e71197415982", "comment": "Malware payload (GCleaner)", "value": "4ec9c8b756173fbcb94187d12fe43d13650eabadd35d5e3e382c511664f81915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188906, "uuid": "6c9eb50f-ba19-4e7c-b88c-c376a84fe50f", "comment": "Malware payload (GCleaner)", "value": "15ea2f461a3c5c7b9e2c0d7ff94b2a229c3c24ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188906, "uuid": "d2d2cbc8-ab14-4779-8ca8-fa9a18c5082d", "comment": "Malware payload (GCleaner)", "value": "18875a0a55b3b9f4f4db3b8444da4e0b71835f3602d6eaa1e37c198145ee19ed508663866f004e2e6877ae874c05594f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188906, "uuid": "c5559015-3111-4c7c-9611-4cc75a79497f", "value": "T15CF5127C3545C46DD180BEB48C3AE4E75CE66DE3E9E4A12230DDBF3F917A2889A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188906, "uuid": "64b6a873-1c7f-43d8-bc75-c180dd3f0831", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188906, "uuid": "37d1dd3f-7b3c-4df0-827e-618fe714751d", "value": "49152:rdHOZ0mJpRTzluFzaMhTGmFe9kI8ofpLOlTQKgfUqth292zEQ/2WTKnLCgv2MR:JHDuIF2UTGmFdzcOlefUqtzEQ/qv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188906, "uuid": "b48bbf36-b110-4687-ab80-367be3f98439", "value": 3585761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188906, "uuid": "1cbbc139-c1e2-448c-9389-8c64248e2cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188906, "uuid": "31cab6a9-61a5-417a-b6df-f0d2a4376a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2289fc0c-ab29-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676242867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242867, "uuid": "c44d0c39-c1a3-4e05-85cd-587a52b1d3f8", "comment": "Malware payload (GCleaner)", "value": "118071bd80465e63f67ef706fe232eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242867, "uuid": "5a2dcac9-7f19-467b-b89a-0d1325ff75b9", "comment": "Malware payload (GCleaner)", "value": "4fa2e40e4f3d1979769b39b358e234db112ba64fa2296234d016052ce59fc225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242867, "uuid": "11349300-0fc9-4395-8e6d-328b1b7ce2a9", "comment": "Malware payload (GCleaner)", "value": "7e7b5a884d9f67b60c9337fffa9d798182ae5352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242867, "uuid": "62af7df1-228c-4ee0-a23e-dfe152a1fd59", "comment": "Malware payload (GCleaner)", "value": "f8f118bb43bda7b72018dee466c2cb90ab18c2957bae3457338a5915f6d827e8cb4a379db0bb650db62e3c6221fde135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242867, "uuid": "90d29380-ff24-412e-8371-54e999bf5624", "value": "T106F5223C7585C86DC280BEB4CC3AD8E35CE76EE3E994A11270DA7F3F41B9289560A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242867, "uuid": "50153af3-5fbf-4d4f-8152-37751bc468be", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242867, "uuid": "afe138c7-e8c1-4779-b6a4-28f9edf23501", "value": "98304:JHsel+0yPv4aPW5UoKC3JUulAYElT3c5Tev2MR:dNl+0I/IKVlYElTlvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242867, "uuid": "bce53288-518f-4ea7-9d55-9aab60fd609c", "value": 3629985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242867, "uuid": "b86d7220-6fc8-422e-bae7-dc2816f4a6b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242867, "uuid": "c61c6c0a-2bd4-4c08-bb4c-2dee845b8bf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb98b7cb-aad7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676207906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207906, "uuid": "5bfa21cc-51b5-4f06-8ec0-d6d7ebd769a2", "comment": "Malware payload (GCleaner)", "value": "83bf970192b8ea92a6314f0580b48036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207906, "uuid": "3bdc9985-1372-4657-a60f-3776f9e33d09", "comment": "Malware payload (GCleaner)", "value": "502a8d0b4b002079bc5ab1c98f288af25b6b081b80c66d159ecad8e05e5c4da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207906, "uuid": "65f6117a-e930-4c1c-ac29-b03fa78cfeb2", "comment": "Malware payload (GCleaner)", "value": "b9e92a17b788860a07d4c959b6d09a8269ba2b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207906, "uuid": "3c708f48-4988-4788-9aab-6392d28dd139", "comment": "Malware payload (GCleaner)", "value": "7a2f95b794ea6d877e131aa72ac8475229aa1d0db8fc807997489f782d3a4f22c66a492e49633031f2a30396fda90a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207906, "uuid": "356522aa-d37e-420b-90f6-18cf8c799621", "value": "T189F5127C7109C5ADC280FE788C3B95E76CD62DE3D9A4A42271DEBF3F5179288960A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207906, "uuid": "c318504d-abfe-44ad-bfe3-fb3bafc8e8da", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207906, "uuid": "4478be54-23da-417e-8582-d8ae4959188b", "value": "98304:JHWVdURclr5v9yd+bs4b32SsG2s9Vv2MR:dW0clB9zI4b310evjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207906, "uuid": "688eaadd-55cc-4071-8e07-82e5f1c0012e", "value": 3455032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207906, "uuid": "a8a478e4-05ca-4da8-aa1b-c4da076012dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207906, "uuid": "ea250540-686a-4f5d-b7f3-4f4605eb8224", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db54c65-aafe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676224552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224552, "uuid": "ce4a9f1f-18ad-4945-b924-863f96665d0d", "comment": "Malware payload", "value": "85e6d8401545205c10a03b442208fbe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224552, "uuid": "a416b8e3-f381-4333-be84-e3ad312eb075", "comment": "Malware payload", "value": "5138f840239c60b82a256166a2b861e9ec3b6961a5a1d707bff809259211a67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224552, "uuid": "f377c500-4ec5-4dbf-8b2b-adabb02a576e", "comment": "Malware payload", "value": "483ef8cfa4ee6b712ed6867b26f5e143b6c35ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224552, "uuid": "80f54022-2d57-46c3-abe2-86bd61cb1034", "comment": "Malware payload", "value": "0d27df4346d7a371810bbcb4c29e9a599c4ef40fbfec9fe929675fc2ab5fe5b5069a35b9ec829d586ead6ae570d1fee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224552, "uuid": "122167cc-84d8-4eb2-a8a4-00e2ce46cc49", "value": "T10314DF1176E2C073D85789755831EAB02A6FF9B267B284CB3344D76F1D317E18A79382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224552, "uuid": "c8ce8aef-da2c-4aec-8824-367b5b7e2347", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224552, "uuid": "3158263d-a291-4601-bed3-09f0299fa9fb", "value": "3072:T7+PA+H4K56Exozm6FZCgBuKVsCBxeBlNZ6U/pdPLc:vbC0ExK/CT5BlNZr/zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224552, "uuid": "2fc74fef-ffb6-4888-80a0-9e228bcb445b", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224552, "uuid": "b384b8a8-5df5-4c23-a21d-58f554c765f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224552, "uuid": "73886f51-d2bd-45d3-b904-8cffa0fc8eaa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a054f1-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244237, "uuid": "10143212-a169-448c-b9d4-50221139e70e", "comment": "Malware payload (Mirai)", "value": "20e81378bd2b5e1ac09b70517e8f170b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244237, "uuid": "623d30c0-acff-47d5-b76e-cbd75c842653", "comment": "Malware payload (Mirai)", "value": "51435acd18ba90bad61d9cf1b604cd8cfb0262bd53705d15d9d49a16826e68c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244237, "uuid": "153cc2fa-a373-4cd6-9770-3ae6d623ce75", "comment": "Malware payload (Mirai)", "value": "63472fcad44492c1448f6e7d129766f695e15b67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244237, "uuid": "88486a8d-4ae3-4f3b-b975-468112979e28", "comment": "Malware payload (Mirai)", "value": "d725b080946e093154e4b2fd7db4ca76bbfe9cca6b4048d88812d7a5cfba8afb66a5a221c6b90192cb2ecef0a02796e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244237, "uuid": "dcc0e036-b8e2-4fcf-9ea9-cbfcb55307ef", "value": "T10CF2D031825AC2E2D61B973DBC89BC4D19507218C684963365CD31FB2A76F18AF56B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244237, "uuid": "7a30bb7f-3b77-41d8-8b67-7a2c8fa9f7b6", "value": "768:m+tSvSk3W5pcuAVJuiomRmpZIZBtdpEkLwwnbcuyD7Ufyq5:m+tSj3W52dIL2BtdppLznouy8qq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244237, "uuid": "43552228-d79f-430f-9c4d-8416156437c7", "value": 34840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244237, "uuid": "44cc33c9-7a7e-4e30-89a0-272bce787e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244237, "uuid": "d0105dac-9821-414f-805b-68141b859f6c", "value": "20e81378bd2b5e1ac09b70517e8f170b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b831ba3-aaca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676202054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202054, "uuid": "7b5e4cdc-f200-482a-872c-06e20869af58", "comment": "Malware payload (AgentTesla)", "value": "6e4ccd2d398262af6ed23768838ced20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202054, "uuid": "4f8dfd60-cf6c-4e87-9a2b-d64f5f88a172", "comment": "Malware payload (AgentTesla)", "value": "518c087ade25bb946d8078fa02548b0b3854c0c4fd3352779d5b9383e44c02be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202054, "uuid": "6d5bc916-33e7-405c-bea3-6a26378a6bfd", "comment": "Malware payload (AgentTesla)", "value": "daaf4bb24a10de68cc5a161a5aa405c603a0066d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202054, "uuid": "63685be3-3581-47e5-93d5-28bd5dcf70ad", "comment": "Malware payload (AgentTesla)", "value": "cbf79d8ea1dcad60c1e95ed44e241f76c5a1c59ed94370dab243d0da7cff6cedad15954ecc5a7562108c98302e148230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202054, "uuid": "cb6498ea-bdc9-426a-96b0-171516c1fa57", "value": "T1E8052A3C1D7693F2E474F9755394A0B0BB9F489273A7C8A8DDD62AC05F222426DCE12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202054, "uuid": "8691aa26-27b5-4cbb-86df-9aebd8b0b4e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202054, "uuid": "ed928d96-d15d-4c66-a3db-614e53203d3c", "value": "24576:CT8irmdjXHNOrAe/IupojwrqhTPVcJmBDCp/ysebZdWzqhrlG8DEo8PO:PjwrCPVcJODmysebZ0zwxdYPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676202054, "uuid": "f87721ce-b628-4717-80d9-50e8d06f7755", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676202054, "uuid": "a939a7cf-b29b-45db-864c-8e85dfd4e624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202054, "uuid": "793ab08f-57d1-4dc4-92e3-222bed85898d", "value": "NEW INVOICE FOR OUR BULK ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a8d620-ab28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676242529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242529, "uuid": "b8b13f12-da41-452e-bfdb-1ee8b7f98ee9", "comment": "Malware payload", "value": "ee43ae66c0666b5f7e0862236df32dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242529, "uuid": "c4652ef6-48c1-4414-ae25-0a08fa2984ee", "comment": "Malware payload", "value": "51a393228bbbdf7bf30e6621c4480718d516216ec9c0e15c302c11073c0d3d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242529, "uuid": "ddfa04b7-5e4e-4b43-a110-29a7c1756c19", "comment": "Malware payload", "value": "0da18a6f099a9469f785a55732a7070ddb4b27a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242529, "uuid": "2571b5ff-0bc1-4203-82a5-4b73457677ca", "comment": "Malware payload", "value": "e6c03665703184bdbbf8750b7ebe1885ce9e2adb7c7aa3842007a10c3a0236c1fc93c1e09ddba55794ff3923d9381f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242529, "uuid": "2d63461c-c4cc-400f-9365-f2bbd0e7cbd2", "value": "T19204BE10FAA19072F1AFC17C5530DAA2A97AFC7157A5C0FB2344066F9D302D29E7936E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242529, "uuid": "e0ad68c7-9577-47c9-812b-017f0944e7c8", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242529, "uuid": "948a8d3f-626c-43b0-9b90-0e7954e712bf", "value": "3072:baEZBTz5HZd2DwxrX7DJMnFJ65DfGNlcxCzW3gSE:vXNgwRZMnFJMDfGNlcxk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242529, "uuid": "d243d741-7a06-4e02-8138-7916ecb8fc0e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242529, "uuid": "2a3de65c-ca49-43af-8283-41ebe2aeb971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242529, "uuid": "6e3d9d60-0fa0-4b34-89f7-df36c6314ac3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddedd0eb-aad3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676206245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206245, "uuid": "947d88d1-ee9e-4cca-8861-117da71fcccc", "comment": "Malware payload (Amadey)", "value": "bb9c3ab84b4d510816682a0c6b581149", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206245, "uuid": "a113d51a-12c8-40d8-b9a0-ca6266646d54", "comment": "Malware payload (Amadey)", "value": "51fc4d4ec1401bfa9333f6ed7416301f773b2f45dbe497d5ffc665f7b4896538", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206245, "uuid": "bbc46570-cdbf-40d4-92fb-d7ee4cc71631", "comment": "Malware payload (Amadey)", "value": "90d284986c2b6a72da9a98f2e4861152f357da96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206245, "uuid": "3dc418d5-2d15-438e-b4ce-57e639d5b8c7", "comment": "Malware payload (Amadey)", "value": "257b4fcc718d0b3b003b2060a564e24911c0c6a941371462e8acfb8752d2b856f015582d214b097199bba3d1f4ffc103", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206245, "uuid": "de6042a8-3a0f-43c6-8300-ac039a1f0094", "value": "T122F4121FA6F94232E8B4A7701EFB03D31636BEA11A348647274F6D1E58726B07935363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206245, "uuid": "f9dc9e1a-d8e6-4c38-8bc0-e02ff61cd154", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206245, "uuid": "8bc72a6c-a3d7-4a8e-92fe-bd242a63005e", "value": "12288:WMrTy90i0xHFH+royyyup/A59mXDgneJaXjlaYx/oNRag/PtMEgZlX:VyBolufup/A5MHa//kRt/PCRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676206245, "uuid": "1f7f3f02-c69f-4d7e-a02f-a0583a4c3d5e", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676206245, "uuid": "e9aa4b7d-4b99-45e5-8c16-f569d875a8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206245, "uuid": "0136162e-b9c3-4ee9-a8cf-ed5e649baca4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447513d1-aae5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676213719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213719, "uuid": "792810bc-77b3-4a24-b8e5-e0b012368dc5", "comment": "Malware payload", "value": "0ee4bcd478e8ae27e36e63c500cc3ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213719, "uuid": "9fe365a1-cac0-4bde-a401-ad4942e8e19b", "comment": "Malware payload", "value": "526c981f4e061a5053f223166f3a26109a70e5a74abc3954f5ca352a98584d6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213719, "uuid": "79acb2c4-fd8f-47c6-adcd-5535ab8452f7", "comment": "Malware payload", "value": "28d2cd3a77e7a46d2d2e5d3bbb6a148ee9bada2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213719, "uuid": "1088b73d-7afa-46eb-93a8-7af1f796577b", "comment": "Malware payload", "value": "580a986dc51a9dbbda2a032333666025df1e0ce40ed917dc8ef5aca82500a55e0c642b5101110bc190317252bf119be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213719, "uuid": "5ff8c036-730d-4031-a892-dbdd3b3e4b8d", "value": "T1FB14DF223963C036D15785B05831EAA46A7BF8B157A1C1C733481ABF6E307D58E7F39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213719, "uuid": "a2439f75-ed45-4000-a96d-154c69b312b8", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213719, "uuid": "c454d052-c05e-4dc6-ab05-0d955c525a02", "value": "3072:u7OY+rGh56KBDrCv9pHH8330wl4mQ1iVxBqWTq:wPL2wHG9xH833l4vsaWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213719, "uuid": "f246a603-a4e4-4fc0-a0d7-485062558604", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213719, "uuid": "1444ea3f-0bc6-444d-88d3-7fcfc0f9e666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213719, "uuid": "35c18948-7de7-425c-a67e-0e8c9ccefc2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964faa24-aaec-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676216862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216862, "uuid": "8c5ecdce-1004-4e24-adb0-a0f02eac80e8", "comment": "Malware payload (GCleaner)", "value": "9a220e573dbbe5ffd2c82571a7289995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216862, "uuid": "6cdaac7b-a4f6-4a29-9413-34bf393ac486", "comment": "Malware payload (GCleaner)", "value": "5291492898002226968a1ebdea6b140a6e1ed20bfc30ae42b8139e748ce09ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216862, "uuid": "0e3158e9-3111-4d9c-87d1-560da1e7dfb9", "comment": "Malware payload (GCleaner)", "value": "1d118c6994de8a46cfcb1e4ef79f0f406b57aeb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216862, "uuid": "b9b9ee2e-9c30-405d-854d-76af83c028cc", "comment": "Malware payload (GCleaner)", "value": "840332765e578567bb991eaa463f0b7ecfedfd60c3253e2899c704ea08fb0102ff875068b8a2ef79383411f4719f9704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216862, "uuid": "9b0f9e7f-bc87-4268-8fe3-f2c4128a060d", "value": "T1AAF5227D7004C56CC2D0BEB49C3AA4E72CD66DE7E8E4E022B4E97F3E51791885B1A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216862, "uuid": "e0b8d981-275d-4aba-8031-51968b42ee79", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216862, "uuid": "d258846b-fc99-4290-97e4-674933f771f5", "value": "98304:JHjVqQxzAe8TbmuIoxjhJuh0LSiRgNL2PLiRv2MR:dBZaC/UfuhcRIBRvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216862, "uuid": "e71140cb-2163-4005-b9db-95eb6d1aa12d", "value": 3615381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216862, "uuid": "c51cd248-d27f-4daf-a22e-6655b1429364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216862, "uuid": "1655dc98-ea50-4c92-b26c-df387c5b8c3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75db17f9-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1676212084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212084, "uuid": "c9f6d400-e333-422d-b5a9-6f091e702061", "comment": "Malware payload (SystemBC)", "value": "ca810ef2745de0c5636e539a80fc3467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212084, "uuid": "d1178ee0-3719-4d05-aa4f-df8bd5bb5014", "comment": "Malware payload (SystemBC)", "value": "52d1b27dddcf8fc24ea4258f108fc186feeaa95d9b882341c7a49a5d8b819436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212084, "uuid": "6e27eab3-cc80-45ba-9f46-7c0eb2154db5", "comment": "Malware payload (SystemBC)", "value": "28d303ec336b54aa0ed4796e93481f788428f4b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212084, "uuid": "7876a1b2-fcb2-4613-b91e-485de476b1a4", "comment": "Malware payload (SystemBC)", "value": "adccffab88e6df0d67dfc970cf03d1e2f5111630f46aaddbefb2f08e5f7d3fd83822ae6dc493269b5feadd0c461d33d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212084, "uuid": "3a349d2d-e8fb-4154-afa6-1295756f31dc", "value": "T10A34C0213E90D467D2929530A824CAF1FA7EBCE15B60568737543FFFEE312515B2A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212084, "uuid": "3aaea99a-aecb-4a81-ac70-47aa16b38681", "value": "7ec7f49ed6c361cf3d1f933afdd59bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212084, "uuid": "61f721b4-22f7-436f-921d-02bcbcfa29b0", "value": "3072:cVvnL5hvxGKtzu5vP5XNfO3uvIjpgxGvQjohdBcf0EmoZgRbR8pgX:aLNGKtUdG3uv8pgxmQjoyftccpgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212084, "uuid": "1984eeb2-3170-43d9-b454-b6cb9ccf5409", "value": 246272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212084, "uuid": "c497e9ff-7040-4af3-a5f9-e7af3c5dc2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212084, "uuid": "bc4a6ddf-302b-4c5a-ab23-8ea6afa9e850", "value": "ca810ef2745de0c5636e539a80fc3467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2cf942-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676235721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235721, "uuid": "7186b35f-7104-4055-9ee6-839dde12e8a8", "comment": "Malware payload", "value": "d95747b5423c890766aaefb016d2fd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235721, "uuid": "31418f1b-b5e1-4ff8-b13d-904916439c8a", "comment": "Malware payload", "value": "52f2c0c69352f4fd0c4f4f62ef011c0cafd338bbbc15deb9a4df2d07e0afdbd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235721, "uuid": "ce3d568b-5380-48c5-bc8a-48e3181213cc", "comment": "Malware payload", "value": "407e483d4599dd89e0d8809d6f229d42a78ed138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235721, "uuid": "cc6ca8df-d4a3-4480-b16f-09a7e1d18b04", "comment": "Malware payload", "value": "ce168d4829d20482913789bfd8db6c810430d00bbade8454ef42452645b213c0b6b9c8094927d7391c85312243858b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235721, "uuid": "4f4ecf93-425a-46ca-884a-3da2dc5c3e50", "value": "T16CF5123C7205C46CD290BEB48D3A94E71CDA6EE3E8A4A06370D97F3F817D285961E217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235721, "uuid": "6c8e2888-9691-4cad-ab14-79754065a252", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235721, "uuid": "5154eac2-9c9a-4ea3-8485-566b147e246f", "value": "49152:rdHlL4NYn4L3KIPIqTl+InK/USWz71zBaQrB0UqCumfycU9Ftdg3j2PLCgv2MR:JHlmYITlc/USsZzj0rhcU9va3jMv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235721, "uuid": "66ebfd19-d68d-4688-8425-1722433d2cc2", "value": 3432551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235721, "uuid": "1ffae54b-dec3-4d79-ac56-39cb905fa327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235721, "uuid": "c526c843-9855-4701-ad2a-954167e1ef5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7648af25-aa86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676173000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173000, "uuid": "2ee708c4-8082-4df0-96c0-05311ac8c000", "comment": "Malware payload (RedLineStealer)", "value": "4999ee382018b53900e395c6865eedd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173000, "uuid": "78a60fe0-bfbc-437d-976a-545b3c700785", "comment": "Malware payload (RedLineStealer)", "value": "52f6b35b07a96e0f3a6cfd8e27b8b667ea77152b4d5073ca1ef736c927137371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173000, "uuid": "5813798e-6067-499b-88f9-870619865402", "comment": "Malware payload (RedLineStealer)", "value": "f6b01ed033110e6e78f1113ecf26a55feeccd123", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173000, "uuid": "b3b6c784-e208-43b2-9d14-51df505377c3", "comment": "Malware payload (RedLineStealer)", "value": "b68a7ed67018f11b6b563df520cdfd57c1e175c9cedc0835219bd5d6a909bfa9fe3b6f10e76561bf107fbacbb08f5748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173000, "uuid": "1d3fc1a4-3a2a-4e51-8dff-ce79a000144f", "value": "T117F41347A9E85032E9795BB09DF217C31A367D614B34825B3B9E2C8E0D311E8F5307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173000, "uuid": "841e3cda-6822-4557-aeef-47b946718f22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173000, "uuid": "76a76f0c-b4e0-4d28-a1ba-84080e8f29d1", "value": "12288:9Mr5y903QlK4gDmUMdmPBCk2hsqX/eZ22YUeJ/F0eG8dZopSYVtqB0:syyAFg6JXbX/eo2mtHTocvB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676173000, "uuid": "4ec963f7-1827-4470-86f0-81f7e318d105", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676173000, "uuid": "420638b0-c46e-4642-85ee-bd9a6ec06d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173000, "uuid": "472e03b4-8585-4d28-864e-c689b377bf59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb74941-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212122, "uuid": "4e92c4df-24d9-4085-9f59-cba7a459a4b1", "comment": "Malware payload (SnakeKeylogger)", "value": "7d71c1b01d1e3b77d70b5d3eac38a276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212122, "uuid": "0ee06620-5b2d-4450-925f-de05ffcfa961", "comment": "Malware payload (SnakeKeylogger)", "value": "53446fbc7507ef854a675f1d03f41d10dac1ea39c3edd6640e049b02680b40b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212122, "uuid": "64e01942-0fa7-4c15-872c-fb731dbd1903", "comment": "Malware payload (SnakeKeylogger)", "value": "e23bc761dd0da58b6332a2c7400e53ab41bb1785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212122, "uuid": "841eb0e8-3720-4739-8b9f-e019600ad2fe", "comment": "Malware payload (SnakeKeylogger)", "value": "a75f37a8120c680142c26fc030ff75744a78a0115f0c065a62fcf210b4f6f1e005685d7dece3d04db0633ef38de70ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212122, "uuid": "252b374c-2f4d-417e-aac5-9bf40181e2e1", "value": "T1D8F4EF4EE44680F9E6BB57F21A354A48CE255E943C70D4EE1BAE3EA8D7347E3840E543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212122, "uuid": "4172f1fe-4f55-4524-b722-37ef7eb8f2f6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212122, "uuid": "2646f63b-d5c5-4a18-8387-2045dccf4b27", "value": "12288:GkRoHNDKd9xFfp8SaAm7GVDISHLHkwq3oUeVhgpsy6:GwotDKvxFJax0b4wvxVhbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212122, "uuid": "7e665f8c-e016-4e98-9250-857e5bc7a012", "value": 726041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212122, "uuid": "bcc4f8f3-8a03-4ec3-a13d-5560c0a5eda7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212122, "uuid": "625a0af1-bcdb-4bcf-b829-43cb385cdb0b", "value": "7d71c1b01d1e3b77d70b5d3eac38a276.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ece0764-aac2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676198650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198650, "uuid": "d1af6b47-b7ab-4a78-92b3-52abefe4badd", "comment": "Malware payload (Amadey)", "value": "5db8d0c5594399e51df92cb5e3c7a3b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198650, "uuid": "5157a6b3-2b11-4882-baca-79e1a0856656", "comment": "Malware payload (Amadey)", "value": "53a0905d3ce6d93fe50b6a8b5fd41d81087e27d6e03bd1fbe9d9dec6c00b3f64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198650, "uuid": "63768612-0a49-47c3-bbad-6ff3c5f2b3c7", "comment": "Malware payload (Amadey)", "value": "524d7a84ff46bb05b82214c313680bba0b77432d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198650, "uuid": "8937414d-6429-4b75-80e8-ddf73ecae3b5", "comment": "Malware payload (Amadey)", "value": "2406b4de2c85f573e975d00d4389076b244a972a28338182fd9dc7b53b991c6dd98a1b685dcb1e356d95e872b21ae82a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198650, "uuid": "e0fb5328-3938-4dc0-992b-f0d67c842874", "value": "T1C7F4124BA6EC9221E8F867701DF703C316367DA08B38C25B774A5C5E1D326A0A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198650, "uuid": "d83ece58-2521-48c1-8326-b7af4aad75a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198650, "uuid": "45d4c8ab-1514-48fc-b7fb-1b386bcc4165", "value": "12288:bMrsy90A0c73jdbBj7wnGF23gBNxeTeJCFmLsP4pidFfpcG7OImzhejl8dVG4v:nyP0cTjxJwGF2QBNx1vkdxpcGCPcJp4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676198650, "uuid": "bb8fde4a-03a7-4f02-8829-c7e935edb436", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676198650, "uuid": "952c77e8-e8b8-4902-8da1-74d25c168d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198650, "uuid": "92afdc29-d57a-4c78-8d02-a76d45b71078", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30a1752-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676232024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232024, "uuid": "84cdc107-6cd1-467a-a0a7-85baa3164322", "comment": "Malware payload (QuasarRAT)", "value": "1e44cb58c487dbdecdeb626d40d52706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232024, "uuid": "e9bd91e1-4025-4b45-acf2-93eca7114698", "comment": "Malware payload (QuasarRAT)", "value": "54250aeb90c867a9e4ed7dae2b26ecf2bd90e83172bdf4f722b99cd7f19b37f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232024, "uuid": "f246e9d4-7bed-4c21-8637-13e942041e54", "comment": "Malware payload (QuasarRAT)", "value": "4d614ebe84dfe5a5d7a576a2d9108dd18791416f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232024, "uuid": "fcd3a95a-8395-467d-b9c8-2df43a18a45f", "comment": "Malware payload (QuasarRAT)", "value": "2ce05e0bf83fabfdf37d8722905a4c460db5eab27e1a168b297bbf5054da146bc8b3382bcda10e9ebd2c2db6b22ef79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232024, "uuid": "d1a1d318-2202-436b-904b-6faad09b1049", "value": "T168B46C4063F8862BE1AF577AE871042597F4F407B2ABEF4F4A40A1F92D667069D80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232024, "uuid": "4d62193c-2533-400e-a3eb-8f7ff20e9b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232024, "uuid": "cb10e24f-56bf-4bb1-8d49-e34a00f7f522", "value": "6144:tTEgdc0YoX7IxUpGREWeg8ydTED5KhDkQfocExOb8F9EA1TPQGv/cTR3O:tTEgdfYtxUQSwDkBpL5/cdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232024, "uuid": "3805587e-47cd-4d8d-89fc-fffeecafd56b", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232024, "uuid": "661accd8-119a-41c4-bbb1-4f8d0f09649f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232024, "uuid": "40464022-8ae2-4682-a155-2741299a37c6", "value": "1e44cb58c487dbdecdeb626d40d52706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6e5838-aaac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676189385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189385, "uuid": "ab053680-6c4a-46dc-bef2-8878f94948ba", "comment": "Malware payload (RedLineStealer)", "value": "e13761cdc763e268f1e812eea5fe3d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189385, "uuid": "2f7539b2-3345-486d-8309-d1a2c9b69e8a", "comment": "Malware payload (RedLineStealer)", "value": "5580da6f01212a7670ca379c0c29292d1de7c342d5e9190d26bac1d18640d483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189385, "uuid": "b1753e5d-cd39-4b86-875d-b8d92aa88698", "comment": "Malware payload (RedLineStealer)", "value": "82951b651ac4255c9ccc8b760fdc89ecc35d1f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189385, "uuid": "e933f571-da65-4596-bbd3-ff9ce42cf202", "comment": "Malware payload (RedLineStealer)", "value": "0d29d4ba69b97145d11469d071233f347ad23c07da179b6fe5b8e828aeb5bf589d50587f54e9e5be0d9eac705fb25814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189385, "uuid": "eadcec4e-a784-4b01-b888-1736f4849811", "value": "T111F4120BF7E88032E9B127701AF207D31A357E111A38439A674F6DA90E726F57274B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189385, "uuid": "bb4c6442-e554-4320-abce-c3242a148889", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189385, "uuid": "14c4ea1d-2c66-456e-a6d7-2d2df487498a", "value": "12288:WMrKy908xSzm/EYs5TYPpBFWPwOvDTHpZTeJ6qqCih2KpUm7VwPO3D3YVwJ+C:kyOYs5ERBwwWDTJW61EKim7VfYwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676189385, "uuid": "aa3e8f8f-c5ca-4a5f-8499-b187affcd537", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676189385, "uuid": "f156dde0-bffd-4598-91f0-c700e9fa994a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189385, "uuid": "d6b40597-d9b2-4426-aa2f-2c7192471fb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceba252f-aaa0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676184315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184315, "uuid": "abcc5953-ab86-4f77-9dbf-d7530b5e8b33", "comment": "Malware payload (RedLineStealer)", "value": "a7216b02b3b9b24cdcab314b0444969e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184315, "uuid": "448f8c15-4f1b-4b2a-963a-5f6e725b506d", "comment": "Malware payload (RedLineStealer)", "value": "55ac165327b48d2b2fa2d9b063f258881ccf07e431867c7726fc7871ddf33a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184315, "uuid": "34e8ab42-90e0-44d8-85b0-04b8d8716b34", "comment": "Malware payload (RedLineStealer)", "value": "a22181a85b49ec85a10139a0850ce4e702ec0478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184315, "uuid": "650006a2-baf7-4485-8b0f-cde9985ed986", "comment": "Malware payload (RedLineStealer)", "value": "aa3fa0ad37f761df197e11bed3f7c1db6d51533d076ba1ebe2d96d5c67e00c45795ee9e60d8a389d4fc4de1c2d9860c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184315, "uuid": "be3ef9f3-40c2-4276-8d58-9f9b0e40bf22", "value": "T1B4F4124BB6EC9537E5F4537019F202D31A377E915B3883AB178BAC494C32AB1623572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184315, "uuid": "1c45569c-33ed-48ec-9c6d-c01ecf254558", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184315, "uuid": "59f56c9c-548e-412a-9d43-a06f6f4c9e20", "value": "12288:cMr2y90jbkyppbuFNipCWA/Y74YWWueJ9N7mV46SSVUX3Oqx1zZtWrK:6yM4yppSDiIZz1i9BmO6FUX3O+zZtSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676184315, "uuid": "cba06cca-c44e-4e39-b57e-f2ae8e5b4387", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676184315, "uuid": "c668f145-05ec-4b4e-a0c4-d3bf9ae8eb11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184315, "uuid": "9820751c-0487-49ea-b2a0-5dcf2ab8e4a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5477b16c-aae8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676215034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215034, "uuid": "06642f7d-fffc-4992-9e2c-7b73315eee35", "comment": "Malware payload (GCleaner)", "value": "86f5b23d26abe43a27c7be46408dbeb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215034, "uuid": "ed22ba89-cd96-40d5-8ad9-3d6b60a489bc", "comment": "Malware payload (GCleaner)", "value": "55da8718abd67e661f2d889b64dda5cdca0e88eca2554bd3240cacaadf1d744a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215034, "uuid": "f6d18992-8633-4a56-8ccd-849681966182", "comment": "Malware payload (GCleaner)", "value": "2baa09026273e001a2c54911918d715b4c7b9865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215034, "uuid": "972d0c56-410f-4e75-a74b-e453935099c0", "comment": "Malware payload (GCleaner)", "value": "312148e4d7b3a5d34221f42747496c6149cd5471636b01987b8d507a6199ec06933cfe45500cae33c100251d7533f0e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215034, "uuid": "6ed6763f-7e34-4347-a9e4-c17586b5175e", "value": "T191F5127C7245C8ADC290BEB48C3A94E75CCB6DE3E9E4A16270D87F3F517C2885A0A517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215034, "uuid": "414f2c7b-28ef-471b-8480-79d620c8f793", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215034, "uuid": "c79b0309-ed7e-43df-a796-b4f3f16b331c", "value": "49152:rdHYM57tP8JbYOZBd5e5wJl1PYI8tye+gmyxAkhkFt1kOuDEbVjVkSTLCgv2MR:JHYMttPylO5j5t6uCkh0t1kdKVkav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676215034, "uuid": "e916d908-3c90-4459-81cb-d6412c11e01c", "value": 3439380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676215034, "uuid": "71a012c5-8af2-441f-89e4-3eb57acdf335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215034, "uuid": "df942ab9-1b3b-442e-b85a-7c8904f47381", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9be5ae-aab7-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676194219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194219, "uuid": "399bb087-10f3-484b-871e-ba90849710a3", "comment": "Malware payload (TeamBot)", "value": "3b22e5432ed609b29d6f2620161debcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194219, "uuid": "731e4881-4c38-4f1c-9faa-8a2281da5099", "comment": "Malware payload (TeamBot)", "value": "565fa975e4c07091f8d8704b1f0020023e187c362e8a367bd758155f1e38d14c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194219, "uuid": "b013a203-b4f6-45f5-8964-cf6149b983d5", "comment": "Malware payload (TeamBot)", "value": "3b40352996f3a9db62a39e82c7f92eefa4e73bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194219, "uuid": "5bec8fdc-016e-49af-8adf-3cfa6ed59391", "comment": "Malware payload (TeamBot)", "value": "88f6284b3907735e70ec08ee7a74c8aa0cdfd1e60a8bc701f815cba19ef82770eaf6a3487b8fcf5b30e124e45857369e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194219, "uuid": "09607964-d8f6-4b72-ba55-22d82d52a109", "value": "T1CF14CF293691C0B3D19785B42921DAA46A2FBC7177A1C4FB370B17AECD313D14E7A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194219, "uuid": "201a1b76-43a3-4385-acc2-56c4643147cc", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194219, "uuid": "d8e4093c-756f-43fa-9c63-d3a1a241c5ea", "value": "3072:kb/b+lcRsHsV1qKvJe3xKVdM+cFwIojNaDDZ9aUium:Oz6H/KvJeUdCFwbjA3Z9CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194219, "uuid": "675bb379-1bc1-4eeb-b811-b4e880eea477", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194219, "uuid": "4099a01a-4766-41a2-aba3-87f640bbab80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194219, "uuid": "0672c044-ff0e-4a92-8861-62ea5c23725f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f905ed-aaff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676225078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225078, "uuid": "83fdce47-147e-4c89-8cb3-ccb5e385e813", "comment": "Malware payload (Mirai)", "value": "1833f25145ca5092876933d95f824179", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225078, "uuid": "1b4f8dbf-759f-4a36-9fdd-0cf8d3c7aadc", "comment": "Malware payload (Mirai)", "value": "56984dad2d0dd7f951b67521c5266568afc4bafde0c7bd531f52e1ea21cd3d8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225078, "uuid": "c8dd55c5-df45-484b-8fee-cec4da03b358", "comment": "Malware payload (Mirai)", "value": "f7ad3f0857f46fb63414c2abc3a8c1595ce8bfc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225078, "uuid": "a1a59def-8a6f-4dbb-9699-fee1166a367f", "comment": "Malware payload (Mirai)", "value": "e80085f214b934a76bd54693fa754fe3df0b01fc12fe6696b019bed8b2562488c68f6d6afc31fe9f57f0162f27633a7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225078, "uuid": "a8c061b4-cacc-4e25-b1ae-7aa22cd99782", "value": "T1D0435B0272180A47E5661EF1293F1BE083FFEE9021F4B689695FDB568271E331186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225078, "uuid": "613712aa-c588-471f-9e5b-877649b54bb9", "value": "768:ur7xv4XXNlb+1EzsTD1HdRtv287M1L/29Hes8Dr6SVGjGEa2xGWar4YCygHWk2md:VATR99Mgsl6rbFaAFHfdtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676225078, "uuid": "4396a090-4a46-4712-822c-d56279963bac", "value": 56640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676225078, "uuid": "1bfcbe54-8b7d-4798-ad06-837c8ceac9c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225078, "uuid": "166bc172-4432-4871-b1c2-a3f19d572703", "value": "1833f25145ca5092876933d95f824179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909e9586-aa7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676168320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168320, "uuid": "5176aaad-8ecb-41d9-b93a-c8dc99c0cfb8", "comment": "Malware payload (Amadey)", "value": "75891aed1d1784631d74c4617551dff9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168320, "uuid": "296464aa-7a77-417a-9ff4-1538c326f216", "comment": "Malware payload (Amadey)", "value": "56ee213b336ed1724659b7ac1e42dde95e932636f7a5346821b9ed368e82cc07", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168320, "uuid": "a7d81f15-0b28-459e-9965-bae63642a4c7", "comment": "Malware payload (Amadey)", "value": "cbc17f29fad9391a490b7bbe8a2d682de1de88c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168320, "uuid": "e8aa8442-1a47-4168-a2d7-4353a814ed84", "comment": "Malware payload (Amadey)", "value": "adc6d173492c6544619c31d6997f8fbf4747d63bc777f2eeae66930cb429c14b0cf55f67feca64dd36d6b753b0b96ebc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168320, "uuid": "81ae9cfc-7854-4af3-be96-be811657bc3a", "value": "T14CF4120FB3FC8422E5B9A77118F743D316357DA15A38829A238A5D490C736E8B53973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168320, "uuid": "0447f633-6b5e-4a83-862c-8eedfcbfc8d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168320, "uuid": "8a09c514-8e2e-4d8f-ac5e-af39565b78f0", "value": "12288:MMrUy90XiwVdZUq+H69LPikYrhzAk4eJiIGawyqesKdpcnv45GkMGCz:wyybVt+aJ4FzVOZyGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168320, "uuid": "8281cb9d-e84d-4187-8e17-39e7b0ed54fa", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168320, "uuid": "18ae549f-53b6-4fbd-99f7-3a7714e55d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168320, "uuid": "8d8aa179-9a1b-4819-85e4-5f795bbf3b3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aecc63b-aac4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676199449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199449, "uuid": "b96139ae-a411-41bd-ba22-e9e963d644ce", "comment": "Malware payload (Formbook)", "value": "7faabc45071fd2f0b07bb0745646deab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199449, "uuid": "64190d02-4f1c-4df9-8424-7c7af2a3519e", "comment": "Malware payload (Formbook)", "value": "575e8f3c11e849517340c54d016dd1b82936f844b7a107134bf175cdd3c40618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199449, "uuid": "1f188f09-1bf9-4de9-b68a-fe0ae8ae0832", "comment": "Malware payload (Formbook)", "value": "451e3f510fba24fa894293bde2b2c3a58c6640f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199449, "uuid": "46ceb3c9-5bd3-453a-8b9c-46547bc4e304", "comment": "Malware payload (Formbook)", "value": "b91a15f2543e9d43baf95fd04e5095f2959363573f5f76cdf7c4bcef0dee856f2730292f144d9e3982e836762ba35be6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199449, "uuid": "7a4acb97-feb5-44bd-83e3-42d974dcb20d", "value": "T132E4F1821D24C669F2F41BBE5E7C562D9FF48C8917E3E3B55BE260D8A423B83C411876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199449, "uuid": "5f4f4866-c19d-4c70-adba-647afdb093a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199449, "uuid": "fc0adb23-44f6-4eb6-9828-c83c0a4b9fed", "value": "12288:qC66Bm2iNNPG1KIzpxjIRCGXj92gamGbFZDRePZjjLZ66B:nVM1ruUIlx0Xj9rLSgPZ7ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676199449, "uuid": "e97a5549-8ed1-466b-a21c-ca925edf4abe", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676199449, "uuid": "f73817af-2570-48a9-84e9-77c326747c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199449, "uuid": "801f5c22-485e-41a5-9c94-5ad628a2ecb8", "value": "Order specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72894fc8-aa6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676162256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162256, "uuid": "f4b975eb-ad03-42e2-b30b-0c0199f85cbd", "comment": "Malware payload (Amadey)", "value": "761b47866c67530ddb8f4200ba5abef8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162256, "uuid": "d1addf0a-4fc6-4705-aabf-58103b6954ef", "comment": "Malware payload (Amadey)", "value": "57fb635fbf142cf0e86cdecc79b16d8b8274b95b3953667c0a557986cb294121", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162256, "uuid": "58662bb3-627c-44ea-84a4-99a0bedebbf9", "comment": "Malware payload (Amadey)", "value": "9029b3bba3a858c607b9daa75c9b68fd4ca8d8d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162256, "uuid": "02beec6e-7bb7-4e36-a091-d04ff76953f9", "comment": "Malware payload (Amadey)", "value": "fbcd2e0593ba250004003c69922a28c6455061c6cbae6cda02e5f7ee72e9be318cb4dfdd05e2c8e204a5e4d1fabbbd52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162256, "uuid": "d70ae2c2-71a9-4656-b9cf-5b09638f576b", "value": "T1C28602C88DEBB674457B44705432DBC9ABB7323F16398A7F0216705A3F1B6A42D03B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162256, "uuid": "1cdd752d-72ed-4fee-ad76-2e1869f69cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162256, "uuid": "8562c768-279e-43f8-a237-6b351785761e", "value": "196608:AuiQk5uXAsEDJBbnU3cNjzhjnZxHGn8T25V1q:AuiQk5uQZfLU3cNfhjnZEyOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676162256, "uuid": "08d128a5-2284-4144-8fce-de46fd0132cc", "value": 7979008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676162256, "uuid": "c6f6dbb4-72ae-4e6f-b13c-5d08f4fa4a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162256, "uuid": "a71073e9-45ab-44c0-8ffb-a6727c63eedf", "value": "761b47866c67530ddb8f4200ba5abef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336a39b3-aae6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676214120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214120, "uuid": "ae250f9f-c7d3-46e5-b7c3-f4f7d9b95606", "comment": "Malware payload (Smoke Loader)", "value": "34ffb1b3f25123ab349babc5f7397480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214120, "uuid": "c7baa4e4-b211-4f56-a5cb-0361235289ee", "comment": "Malware payload (Smoke Loader)", "value": "582bbbdd1e83916b3adbce32f25d05227a79f0f4a037e94471a81706f71bc709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214120, "uuid": "2bb70068-37fd-46bc-8ff6-38b6c5256207", "comment": "Malware payload (Smoke Loader)", "value": "e9fc577e0573582624983e02e7f19cabc2e32ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214120, "uuid": "33d87437-7497-4906-9653-54f8cf80829b", "comment": "Malware payload (Smoke Loader)", "value": "3d9fba86a23eece2d9bedbac88f42f08033f0df854745b888378bcccaa0ab7e03a95b3ab884f3397e669abbc3552c4b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214120, "uuid": "c2125ccc-7647-4b03-a2bb-84c8434bee1d", "value": "T15A14E0917AD2C472E16791702831D6A52A7FFCA1EBA1C0CB33B81AEF1D313D14A79365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214120, "uuid": "36c76f7c-24cf-4dd0-95a0-7741375d2be8", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214120, "uuid": "3b299271-f118-4974-a0ac-8657490002c7", "value": "3072:17iK+rGmzD5iEpvXpJClEeAyZ9a+IsuuHJxfNRbG:RpLmzAEpvZaEeAuhHHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214120, "uuid": "185e3110-8333-4e46-9f7f-1ed4444059b6", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214120, "uuid": "a504495a-ea92-4365-b42c-695b00a66c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214120, "uuid": "6e580272-25d7-4934-9642-31ca30affb3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51a4c24-aa72-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676164623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164623, "uuid": "b365bf85-b076-4228-ba1c-a5f4256d43b3", "comment": "Malware payload (GCleaner)", "value": "ddf8e14444843aad7d7ce1c090f8e091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164623, "uuid": "4b37220a-6011-4508-bf57-bf8361c40328", "comment": "Malware payload (GCleaner)", "value": "584d52d31ea654c7df87aeedca82768a57a723824f00621fe5313ae0f9e1ae1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164623, "uuid": "ad3fb752-8ee3-47c7-ba17-b2582cfde7ed", "comment": "Malware payload (GCleaner)", "value": "909683a60863f98d1a5b93638f9cb2768d004dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164623, "uuid": "b06f456b-211a-45f3-a01a-d45f00d5cd5e", "comment": "Malware payload (GCleaner)", "value": "71713692a8a91022f493a18453ee5a6ce3342aa231a7426a02a48478959b85a3f3c7a826938633462c4e3e27bc18bb75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164623, "uuid": "6df046d5-7e69-4fd1-a8f2-8e1edeb3d8df", "value": "T1C3B5027C7049C46DC280FEB48D2AD4E75CEA6EE3E994A06270DD7F3F917D1889A1A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164623, "uuid": "4093583c-73b3-4458-b6e5-bed1b8f76d77", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164623, "uuid": "57b4983e-6972-49de-8078-ce02eb62e614", "value": "49152:rdHRiSGlGQ6ycptC4kxLLRhExTC6tEFbYMwAWLCgv2MR:JHtGlG7ycptCTXRhEckjAGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676164623, "uuid": "ce3f9901-2117-4b62-a301-55d6475d1989", "value": 2453256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676164623, "uuid": "0229cc77-f1c9-42a4-afc5-e604f67be339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164623, "uuid": "9fc30165-9cc2-42db-8439-0a7cbf307ccb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0171a9bf-ab00-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676225203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225203, "uuid": "a14bf8fa-e8bd-4024-9ab0-dc71b2ff0696", "comment": "Malware payload", "value": "33fc47848a1354a93abd215d2434029a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225203, "uuid": "3fff6620-fb0d-44a5-8e0f-97f941257310", "comment": "Malware payload", "value": "586426a0cbf9e57bcd12dc133b9c3534c5183a3bbb1136a92bbe891efa7b6c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225203, "uuid": "7cc709c4-d794-49a8-b057-dae80ed4c6ea", "comment": "Malware payload", "value": "8d43b3dd031360aaa5007fd7a3b2e26171a8a963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225203, "uuid": "22d6e7e5-c026-4b26-af4e-95871232a9b5", "comment": "Malware payload", "value": "79882b35af973e503d8a25a923cc83632d92b0040b2188a9a58678d50971154f9340bf33b59fac7895d0ad46de588c46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225203, "uuid": "b1edfc2b-776a-428c-a108-e0a0f8e14ee8", "value": "T14BF5123D7104C8ADC294BEB48C3A98F74CD66EE7E8A4A06270DDBF3F52791885B19147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225203, "uuid": "0a0b61a3-6b48-43a2-942c-40567600b67f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225203, "uuid": "1dd03b7a-fa52-47c1-a73f-fda7929dc2e5", "value": "98304:JH2GTDv5/9umLm8lQtG3h5HS8zP2vPocv2MR:d2KtYmLm8lId8cocvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676225203, "uuid": "d9c52387-6d89-4ddb-b7db-f288c3bd1dc3", "value": 3614578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676225203, "uuid": "f204770e-3290-4310-bc03-029e7d4d2251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225203, "uuid": "700fde77-2379-47f6-af81-e6347f2337ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281d60aa-aa9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676182318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182318, "uuid": "ba9eb797-d78c-4d64-b260-c7b5efe8019f", "comment": "Malware payload (RedLineStealer)", "value": "802557c6ea2e3f8bdf5b5e92866c14d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182318, "uuid": "d1aec689-44e0-4040-b0d6-887ba21c4ecc", "comment": "Malware payload (RedLineStealer)", "value": "59520dc47955aa38e69ef20d91966552fce928230ffbaba270477f4cdeebaefb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182318, "uuid": "c5aa7055-66a4-4cec-b8b4-86a11a3eebc2", "comment": "Malware payload (RedLineStealer)", "value": "fc6bb55f9ef8ebabd8834daa589fc3629b61864d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182318, "uuid": "9b68552d-a275-4057-885a-217cd076ee8c", "comment": "Malware payload (RedLineStealer)", "value": "71e81d76cebae985b1fada1863684ce4756e450920f0027d2b24efe88557edee455c42d448c2d94777073ba6cef0b7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182318, "uuid": "f9fd9799-60b8-40c6-a76f-a9c8ae6780a9", "value": "T1F3F4120BFAE89822E4B413B019F703D71B35BDA15B3482BA969F6D151C326E5723472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182318, "uuid": "66b61163-8882-498a-bb2b-195125b58c6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182318, "uuid": "71fb8377-8f2f-4a17-bc43-61e2b973721d", "value": "12288:dMr2y90HXhE6BQxcyc7QCHeJ3KRqZ8dv9uoFsX3O0x1mJ+nGyX:7ycZd7Qx0fvcoOX3OsNnXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676182318, "uuid": "6ee0232b-c513-4405-913f-896f752217d1", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676182318, "uuid": "6eef0f96-cec7-4e31-9fc9-04c0ef99e140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182318, "uuid": "29322444-c050-4d03-ab41-923a6d1de7bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef79794-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212152, "uuid": "d5dbd8d5-a138-47a4-bb89-d5b845693616", "comment": "Malware payload (SnakeKeylogger)", "value": "8440a1f68c373db7bad127fd4cdbe684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212152, "uuid": "ffa50e28-2c5f-467d-b6a3-59d9437495e9", "comment": "Malware payload (SnakeKeylogger)", "value": "596807f2fdd2c55472a55345bcd4a3ed633c2fdd584355eaf3dbcd58b1144f94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212152, "uuid": "1f3e93ef-ba76-485f-ae9f-33299de3f4a5", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6b0712ff31379a62f5f1c8a6c2fdfe73d526ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212152, "uuid": "e916e8d7-3b75-4394-9c8d-559be1aad8c0", "comment": "Malware payload (SnakeKeylogger)", "value": "a50ae1c115101d5d4b60061974739309a6e5bf785bcc98b58ef2cd68e224019f834aaed327513d62f75e29c028458ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212152, "uuid": "dd6688a5-313f-4ab8-92a4-5ebe12338cd4", "value": "T172243B5977F48820E5FF593304B05662CB3AF8121A26DD1F17D1A52A1F3DAD08E1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212152, "uuid": "d57b12b2-a3f7-4aec-9c72-e70b14df4dbf", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212152, "uuid": "c3589eb5-6708-4310-999a-d0d54cdc3d1f", "value": "3072:TqqaM97eOTPiK3DruiiF/XbKjPM18l1cNEOaa89WpAGshT46b8Vn/dRkwBVj8oFN:mCteODDmzKZPdOn6bkX8Mbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212152, "uuid": "d68e8b72-3859-4343-99e5-21025efbc346", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212152, "uuid": "fb96afa6-c8e8-4d2f-9645-766a4e06a43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212152, "uuid": "aedaa183-3a97-4109-9aa9-43276f325e65", "value": "8440a1f68c373db7bad127fd4cdbe684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254d97ee-aa7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676169428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169428, "uuid": "c65967be-fc36-43d9-ad2d-8e4b5f03db65", "comment": "Malware payload (Smoke Loader)", "value": "1c32836bfbe2eb54f1ed58a7e7d3cd68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169428, "uuid": "dc1b7cca-e1ae-402b-b511-d5778d6a8104", "comment": "Malware payload (Smoke Loader)", "value": "59a741423dbe977bb9d2bcf02b14d5670c20fffbba23facdb75cd737f5dea148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169428, "uuid": "6413545b-1ed1-48cc-8dbc-eb2ef8a0fd4b", "comment": "Malware payload (Smoke Loader)", "value": "f32b580ba4306fdc9d2bffc7425de618ca607850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169428, "uuid": "9f4d8668-23b5-4fbd-9b03-b3d831b5c957", "comment": "Malware payload (Smoke Loader)", "value": "bc5d566a88a3e3f92f69a8d10700b9ca2698508fa3fb61ab93d7740255e2db7f7b48d6003f1fdc0f5e1b1263358200f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169428, "uuid": "03d85c40-90a7-4eea-890a-fbb1606e2eb9", "value": "T13714DF1676A1803FC69B46B2EC319A906B7FBC71977281CB3309066F5E213C1AD7635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169428, "uuid": "94d5b74d-b3b5-488b-984f-935eea6441f5", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169428, "uuid": "67c2d58b-c305-411a-b647-ceeb4cd3a7dc", "value": "3072:BjqDA+0JyDaG5C7yrO2gtZn5LJYPXIYv6q3bDXqVpUM1ktG:BGMRbLtZnZsN3HXAqMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169428, "uuid": "06bd5b7d-7e3e-4d7c-ac32-a5debf6fd585", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169428, "uuid": "370e6668-1e97-4c97-924e-aaf355386d59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169428, "uuid": "c3ed4616-ed29-4c61-9536-9a4b2cbb85d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6326f135-ab24-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676240828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240828, "uuid": "b0fcabfc-1934-43a7-82ef-bf93e152bdc1", "comment": "Malware payload", "value": "83e7746fba5b410bc91d814f7c58d291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240828, "uuid": "e3f5072e-60d3-490b-b47e-121514d661a3", "comment": "Malware payload", "value": "5afa2cfa1315d681e56305d5295ada1c64433956729e0acef8f604f8860c5a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240828, "uuid": "0af4dad7-de6a-49ff-b4ce-d745f9e20b16", "comment": "Malware payload", "value": "d2cd4c94e53c52cfb70e6120aff51c9d4b815738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240828, "uuid": "852abb61-e818-43ac-b27c-f811408ec834", "comment": "Malware payload", "value": "212f92767bb57226648c1befc45931d71d41e0183b61cb34866cc06bb0fd7b23bd00475a41016677263f82381a710ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240828, "uuid": "233ddafc-b391-4b1b-9cff-66b363a6cee1", "value": "T141F4125BB7EC9432D8B44B7105F703C32732BD605A35C38B228E6C6929B15B1A279777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240828, "uuid": "a8726ab0-806c-4e7a-9eb3-35a385f04e14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240828, "uuid": "7e091c4a-3cef-44c9-8401-90dbfcac3362", "value": "12288:CMrfSy90KYuUeYV9SjBdtyMbk7qI8vFh9Hg/cfsneJcxqpLztCCjfR0r9NoqzSpT:oyOuUnVw3tyMbG+vFHcC4cLh7SRRSpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676240828, "uuid": "fa23cc67-6ca8-4f5b-ad12-b4eb91bc40c5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676240828, "uuid": "5273900f-3168-4119-aa35-3b06f78020ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240828, "uuid": "e4a9254c-2bcb-4e62-95bf-42d99122d93a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1b03d8-ab2f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676245484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245484, "uuid": "8027b0ea-0053-4a6e-8846-6c58ef8a6d80", "comment": "Malware payload", "value": "5e56b64ff6f53cf54eec52a5e557de63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245484, "uuid": "77aef50f-ace1-4b2e-8217-762dab902813", "comment": "Malware payload", "value": "5bb716db32bc6475bbd80eb7d3d7e22c23a98b4481a2fd91d71b807210a3733e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245484, "uuid": "7ce5b9a5-1856-43c0-b54f-18c3a15959c9", "comment": "Malware payload", "value": "c160f1c24e334a9c4523c1678a011a07303b29db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245484, "uuid": "d47192ce-7d1a-47f5-ab19-9c57aef51188", "comment": "Malware payload", "value": "ee64afb5ce19ebe97df00e999584d7b5677fc69eda43b66ee3f2783776435d3e2224e380d24e9e7747faa98a6d4c8ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245484, "uuid": "85ac22f3-c9df-498f-ae07-46af6e14cad6", "value": "T184F4121BBBE85523E9F4577058F603D30A327D918B38839B26892D9A5C726F0B13477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245484, "uuid": "441aacce-118f-44cb-8fda-aecd1c295bad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245484, "uuid": "762fdab4-599a-4f07-84f9-5a2bb62884c6", "value": "12288:tMrAy904KtyeAy/ZGFw4cqTHV1SUIXRoZTyeJOv4hF+aK7CCjVR0r9Idqfsp:dy8tyNy/0FJcuHVooZPPr07JSRPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676245484, "uuid": "fd3913bb-ca18-4aca-a4e1-57ece05f753a", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676245484, "uuid": "f732c85e-f81d-4997-a3bc-acb43ad50928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245484, "uuid": "223abdb2-3ae1-4d59-a538-82e8aa1ef225", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf614df-aae4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676213518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213518, "uuid": "e2fc602b-b443-49c2-b422-643ed4b111b3", "comment": "Malware payload (GCleaner)", "value": "d4baf4c88518e3ec26c3eb7fbd04bc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213518, "uuid": "ec88f24e-5fd6-4b37-bb31-af9c662dc866", "comment": "Malware payload (GCleaner)", "value": "5c133e267f1b7cf8b07e4445232878b71420f73de04937f50b647b6019f868b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213518, "uuid": "d42868d1-ac21-4ef2-b384-a74f064b134d", "comment": "Malware payload (GCleaner)", "value": "6116720161a764352809a9a8dd5a21354836f0d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213518, "uuid": "c93dadb9-639b-480d-a26c-a3d3a19de3af", "comment": "Malware payload (GCleaner)", "value": "7de5c4bdf2b83687bde6c8c114f39de9594dfdb3276d436719919df4d525d7a8f1769ba789ec5e3fda08c0554c056495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213518, "uuid": "38b6938b-0d4d-441c-b2e0-42544226ea07", "value": "T190F5123C7645C46CC280FEB48C3684E75CEB6DE3E9A0A46270DDBF3F92791849A1951B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213518, "uuid": "f50549a4-0eaa-415a-88ec-a0c79447468d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213518, "uuid": "bdbbce18-1e17-40ff-a8c3-33045e76d6ff", "value": "98304:JHowWyIgsWraj7U4j9cyDCfNr3yRedv2MR:doxvagCfNGRevjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213518, "uuid": "fd69bcf8-582a-4818-be08-9f1f2cc82949", "value": 3437506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213518, "uuid": "d02bb937-f44f-4a76-9186-0ba0dce03a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213518, "uuid": "b216c2b6-2364-43af-b0b4-0302ee36a597", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615972ff-aad4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676206466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206466, "uuid": "d8285929-21c7-45dc-af03-ffc2bafa467c", "comment": "Malware payload (Smoke Loader)", "value": "78d39e44c39d7599793636fe5d18305d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206466, "uuid": "ac5c53e7-356f-4ad5-a36f-1065e8ab7eda", "comment": "Malware payload (Smoke Loader)", "value": "5cd124802e894dc144cff7b0ea122b69830f2ecb2b44e656cc901e10c1ab9a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206466, "uuid": "39eaa8b2-4c0d-47db-bc27-d20e7a9a1c20", "comment": "Malware payload (Smoke Loader)", "value": "2acb5631cd56ac823cc004a9e1462c8b3b3c963f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676206466, "uuid": "64da4346-45bb-46ff-be1c-ab1713a8cc8c", "comment": "Malware payload (Smoke Loader)", "value": "ec40201590dd7a3163543bc61241b6ed8bf9b7ae59a15523209df3d68aaf1fa353f113ab40f9fea814c8dd9d9600df5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206466, "uuid": "80787c1d-ac9f-48a9-9a93-3bda1f39f458", "value": "T1DA14CF3175948272F1E2C6B0693DFAA36A7FB871579584CB33481E6F1D303E15A3A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206466, "uuid": "3f3a458c-db8b-45d8-b1a5-4eae2fb03d0a", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206466, "uuid": "89458768-213c-4593-91e2-d0e7a2d0ab2b", "value": "3072:v7t0+rGj156yNmnkdW5GQ4NeonPmq3mYiqtNrzUKTi:j6L+yqkc5GPOq3mOrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676206466, "uuid": "db80ec8f-adbe-463d-aec5-bdc054f37a64", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676206466, "uuid": "28b41781-8fa1-4564-8ad1-93fd44ed9aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676206466, "uuid": "44f95c39-b3e9-44ec-90ad-a9395d75d70f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead07728-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676179638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179638, "uuid": "6909213f-47a3-49cf-9926-8b84933016d9", "comment": "Malware payload (Kangaroo)", "value": "f124eea8155f4088d236eb341403e1b5", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179638, "uuid": "d00aaf5e-690b-46e4-bc57-38962da96b4b", "comment": "Malware payload (Kangaroo)", "value": "5e08e6203f8669f85404560412d0e4f79dd38098b7aa2bb4ac7c08c791320d1a", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179638, "uuid": "df2fe6a4-7f2a-4004-9ea9-709dbc68c170", "comment": "Malware payload (Kangaroo)", "value": "b252e6343d19946c1f22f22aeaa04b5c72c378ef", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179638, "uuid": "6af60de7-1e19-4e6b-a30c-333958c5319c", "comment": "Malware payload (Kangaroo)", "value": "aa2a0238ac70067f952200d289449fc8369f71220285c7a2c096b26cbb68171105b35761c741178228b34727a6695048", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179638, "uuid": "606f5558-7262-46a3-af4a-2c2b1399a496", "value": "T10D82E8471FF80966FBF2DE7014FE6846C17B782AAB39EACF0614580819B15A0D57C7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179638, "uuid": "b044e0d8-b890-46d4-95b8-2154fbab9dc0", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179638, "uuid": "1c525c97-f097-4d67-8e4d-d754362919b0", "value": "384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zFNWKhWAWhb:19u9CaxEovcm/BCvXFfmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179638, "uuid": "924dffc0-15a6-40a4-b985-6415d35f9b9d", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179638, "uuid": "61191135-d150-4aac-aa30-3940ed6ce1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179638, "uuid": "9679bfc0-dfde-446e-a8f2-f85d755b16c8", "value": "2023-02-11_f124eea8155f4088d236eb341403e1b5_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de01d15-ab2e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244980, "uuid": "9cb959ad-88ae-429e-a5b0-5945cf6b89bd", "comment": "Malware payload", "value": "b5a5ff567ce2731ac5f2cd6ae30f44e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244980, "uuid": "88307bf4-a6fb-4e3f-b576-eaf159152679", "comment": "Malware payload", "value": "5f50ebbaaf1571fa601e847e6efd4d3f811fd86f8517bf6cee69536648ca4cbc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244980, "uuid": "bf4407ab-5922-49d7-8f7e-9f430cb3efe7", "comment": "Malware payload", "value": "10889ce1855740550f3d40aec4ee44af40f86e78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244980, "uuid": "ce1c64be-c004-45f7-82b9-2171c4ffe8fe", "comment": "Malware payload", "value": "48aed05449bdc815bf48346b6beebf45a1f671d2b205d2067e435375262a00cdb724a773d1c9d80e615a5c3a696abf55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244980, "uuid": "dc5ead9d-2cc3-4c37-b00b-645791058d4a", "value": "T1036533D58FE8BA7FD731AED75E08AC80DB359B41DCE18580613FABDAD23C90185A9107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244980, "uuid": "f489cf69-9424-4830-bf4a-22a72d4ea455", "value": "24576:0EziOjPIn8DNamMhjVuQ4ZuIsYah4ouioamajuxr4Ueb/Nff:vziOjs0wfNh4ouio+ql7eJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244980, "uuid": "e9e4ad3e-2974-4f28-ac7b-c327266d97ff", "value": 1541174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244980, "uuid": "5af75212-a753-4674-8461-364cb8c7c3a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244980, "uuid": "9a03f17f-b215-40a5-b477-33fdc6f12dfb", "value": "a383534669ff5ef9786e6aa9dc78ca66.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b326f132-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676229796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229796, "uuid": "04da4863-c993-4b0a-b09e-d6886e46119b", "comment": "Malware payload (SnakeKeylogger)", "value": "071131e0480e990e09c95c7b759a559c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229796, "uuid": "4e6303ff-552c-4b43-a1cd-70fe4d63d061", "comment": "Malware payload (SnakeKeylogger)", "value": "5fcedd535c882efe907010b867761452deaf99e41fab0f1d0cc306f506bee72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229796, "uuid": "a0996d43-b28d-4642-809e-bc3559f89b01", "comment": "Malware payload (SnakeKeylogger)", "value": "4a5de8a8be62be00e4cbf2455f7c18ae633e2f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229796, "uuid": "6b77683f-34a0-493d-ad89-7657eeab9593", "comment": "Malware payload (SnakeKeylogger)", "value": "33953275b2313d085bc6b7bc977c8ec9a17498ddb4bb7e6de26408acca85f7379b1d42014ce035b4195cb8d7b695a4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229796, "uuid": "897d20e5-9f67-41a6-b2ee-0a0d83fe24d4", "value": "T1EE1512A1B2EBCBB3C99909F5D4F24C3823F1D6EA9193E359BCC11561AC12780E7596CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229796, "uuid": "ec7af7bc-bd2c-4f2f-ab15-be83451487c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229796, "uuid": "2b1958e0-8960-46b4-96a0-22e56d8ff3c8", "value": "24576:7f5ueDRKQPSDZKFv/v3Q+RKORv+TzFRP1+:lueN8KFv/vdRKKv+dRPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229796, "uuid": "0ce56667-d96c-4dbf-92e1-a25b531357ae", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229796, "uuid": "3a3f0054-644b-45b3-a6af-ec709550efc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229796, "uuid": "9da226f7-40e2-402c-9dd6-99c439f1ea69", "value": "071131e0480e990e09c95c7b759a559c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7961591d-aa9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676182884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182884, "uuid": "88889ec7-fbd2-4859-8d14-3cf75576993a", "comment": "Malware payload (Amadey)", "value": "8b713b716df08abb26d0c321810fc197", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182884, "uuid": "80931620-c550-449b-8ae9-042269991035", "comment": "Malware payload (Amadey)", "value": "5fd1fd869765a9b750e749c8194c4219eb0fd08431b53064534a680fcaf2defb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182884, "uuid": "bf469d50-3427-4888-ab8e-b0e3fd39b691", "comment": "Malware payload (Amadey)", "value": "cebcf9807b8442f92c5539e6060f9b15e010ec99", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182884, "uuid": "bcaaeaca-e242-44a0-9add-10d35f7c7597", "comment": "Malware payload (Amadey)", "value": "3173b9d054f0076c493bce744081e7841fc34924128707ffd2197e0e68b06799f45bf119990f3fae7c3fcd0da29b3652", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182884, "uuid": "8941734d-5dab-48c7-9be9-f308e09238a7", "value": "T11CF4120BA7EC9532E8B523701DF602C316367D906F3486AB674E6C6C1872AE1B17573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182884, "uuid": "0afced77-14d2-4a43-b7cc-9dd3fff8bf66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182884, "uuid": "6126e455-cee6-4cce-922e-24db32b59514", "value": "12288:xMrvy90k6czs5S9AUo9LAABWfH1mkeu5ioFyeJjg5xSLo8qkDX3OAx1cZtocUo:OyM3R9LA6WfHrewhMbSLo9aX3OocZtos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676182884, "uuid": "99cdd526-c3ce-410a-bfa9-559d3f405ae2", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676182884, "uuid": "108736c2-6f24-4079-9d09-a8934b8a21a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182884, "uuid": "90c254fe-1e48-41b0-ba69-43eeb8db0d7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840d64dc-aabb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676195786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195786, "uuid": "69b226a0-a937-4d69-871f-8f9639435669", "comment": "Malware payload (RedLineStealer)", "value": "777474c413f32becd570c25bf923fe2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195786, "uuid": "67aa0ec5-20c4-4e86-99f5-f1733b8d566a", "comment": "Malware payload (RedLineStealer)", "value": "6224a67c258a7c8f89f9547107ebfe0862a8ac77cf30afec59090c9e5a5546fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195786, "uuid": "4c64cdc5-a250-462f-828c-1067cae67a01", "comment": "Malware payload (RedLineStealer)", "value": "c77ffc2a161d540bbdc99d5cb5b2d4b26dc9edb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195786, "uuid": "5d3022ab-a783-4200-a52e-76a1e6f216f1", "comment": "Malware payload (RedLineStealer)", "value": "c3a2af9e07d3088e23b4e821eefbd82a8144e4c38916141dde53d43664bb60b0d2b07410ebfef4da3abf7255f20b3761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195786, "uuid": "bac901c1-990d-48d5-9840-7eee0b64f293", "value": "T1BCF4120BB7EC4022F5F5937009F203D32A327E71973886A6679E7D9928716E4653633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195786, "uuid": "0e6e81bc-ef82-4f81-9c7c-36177c4831e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195786, "uuid": "dbb95a9d-9204-4c59-b844-e3929c3e9a46", "value": "12288:YMrOy907YFgwVyn7VKM6CLKrKzgkaTclCi7JeJtzzSP+QhpGM7IVzhClfl80iPKu:2yUuV67VlL8jVcAjh8hpGQg4lNpju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676195786, "uuid": "97d39a14-3a0c-474f-86cc-defecbb1cbc7", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676195786, "uuid": "4e4f36cc-ede9-4953-95ce-2b3aa1f05f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195786, "uuid": "e84dbdfc-70f2-4619-a8a7-6c6f386ee855", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e140ef09-ab11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676232880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232880, "uuid": "e0b0632f-bb02-4ed8-b0ad-cb61c598ea21", "comment": "Malware payload", "value": "4eab34cd6a3d67a572331e5ed90a27cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232880, "uuid": "8e0ff6fe-2893-45cd-9f0e-d08f7af6bf78", "comment": "Malware payload", "value": "627acff7df32cf9f6a0528740b74c35d2d6175471153812349e7a77a6ccf787e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232880, "uuid": "8751f10a-7bf5-4af1-97b1-3bcdf033a58f", "comment": "Malware payload", "value": "71ac059de3cd8dd08bd55c5e8f37e42608e2f5da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232880, "uuid": "8268808b-f934-426e-b77c-7de4420e0194", "comment": "Malware payload", "value": "a0c1d837dbabda9d22e7eb8b12f1d1225d220621d4c6a21b38ffc45f9c88f76ad31a6624c13d985bf5ed54d6620fe551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232880, "uuid": "c6480116-4af2-4cc8-8bda-a5a7dc13491a", "value": "T1C5F4120BBBEC4423E9B417B05CFA03C3053A7D15A738439B634B6D1919B26F4A6393A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232880, "uuid": "3b6a1120-e3d4-46d2-a5f2-d5457679849d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232880, "uuid": "d265df59-00d7-4fc2-b665-7794d3603743", "value": "12288:uMrTy90Yn6Sgp7wdJG7oW1/6ZnI5+feJlGU9xP27FltSKfB61piVGX7Xz:dyl6SIwTG7oW1suBl1C7Flow61skXTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232880, "uuid": "684bf083-10b4-4b16-b88d-0c30c4c87db6", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232880, "uuid": "67c768c5-5a3c-4d04-8f2e-ed9c26e7e9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232880, "uuid": "30eba47b-a678-4d21-b64e-72de9ccd788a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fa7c57-aaa2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676185235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185235, "uuid": "7fcff176-5567-48fd-a757-229912df4401", "comment": "Malware payload (RedLineStealer)", "value": "c327bd2964a9f3a1fad08c6d0412046d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185235, "uuid": "97123fd5-04ae-449d-aaf5-47b1b6f80d25", "comment": "Malware payload (RedLineStealer)", "value": "6292bd078de848615b1d99bda90f0bca407a069787b7987e2c6d45fd2dc2ee1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185235, "uuid": "3052cbaa-1a5b-4476-aa9c-44c45e2a50f7", "comment": "Malware payload (RedLineStealer)", "value": "55a40b47967f49f39c10fce59fb2e39e817ec766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185235, "uuid": "0f092547-10bd-4f1c-a331-1dcbf6652b8a", "comment": "Malware payload (RedLineStealer)", "value": "6a0b071ef46f946808b142a37dd4563dbe2da67cacab711f04eda8deb336ad14269307aed1ad2f6165cde0ff09438222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185235, "uuid": "145e0e90-d6e3-4c44-83b2-96b44a423c46", "value": "T1BE54F1017AF1B373F55782B16930D6956EEF78E3979485C72314021E8E203E19E7E3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185235, "uuid": "fa341f71-0130-4e32-8593-ef80b716cd05", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185235, "uuid": "e6de6993-747f-48de-807f-18599f3d6c53", "value": "6144:dGqRtvtwgpXjnTP+vcqGIy0Sqw0iWbvxAjZd9CTJD:dGUruEqGcffbejz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676185235, "uuid": "3debed54-18c6-4f87-a430-ca482ed93346", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676185235, "uuid": "6f18f1ac-6eb7-4ddc-b614-b12bdef521d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185235, "uuid": "4f30583f-d72e-4976-a95e-66fa35fc4bda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7c4bc9-aaf7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676221463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221463, "uuid": "31a38453-eb53-462e-a3d4-edca9adb0089", "comment": "Malware payload (Amadey)", "value": "4f610adf24cb1a3ad46e95fb847027c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221463, "uuid": "0e4f5bb7-4d06-4040-8ec4-b2aa9e311011", "comment": "Malware payload (Amadey)", "value": "63a4bb235907236f190e355f53ff4581ae4428549df7cc4490b9ad5416cc26d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221463, "uuid": "d8dc0518-9a36-4b4f-b81c-026527d15950", "comment": "Malware payload (Amadey)", "value": "b0209f072df2f41b2ee5f03551d4b69aa91ab9a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221463, "uuid": "e64d65ef-cbf5-45ca-8015-1261164c1975", "comment": "Malware payload (Amadey)", "value": "472253350183c5746f802f7297fbce0cc82140d17d3ac0f61766e0df24bf702bc7781b71daff29fc1aa1c62d2aa43ed0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221463, "uuid": "c80ac8d0-3402-452e-b777-2a921c0dffab", "value": "T1DEF4120B72D88422E9F61B705AB617C30D327E610A78C36B134B9D5A5C73AB5B23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221463, "uuid": "bfe5c9ac-6338-4886-bcb7-57b7a22444aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221463, "uuid": "65416921-82cc-46f5-bae6-77512579b740", "value": "12288:KMrky9051PwDjnr4tYU/ri2q87NPtiBeNWmOeJXBUhN4fRFA+vgkeWt6dX1C:Oy4QkLW2q8hPXgKXmbKXgC4dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221463, "uuid": "a81d351f-1a8c-4cb0-b1c1-36f6515912bc", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221463, "uuid": "2c0d15b6-2c16-411a-87ee-d63d91b1b683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221463, "uuid": "c97eebd7-1f2d-42ab-a285-f00d168a97ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b293c38e-aa9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676181691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181691, "uuid": "cdb6dc3d-4092-4321-b857-dfab860e94db", "comment": "Malware payload (TeamBot)", "value": "a4ec59a653df1f9e1d05b80b3bd8618b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181691, "uuid": "4b4ae02b-622f-4858-8b24-b7cd0e62bd61", "comment": "Malware payload (TeamBot)", "value": "63cfd0bdd10d6a282370c7d70213a0809fdb7a976b759c80989e04140e5f39e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181691, "uuid": "23018eed-8e1c-42ea-a092-23208dfb8832", "comment": "Malware payload (TeamBot)", "value": "c7a739577cd5195582be10babec04417ae4d6314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181691, "uuid": "55645ef6-df95-4973-9d96-5750f326b1ce", "comment": "Malware payload (TeamBot)", "value": "899a48de3bfb1f5b42d087d90422178eddc1596cd4ed538f187c671ae226fd8b02b7067f1ea75e0a73f4b96a24db18f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181691, "uuid": "7d6d1219-5ccc-4eec-a30e-50456a4c9ae0", "value": "T1D614CF117AB68277C2D749B4143DFA902A7FBCB1676283CB2318069E3D313D25E7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181691, "uuid": "c6d69f2f-8081-4e6b-a5e0-91be2ec06486", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181691, "uuid": "07d65f0b-6a48-40fa-bdab-bc78cec77f7f", "value": "3072:mje79+Npoe6R5ChNtUsYy+6cuL+YE3qEWIM7tr8Je5:mi5iz7fYmcY3kM5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181691, "uuid": "80bf9398-ebc1-4bce-b3bc-75ba03e26412", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181691, "uuid": "8da8c56d-1c94-4d66-bd79-91b6ff9a1e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181691, "uuid": "b115e17d-dd32-492c-955c-a69ef796a4b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54270bc0-aab9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676194847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194847, "uuid": "79b1097a-bec7-4b02-a817-a5bab76a7835", "comment": "Malware payload (RedLineStealer)", "value": "78834803d5acd256c8f1c5a78013e596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194847, "uuid": "42e3e0da-50a6-4a2e-80c5-2954773d58cd", "comment": "Malware payload (RedLineStealer)", "value": "640c014f395c32044ff38fd02dbd2bec7bffe4e807e646b30bd961c5bc25d707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194847, "uuid": "31e6a1bd-53c9-4abf-8ad3-4d16b14052b5", "comment": "Malware payload (RedLineStealer)", "value": "7c70e719d9cb93503654440693af7f1db4097058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194847, "uuid": "b4c8d0af-b18e-4d81-9267-db94bf17cc59", "comment": "Malware payload (RedLineStealer)", "value": "31ae374c85336c756435163410487060e0a7f38ae61b3e68a8031fc05d65797985b536e0069983033cbecc5b2c65ca24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194847, "uuid": "0a417e32-cb5e-40da-b47c-c0bf97c32969", "value": "T1CCF4124BB6EC9422F8F457701AF603D31A337D904A388397678EBD495C722A0A67537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194847, "uuid": "4335c034-9451-40bd-86c7-682d53503f80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194847, "uuid": "c5760df9-2e6a-4c87-9d6e-455e2af693ca", "value": "12288:mMrEy90nk+bKWllsw+Nmf/+9TeJFTupJwj1mkdt/gGcpIvzhFP1l8kMSP:aya1lZ8mfPV7ZbD/gGO2fPTPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194847, "uuid": "618153be-fcd0-44e8-8936-f8124962ba33", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194847, "uuid": "2cd35c8e-26bd-4053-a2b9-b0ef600ebc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194847, "uuid": "45cab3b3-05c8-48e4-ba21-64ad1fef3a6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64af207-aa96-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676179979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179979, "uuid": "a98664a0-49cb-4069-9b64-fac859247c4b", "comment": "Malware payload (GCleaner)", "value": "b62c0fc6e364a03cd459a301e2043e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179979, "uuid": "528c7a11-d7f5-4650-9774-8277a1150214", "comment": "Malware payload (GCleaner)", "value": "659985416b032cfe2b39f081aacb2918cfd767b26653b629a1faf99e9de95ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179979, "uuid": "cb8c517b-db59-4344-b36d-b3200da3c8d7", "comment": "Malware payload (GCleaner)", "value": "50557addd269d4553844bf54cc4f319f0c1cb12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179979, "uuid": "21571d5a-ae16-48e0-8cd3-499b266af110", "comment": "Malware payload (GCleaner)", "value": "925fc897605d00a84d41cfb6c18805699a77d773496e69adf05ef70317d05727818f14aecdf91888c6cb27a66101dc44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179979, "uuid": "3c1048c2-48a6-4681-aa7c-264fea370dcd", "value": "T1F1F5127CB215C5ADC6C0BEB4893A99EB5DDA2DE3E9D0D06270DC7F3F51392858A0A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179979, "uuid": "fa153acc-e8cd-4d2b-a965-c260f9511d82", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179979, "uuid": "69932cbc-d9cd-4ff5-b2bb-278452b79ecd", "value": "98304:JHEcWqQubWzsDDrH59DtIldSVX6+jolIKG505jom5v2MR:dEcnWQvrZ9idnzl9G5wjRvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179979, "uuid": "d2b9dee0-ebfd-449b-9da0-8b11f5396602", "value": 3611358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179979, "uuid": "9bd181eb-493f-4a23-ad8c-88db63f4cbb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179979, "uuid": "84eb87f8-7f03-4a83-a247-811edcf23ea7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785286b4-aaee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676217671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217671, "uuid": "b12f3370-6372-4ad4-977f-d00517ef161a", "comment": "Malware payload", "value": "2c3f2b1ba82ef97ac6b9f97e93eec3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217671, "uuid": "836630ba-b7a3-4ff8-872f-d05bb196f68a", "comment": "Malware payload", "value": "66f78b6f296f27261b83e940e8056bdd88a1349f05bc2f660aa144b46f02cfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217671, "uuid": "34f8c1a6-8e64-4e95-893f-a530858c5a80", "comment": "Malware payload", "value": "bb492b90c6dab675869cbea6b8ef8467389544e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217671, "uuid": "392efb64-0b6b-4f85-b5c7-24027c9a27e2", "comment": "Malware payload", "value": "fbbf49da74d874e54453502ae5fdf19aec7e945c757527a5a433c1cd60202331b6e2bd3c3ada5d5436ab0caf00a3494c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217671, "uuid": "7ae6cad0-791e-41e8-a4fa-983d6520078b", "value": "T180F4120BBAE84523EDB07B726CF60AD31E31BD115638939B268E6C1D09716B1B53437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217671, "uuid": "c54243d2-20b7-4578-ab4b-678cdd9c02da", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217671, "uuid": "ac221e5d-3d30-4ab7-b020-0c7452a3ef97", "value": "12288:oMrOy90OHLf0NLwiNViZoZgDOMnWp6eJviW5r4QpIEt2SjGat:myFHLf0NwidSO0WpD5rPTj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217671, "uuid": "90e5d255-c0c7-4371-828d-496103589465", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217671, "uuid": "8cf072f7-f355-4b9c-9777-91cf99c3601b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217671, "uuid": "b4a91159-6ed5-4b12-8cef-8a123c52b36f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0ab308-aa68-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1676160046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160046, "uuid": "9d7ee195-045e-4a5b-b3f4-1fdc4681a74c", "comment": "Malware payload (BitRAT)", "value": "b9874cdde692f485a1c609aeafd075c3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160046, "uuid": "19d50fb0-4235-41d4-be75-a56cf5531a50", "comment": "Malware payload (BitRAT)", "value": "66fdb47c24f569d7fae5707024809698812a40458216414827d3ea57cfb19dbb", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160046, "uuid": "ff1734a5-17ad-4457-9602-45f897de2a8e", "comment": "Malware payload (BitRAT)", "value": "8806ac9b20eaa78f89b5dfd1b78a3c7fb5cbffce", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160046, "uuid": "c8541011-4eee-4691-ac0c-487cdd93f1ed", "comment": "Malware payload (BitRAT)", "value": "11879200b041da707d0a32032d2f346944687e42f19262bb61404992905f5ce16d17c08ebe236bb0f27ad25250097b16", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160046, "uuid": "1f998898-f6f1-4bed-8575-9e8c96ed2797", "value": "T1CF073196CACB30BD3F36D349F325F09947F0266F9F9B44B498280A1E7A5079C56C864E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160046, "uuid": "373c3009-9b02-4e11-a94a-b09366b14132", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160046, "uuid": "55925079-5021-4f8e-b860-df0f6512d50e", "value": "98304:AQC5lSLCSHP8Z2HOR0mW1LCjqOMKmxE6G:LC5R0mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676160046, "uuid": "5a8c3ae3-728c-4909-b086-6047576748fd", "value": 17326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676160046, "uuid": "137779a2-0d01-4228-b399-6ac0079ce8ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160046, "uuid": "35f7d16b-216e-4af4-9504-3b69b1a2659b", "value": "HEUR-Trojan.Win32.Generic-66fdb47c24f569d7fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ceddb9-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676235761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235761, "uuid": "f9c3d235-c46b-4e3d-9188-aaf71e1c4009", "comment": "Malware payload (RedLineStealer)", "value": "b7b036556a229f36c6c9a0c410a9d29a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235761, "uuid": "00d80c6f-3e89-4360-ac53-32ea8b604f98", "comment": "Malware payload (RedLineStealer)", "value": "672aae645de2281a9e959171c4ca5104d7c8c7bba970f3cb4ab7d90a05233311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235761, "uuid": "ee47070b-8995-4deb-863e-362e80ea48a4", "comment": "Malware payload (RedLineStealer)", "value": "f5e986da526db2c69658eee16beed9d6811a885f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235761, "uuid": "e9c53e8d-83e9-458b-8c92-4f1ace6f4300", "comment": "Malware payload (RedLineStealer)", "value": "397dfc1d8312289650a4dc941e3af168b776fa95ce3db89fa9257bcb66eb94aa962e0a7f602de1aa0e2927b996674872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235761, "uuid": "d7737192-aaae-43e4-992e-963d9281ec02", "value": "T12554020175B1C876E05B863664E1DAE1653FBDB0AB22C1C733491A6F6D212C28FFD396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235761, "uuid": "f4397795-3646-4963-8c62-426c3ecf4dc7", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235761, "uuid": "943b2a67-3abd-4727-8e75-2e592d3d3a02", "value": "6144:JsC+v7gjyqlmDvd0myTwE0BkNWjujpVkOqOA:JV+zgjy2mDV0mykBk1tqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235761, "uuid": "a5f6d80d-8e7e-4148-80eb-1b073119e235", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235761, "uuid": "32ba797b-08ad-4c7f-949f-835c5774b1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235761, "uuid": "7ec9f8cc-7c3b-42fa-8301-883fafb685e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49da03f6-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231767, "uuid": "1e060435-64f8-4dd7-88c4-cb0596fc4d35", "comment": "Malware payload (Mirai)", "value": "c7a32aa6d389ea9198db62078b3a45d6", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231767, "uuid": "1ec040a9-b798-4f71-96aa-8768c69271bc", "comment": "Malware payload (Mirai)", "value": "6749dbab7e15bd56c86f2bc06ebe24405021fdc4446165011632293904fd256f", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231767, "uuid": "830aeea7-1225-4944-9734-70e6933598fd", "comment": "Malware payload (Mirai)", "value": "5b22b869567eb51ba0a87bdaaf15cf44b83b402b", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231767, "uuid": "c4158220-c07f-4ee1-add4-0d0550d27986", "comment": "Malware payload (Mirai)", "value": "1870ca72dd75dd835971b8494945c0f3208edd0d1e62d05e62ad5139e3b2cfc02bcb454ac1b0ac580e5f6b55979feff8", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231767, "uuid": "370cf9e1-7a56-4ec2-89f0-d8b0348b1118", "value": "T13433027FA19028FBC72C8DFAD09C6EEB5EB0B58175ED0B2643B5098429ACDC5684C4A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231767, "uuid": "d468c086-9888-4224-9f61-f757de138aba", "value": "768:FJi1sGaOG9INdyKI5rKXqrb/FkVK5qKgNhdA2F5VBLJ0Bs9bXB2kWf:FJi6OtdyrJ9TchNh+2F5bJjkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231767, "uuid": "1d8bbd8a-c58e-4ec6-b7aa-2eaab60ef6b6", "value": 50768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231767, "uuid": "a94b8f71-66fb-4ebe-bf1c-c44539401506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231767, "uuid": "8eb08f47-d505-42e4-9b66-047d87978c02", "value": "log21.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810b449a-aaaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1676190627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190627, "uuid": "41807b7c-99ae-4185-812a-cd85cf61768b", "comment": "Malware payload (N-W0rm)", "value": "9542aea33126605ff94339b2fcfa9dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190627, "uuid": "d98da75e-d7f5-4b48-8eef-9a57cd4fc9e8", "comment": "Malware payload (N-W0rm)", "value": "674eca8c51d7a44816192d8a639cefb4ff570b4b71f05605578cb7fa2ef9cc89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190627, "uuid": "41bde819-a1da-4ea6-b2ee-9076ee1bc269", "comment": "Malware payload (N-W0rm)", "value": "34a55fefa01658db9e920931a2472e610175da85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190627, "uuid": "337c1eca-8e25-4cc7-9a4e-c1a1ea536978", "comment": "Malware payload (N-W0rm)", "value": "84d3a7f63a924a283d61c9375e4f76b0243cb994d1fcfaaf37d4ba597acd228f7f0ffadf8920166dad10769422da974d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190627, "uuid": "61a85dd7-907d-4f04-aa98-62e5e018d4f7", "value": "T14DA40207E7EC8026ED755BB018F602C31A357EA05A7887A7278F5D690CB25B4B53633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190627, "uuid": "ba72e0ef-e65e-4ad6-bf7c-836f306c3061", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190627, "uuid": "31ad910b-f8ab-494e-b87c-922829c48eb8", "value": "12288:nMrFy90xL7zcN6mcmVzC6iBgZKHGw5cn3lwEqXBl:Gy+L7oX6nXcnVwpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190627, "uuid": "d0d7cedb-1527-432d-a67f-68e5034e27da", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190627, "uuid": "c19e3323-d271-4a6e-a3cb-f0ed460003c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190627, "uuid": "aa9355e7-b3fd-4e44-9549-8ca1215e0d86", "value": "9542aea33126605ff94339b2fcfa9dbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5667ff1-aa70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676163657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163657, "uuid": "b38d4052-95c1-451f-8c07-c286f9847ef7", "comment": "Malware payload (Amadey)", "value": "11c09dafd3fc3aa70a5443d35355ae79", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163657, "uuid": "c0a5f009-7362-4166-b3f1-c6c59eda539e", "comment": "Malware payload (Amadey)", "value": "6944483e075757599e977bb5d0a3cf45cce720580f709c35ceadd54dd75289fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163657, "uuid": "7dbf5500-3ed5-49d0-9372-ed0f9c25922a", "comment": "Malware payload (Amadey)", "value": "62fdd3ef2cc7d8aee2b4df00d970f2d56b52a928", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163657, "uuid": "a06b4fe6-eeef-4724-a882-0a49877bee28", "comment": "Malware payload (Amadey)", "value": "764d85846d118db49dcb392bb94f8bdfcdf28f767fa9018fcd95ac44eddabef0d0ce16b542b81caf5275fd9469f0eb7f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163657, "uuid": "c48d92d8-9671-463a-8329-56874548f627", "value": "T170F4124BB6ECD573F8B027B019FA03D316353E606A39D24B638E2D191D762A0A13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163657, "uuid": "aa78b1b6-781b-45ce-8285-f3dc592ed5c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163657, "uuid": "a6a7184c-b0f0-4e73-994c-9465bd2c675a", "value": "12288:gMrhy901Be3fXQLQuyJe4rWUDmbkRkx4IqWdeJGYYojbmQUWNyVk3Qm+k:Ry203/3uyJZDegkzWPTjbmQjyVksk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163657, "uuid": "2f1218c3-e50b-46fd-a297-286640f8eb89", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163657, "uuid": "279ba969-672e-47bf-a77b-f9558e053247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163657, "uuid": "5622322b-fa2c-4ddb-86b8-5de2b0764efd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bce6ec-ab1a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676236650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236650, "uuid": "e5cb42d8-97d9-47c3-add1-19c2826854ad", "comment": "Malware payload", "value": "fbbcff60df5ee01800799b041bfdd845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236650, "uuid": "40979667-8d86-4047-9237-0dd49e9a8da8", "comment": "Malware payload", "value": "6a1905b2b3316d4038c8f66569144ea0309a041cb417bc226cff6070dc836172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236650, "uuid": "323b06a3-9d7a-4847-a916-2ee01a59ea52", "comment": "Malware payload", "value": "a808eab08118fe1921b1683eee5a5b1bbf43fd1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236650, "uuid": "1a282275-082f-447f-9511-8eef7377656f", "comment": "Malware payload", "value": "ea951cd4449e3052c1be4753816e2e2a709e68e09c1eb478a2f1ce30e821590cc3f430df8ad0562f0436f693ec5c542f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236650, "uuid": "f369fcd0-6c94-4307-b8d9-9b2c469e4ce8", "value": "T133F4120BB7ED9012E9B167B028F713C31B317E605B38C2AB634E6D191D72A64A535B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236650, "uuid": "0412f808-aa8b-485b-abf0-dc6020ebe39e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236650, "uuid": "f4c69611-f871-4f56-8e4a-89d22fde4740", "value": "12288:IMr5y909Sg4opaBJ9VMscBkOHtv3dIs6eJU/VOsYCnAxi8hAxXp:ByS+oZRmCvm+UPYC7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676236650, "uuid": "9d7a43e6-6a69-4dce-a3d9-0ebec291a2f8", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676236650, "uuid": "9ae8f187-495e-493b-a964-9ae4a8451eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236650, "uuid": "f3b29de8-7df8-44be-8862-5527061533fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8143a1a-ab24-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676241025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241025, "uuid": "e078e5c7-f45c-41ef-ac1e-1eaad5cc320a", "comment": "Malware payload", "value": "2f7e5d8cd3443e3dd5980d1dfa4c7b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241025, "uuid": "bd0610ac-3e96-4394-ba43-2efbf1aed08e", "comment": "Malware payload", "value": "6a297fa9e371dd75036d9956ef6a85386bc4a3a618824b13aa53698403ac8cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241025, "uuid": "51eccff5-8aed-4e9e-9d41-458918396889", "comment": "Malware payload", "value": "98a7304b4fa0dfbb9df4596ab166b26c1e46e308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241025, "uuid": "9af150c0-6c37-485b-8a7e-1993ca9e32e2", "comment": "Malware payload", "value": "d67484e64fa508b3c262b026acb5610639c4e9e0690c39b742b8551aa83696937966fc8acae0bb5d4ee7229a25d2f3b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241025, "uuid": "cc228a8d-6cc2-4f00-a2fd-13ff7590450f", "value": "T10204E00235A9C072F06785705920E6A0EA7FBD73B7A1C48773880AAE6E733D1DB75356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241025, "uuid": "45c7dcd8-233d-434a-964f-fabc0249ef71", "value": "e846e4e65f8973af5941088654b5219b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241025, "uuid": "689786c2-b0ac-4cf6-9174-555464b89ba4", "value": "3072:LGyZRLA5H72MW9a8sNrAZRXJrkiHTHV92ncsfZ:ZD669a86sHzUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241025, "uuid": "bfaa166d-5eca-48e7-9ec9-90e37194bba2", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241025, "uuid": "7a443461-be0b-4487-b1c2-1afac71114e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241025, "uuid": "b395b651-d111-498b-b9aa-9144b9719138", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1158160b-aaa8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676187434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187434, "uuid": "f9bce26f-1e74-4e44-815c-a7cc4a8f3794", "comment": "Malware payload (RedLineStealer)", "value": "fc45fcb898ce1c7b5354f1e7a33791bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187434, "uuid": "d796fde3-0083-462f-8187-9e13cf17fe13", "comment": "Malware payload (RedLineStealer)", "value": "6a42c68dba0e3b16e8157765c96cc7e76961a69d398a3262c5af3e64765fcbb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187434, "uuid": "29c74888-adbd-4105-8715-2910ea4051e4", "comment": "Malware payload (RedLineStealer)", "value": "296a29992aa6d5c51d4fcdc0454184e5dfae189b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187434, "uuid": "c91cafab-f2a1-4dc9-83a8-9ccdba4837bb", "comment": "Malware payload (RedLineStealer)", "value": "433e731ea38f96362deed4c7682f68c4b43009f16892755fa47b6258dbdb8fdd89f911e17bd5ba575d17f1d67271a6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187434, "uuid": "ac1af364-3d0b-478b-9a46-38755ce941cf", "value": "T1EAF41257FBF98032E5B51B7018F313D31A387D624B74839A234BAC451D72AE166387AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187434, "uuid": "dad4903e-81a2-43c8-932a-7d33ff823841", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187434, "uuid": "a21c3fc7-d69e-4bd9-a8fd-d34bbdeb337d", "value": "12288:LMrey906rVZrZ/BUzN+0XOVQ47RwU9GeJdc1D76Mwm7mwPLgDZYN+SY:ty1VPpg+0iRJdcFmzm7mZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676187434, "uuid": "8587a833-9744-433e-a048-567ed6812369", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676187434, "uuid": "5c1116ec-ca88-4376-b1c0-c1320f42aaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187434, "uuid": "f8e6f358-d084-4f33-ad48-72dc54338088", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fefa66-aab4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676192869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192869, "uuid": "5c8f81bf-114a-4bfb-ae6d-d57197dd9a2c", "comment": "Malware payload (Amadey)", "value": "b18faac0347cfb3eda10f476e8e206cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192869, "uuid": "0928dbc6-df10-43ef-85a1-f094bb341d1c", "comment": "Malware payload (Amadey)", "value": "6a43a789bd5ad146ab5d096a175efe12aa9d9a053c0f3e8ebed19388dfd1bbc9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192869, "uuid": "a38eb9cd-0de9-4635-ae8d-158927caa71e", "comment": "Malware payload (Amadey)", "value": "0978b3482792363d86abda6cb45853afd4e3be5f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192869, "uuid": "28c7c2b0-1e29-4539-908a-c608e35108a3", "comment": "Malware payload (Amadey)", "value": "a59f8f6ebd95a29184fd33f0ea2b411631cdd3488ab8237747c96470688fabc589b15c1946b1edfe23e0babfc7227e0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192869, "uuid": "e848f428-d8a8-4efa-82e1-46e35e6b7e5f", "value": "T1ECF4120BEAF85062F1F057B05CF607D71E35FEA1563982A7235B6C4E09712A0E23876B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192869, "uuid": "7e52aebe-ff30-463e-8b10-922f48805bd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192869, "uuid": "d03445d7-82aa-40f3-9fff-a3b7fe94e726", "value": "12288:mMr+y90A7UYVVzsHRmPPWGyIDJcFF8bxeJpWaX7Uy+oEuko2Nl4Eo:4yz7RVQoPPLyIDJcDM2gyvnzw6Eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676192869, "uuid": "af49a08d-ebb3-42ed-b858-27bbdaa04991", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676192869, "uuid": "57d10806-5ed4-4c3f-98b9-25b82cdeeae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192869, "uuid": "5e15b2fb-f600-462f-b195-5a66bb4b5ed0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eb5d5c-aa8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676175259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175259, "uuid": "996e4350-a1e1-44a7-a589-c1fed8ad336f", "comment": "Malware payload (Smoke Loader)", "value": "0fd72b046995860f4122a5fb74b708af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175259, "uuid": "e3f7a073-5ee1-4d92-9739-22c5a30b02c7", "comment": "Malware payload (Smoke Loader)", "value": "6a70b03b40e70adfb5612dd2f02d82203629c77240dbe0dc67b062f0ba49876d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175259, "uuid": "af2f08c9-ddca-42ca-a4aa-9ef9d9205b8c", "comment": "Malware payload (Smoke Loader)", "value": "71a9317ad601ba74bb4e924ad59072862cf9523f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175259, "uuid": "4a5ca701-fd16-4e81-b241-05105fc82e86", "comment": "Malware payload (Smoke Loader)", "value": "b4df3e6e27aca865308090cafa944819553ad45335f6b7130c7fc1244e39734e2de0c3d840c1eb2a9aeff762e1bd59ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175259, "uuid": "97d1f295-8d1c-4831-a063-b09f5a71a0b9", "value": "T10714DF117AE0B832C69386B12431DAD72A6FBCB55B51C4EB3308325E5E393C29F75366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175259, "uuid": "1b5d204a-702b-4672-967f-f6d02f1d08d4", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175259, "uuid": "708b200f-511b-4784-a80d-a1c278aa11ed", "value": "3072:FjqXy+0Jt6mW5C/y+oPMgE40Ku5tYfaqrITNA8q9Bu2tG:FGCRgIQPMzy22eW7Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676175259, "uuid": "5d4beff4-8bb9-4b9d-a012-b92260415ecd", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676175259, "uuid": "5ee0700a-6028-4c33-874b-24ea5f8609c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175259, "uuid": "ab40567d-057a-49d8-8409-9393c5bad88a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d1c1f6-aabe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676196920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196920, "uuid": "fb9c3572-04d4-4f64-b128-32d29db73110", "comment": "Malware payload (Amadey)", "value": "bb1a56f65a4c30a9f4240035c413ca38", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196920, "uuid": "8d411f4a-c567-4ae9-b37c-d2cc899ecbef", "comment": "Malware payload (Amadey)", "value": "6aab2f470622c9662d136859a4e6a9af9e3dc89cf1ba2a18fc10336d4675b003", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196920, "uuid": "8dccf0ff-dc4e-4ab7-9212-02a0125d5a81", "comment": "Malware payload (Amadey)", "value": "8526b802f114f38fa4b18ef0a3c0b4bfff7646ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196920, "uuid": "8619c52c-89e4-404f-91bd-8edbbe0d79aa", "comment": "Malware payload (Amadey)", "value": "2dc6e82d74513638421a8a02ce045413a5adce398a21b05829cde5caa66ea9b82d614a546034061a02349dfd3160eb2e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196920, "uuid": "459782b3-1b34-4b83-9bd0-7f0bd31372c2", "value": "T1CEF4120BB7FC5022F8B5677019F202C30636BEA05B3C83A6A75EAD591D71671B53632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196920, "uuid": "cc479ffe-5dec-4dbc-9088-4143f58e8147", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196920, "uuid": "92433b35-4baf-44f9-af08-3f898c984d5f", "value": "12288:rMriy90KeM6pmZOpeZ7vCCLCxJMU+CoeJtsoBP57xGtGbxI3zheM1l8bWPb1:JyxrZ6eZ7vC7AU+EyoBytGdOQMT51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676196920, "uuid": "571102e2-48bc-45e4-967d-cf9ec3da647d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676196920, "uuid": "08118091-80ea-4c37-bf56-971066fad9c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196920, "uuid": "da0ab9bc-4388-43b0-b60c-ef62e7702544", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fff21b6-aafe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676224529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224529, "uuid": "58dd29b5-afbd-4b19-8ab4-3fb540a59527", "comment": "Malware payload (RedLineStealer)", "value": "98511088fd9df4449b1b4baf1ffb1020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224529, "uuid": "e928a41d-fee4-468c-8b65-4c7286c89ef6", "comment": "Malware payload (RedLineStealer)", "value": "6b262ba38f3f84729181e45cf5bc8a854ad79a79c6f60237adf8a7ebe8e03b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224529, "uuid": "719d7a53-4d7d-4561-a955-1b4a8f3e1a98", "comment": "Malware payload (RedLineStealer)", "value": "64adaa374a3998dc26070d07846d7c258ad6e4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224529, "uuid": "bed7923e-c600-463b-be0c-20ec9ab53db3", "comment": "Malware payload (RedLineStealer)", "value": "21fefad25a4c33825304f4094f5f3157ba816bf5a108dfff1c0aef9dd7dc381ca57a8d800991933269cdb53ee0d549d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224529, "uuid": "d6761b04-4fd6-4610-8187-81f177adcec9", "value": "T14CF41217B6F89023D9F46B7059F203C3193A7EA05738539F178ADC695C72AA4A3307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224529, "uuid": "6cf00680-dc06-44eb-8ff4-f0f07e541f85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224529, "uuid": "8e5da849-c76f-42b3-84b0-84df863bc6a0", "value": "12288:vMrDy90ug3vVxFaVsF79ZmQzCKHva7eJ13HdDiVslPe3/6XYa8cCsUogcj1:AyHg3vVxFi479ZhrPh1HlPev1OgI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224529, "uuid": "cbce9487-8720-446b-89d7-c1105471a138", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224529, "uuid": "8b07831f-9949-40b4-9090-41283fd549d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224529, "uuid": "538df713-74f1-4745-a50d-5db1a806d21e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63723e37-aaa3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676185424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185424, "uuid": "b7937ab2-a9f2-4ed3-b9b4-7dfc5154354d", "comment": "Malware payload (GCleaner)", "value": "2242ed7e9c784fe5a7f8fa99ddf2a058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185424, "uuid": "b39325b4-6c50-481e-a27b-d5f585c44866", "comment": "Malware payload (GCleaner)", "value": "6b398dfdf074ad8a5cc7ed9cd885c7f0764480dd54f659a96df45e88d9d81415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185424, "uuid": "c1433f34-7419-4268-9f30-ca85d1fbce18", "comment": "Malware payload (GCleaner)", "value": "17dbef78168c721f645b1fe9612005fee89df539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185424, "uuid": "263d57b7-a77a-4585-a5fc-6cbba65631b3", "comment": "Malware payload (GCleaner)", "value": "7cf431bccda451c109e16c64737dd99a791cb3b1e686c3ad3e9eaf7c58c2a517d828447dbf80bd333867629f1228523c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185424, "uuid": "54259ec6-db8c-4efa-b1fd-aa428116f6be", "value": "T132F512BC7104C96DC680BEB4CD3A98E75CE76DD3E8A4A563B0D97F3F41BA1889609107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185424, "uuid": "61b3ce06-5806-41ef-a9d4-f30a72997b77", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185424, "uuid": "9e54dfaa-64b7-4de2-aaa1-7b8c97da3273", "value": "98304:JH8vxkh2EdK7wiCqRx2pCF57YkjGnDsYWC+v2MR:doxO7M7w3qRx2QF50kCQc+vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676185424, "uuid": "418c3798-9c18-4def-8bb6-283f034099c0", "value": 3613478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676185424, "uuid": "47708533-ea7c-40e8-a529-396163acea73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185424, "uuid": "dc9fd774-6056-4495-bd33-2b378bae3eac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935b9b5f-aa74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676165318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165318, "uuid": "8108040e-8fa9-4a02-83a9-90cb888ad217", "comment": "Malware payload (Amadey)", "value": "cc525b525da8f365c6f254b3b017a980", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165318, "uuid": "d6a86397-b3eb-4f0e-82bd-09296674cc84", "comment": "Malware payload (Amadey)", "value": "6cc4aa1b3a647f425f2df60db03c7fd3df8444772675b2e44206626eb8f889d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165318, "uuid": "323bb900-d763-45e7-ab97-4b028b9c597d", "comment": "Malware payload (Amadey)", "value": "f64387bd584a4dac6547cc11087c7c13a49dd02e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165318, "uuid": "2595e53c-eb53-4db4-9525-eee7c2580d8b", "comment": "Malware payload (Amadey)", "value": "40277a1b3d1c71f1ea357568b65a3582de8c15a6c29a9d032755e22395640285c9d607b4d04a6f1b2cb4e39e71b39b16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165318, "uuid": "171a62ff-45d0-4405-838d-8f8176d1ea64", "value": "T130F4120BB7EC5032DCB1977104F613D32A32BE604A38875B238E9C5A1C729B5767676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165318, "uuid": "08202c08-77d7-45d6-aa2d-2f20a5ef14d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165318, "uuid": "92651a56-4b47-4ed1-a220-a914696271f6", "value": "12288:gMrvy90geiIY2gJVSgexcjeXZluRueJmcGPC2JvpGWUA56JHrpuypbr:fyOVbkVdSXPuxE62JvpKEEYypn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676165318, "uuid": "98309beb-971f-4765-be95-bf1f65df3ed0", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676165318, "uuid": "2d5885c0-47b2-4f98-ad92-036d8a0ce995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165318, "uuid": "bd3d21f6-dc61-4884-bfc2-e30e49a02ee0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab628b8e-aa7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676169653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169653, "uuid": "7f954be9-9802-433c-b127-d704c1374b0a", "comment": "Malware payload (Smoke Loader)", "value": "626a364aa01cbf8514bd29e778fac593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169653, "uuid": "e6586954-9ba1-49b8-a50d-728b9b607336", "comment": "Malware payload (Smoke Loader)", "value": "6d02ae22ab4250be30dc1ec8aa21f36018f25c821038d7899d9911ff162b63d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169653, "uuid": "82116ab0-6ba6-45e8-a5ac-12087f07b571", "comment": "Malware payload (Smoke Loader)", "value": "98384c3f8e02f0646e63d873e12d6c63d0309305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169653, "uuid": "8598e82b-334e-4c11-80d8-f8229a42e509", "comment": "Malware payload (Smoke Loader)", "value": "93ed94742c458afb0ce311e5f9cec4529c39c764311fe9c44e2d830e720dbee1feb6b91a8c44fa6c77407ac7b43c18ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169653, "uuid": "a37f9010-d738-4e53-93a3-567aa3c415a7", "value": "T1D914E01136A2C033D2934AB41831CA94AA6FBDB1975AF1DB3349169F1D733D18E3AF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169653, "uuid": "ae5dd2b1-9814-4fa7-a85c-9bf97e1ade25", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169653, "uuid": "3ac3638a-ff22-47a9-88d5-60267b72c23a", "value": "3072:IjqcR+0Jb5i5CFGyvFpfY5vf5K4KXL80iV6mc8g7rfSPi2n1zjntG:IGmR7xDfY9f5K4KXZyvCbSPi2n1zjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169653, "uuid": "fbba4af4-1978-42f2-bfc2-8d124daac6aa", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169653, "uuid": "f09d6992-cc17-46f0-a697-9283b996aea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169653, "uuid": "ab74cb09-e376-49ca-a3fe-93e4212aea87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a07704-ab21-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676239376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239376, "uuid": "ccd9a497-f210-474f-a312-b612d5a96467", "comment": "Malware payload", "value": "5cb1174c302a8bcb8a1e7df41bd2a266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239376, "uuid": "b9dbd2ac-db93-41b1-967e-6ffa754cee5c", "comment": "Malware payload", "value": "6d0ea9e7e52d2d051fb58cf14a365c63277dded2d50d0eb494325cddf9b756ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239376, "uuid": "895887ba-e436-4cee-9ff2-891c9bb780b9", "comment": "Malware payload", "value": "f7bb5e5c7ecd31f49da548cf2f811ccd3d419cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239376, "uuid": "a727f992-b9fa-436b-95a6-108c37404a7e", "comment": "Malware payload", "value": "12c57ad52301850029c6d66f728ffdbdbcb80ba11bd8a7e8181b453f97c5409c3ed53acf0a60fac6474e663627d59e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239376, "uuid": "d1bd95d9-1040-4bba-8986-c66f36c6d85f", "value": "T153F5127C3545C96CD280BEB4C83A98E35CE7AEE3E9E4A15270CD7F3F91792485A1A407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239376, "uuid": "6e338fce-04de-4b11-ac54-51ba48585f71", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239376, "uuid": "0148dfcc-b166-41fe-a030-ddd72e039d58", "value": "49152:rdHTd/RXN608y1LHmcwjMWDsLUyHyhVV2JuIe38tb/8MjwAaIabLCgv2MR:JHTdq/y1LHmcUMWAlSLc1BtrEvLPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676239376, "uuid": "3988065a-e4ea-477e-900f-578c0d6741f4", "value": 3445423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676239376, "uuid": "702cfb2a-123d-4dee-a1e5-714a8a188118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239376, "uuid": "fa320c37-c348-4339-a910-cac120ff486b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f78358-ab2e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244967, "uuid": "c17d6c36-5c89-42b2-80a3-ddbf24c7cf5f", "comment": "Malware payload (Mirai)", "value": "70e4732cdcd6df53a0c4058e86d3b370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244967, "uuid": "e55f2bb3-d48b-4f50-ae8a-bc0d212ba108", "comment": "Malware payload (Mirai)", "value": "6d5d2e4174e24ab15969dc1f3f21526d1e73c2e18ff6d20cbbb39af2c32e346c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244967, "uuid": "c4bccdb7-01ab-4ca1-930f-2d31ec972141", "comment": "Malware payload (Mirai)", "value": "e723a540166380646b65bb0dc0063578fb749f81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244967, "uuid": "749a566d-749a-4b7f-89fe-4c7e6554b819", "comment": "Malware payload (Mirai)", "value": "f3ad8b79fee3a7b6da939ae545ec9f116b9b86d8e5e55abb26783a5fb76ad8d85e247b1659385f55c9dd19183360fed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244967, "uuid": "c180719a-46ad-49c0-8767-22b00ffe21bb", "value": "T16F430121C15AC272C9F2723C50AD8343BD991FB1DDEB2601262B874F3EC3562D7629E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244967, "uuid": "16ebe023-123e-4bd9-95c7-87df00f3265b", "value": "768:W6Q6lz7tJXart4n2acSTOkHAtR+TTavfz+lF77Fiq3UIG8BVp/CEmVhGivouUGqi:W6Q6hjah4nHM+mWTavIpl5FzAhGiAuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244967, "uuid": "e8f644e0-1497-48b8-895a-2b12819b15c8", "value": 57892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244967, "uuid": "56ff80c6-5ccc-4b65-b711-791234f36c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244967, "uuid": "3e134fdd-89fc-4c41-9379-f3d5d06d4923", "value": "70e4732cdcd6df53a0c4058e86d3b370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a235cce-aaf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676221862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221862, "uuid": "0d4659e6-b368-4b01-bedb-226bf0c5deb0", "comment": "Malware payload (Quakbot)", "value": "9e3c68b86ee0073c79c93221b8a919ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221862, "uuid": "5f91ee2f-6a68-49dc-8de8-937d2f03d30d", "comment": "Malware payload (Quakbot)", "value": "6e30dc6403253650fd131d9c60db92680d319624c16aeb9e7aea4bdfc3c47a77", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221862, "uuid": "65cfdf2a-f29d-4635-b71c-8a7e78025265", "comment": "Malware payload (Quakbot)", "value": "f23042424feb136ee6c966f4b4556a3172ccd32b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221862, "uuid": "fd1d7d8e-3aa9-4d3e-9d14-4602c852ad3b", "comment": "Malware payload (Quakbot)", "value": "a8fbdcc970724e17bcea410fb499b4c73993f621915bc76b043c3b08f41f436a2e0a93d0c03cd6247e798f3992e2aa57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221862, "uuid": "bdcd83c0-82db-43ac-8cb4-13bf89a319c1", "value": "T166E39F52A55180F2CF36053891FE9F2E9BBE751007A268C7B7D8AE9129605C3D73B2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221862, "uuid": "205659b7-437a-4756-a175-fada67ba99ac", "value": "1bd51003f5494b32d39257bf6bbbb175", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221862, "uuid": "7c38eb85-7022-46fa-9fe7-e9bdd07d0ab1", "value": "3072:hKUR+AIznCp7BQCrZJzSWjsdA0Jl0nL8TBfPhg/q:hbIznCVKCtcWjs+0J6nL8TBHhg/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221862, "uuid": "1536d699-582b-4dac-8c64-1899b8dae7a4", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221862, "uuid": "6b9d070e-8313-42a8-ae95-09e8559855c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221862, "uuid": "6a045344-ccdd-4a8a-b239-97c7bf0968f4", "value": "qakbot_unpacked.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ebee7d-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231755, "uuid": "d545f5c1-661c-4ad3-baf6-028257fc2e95", "comment": "Malware payload (Mirai)", "value": "bf2366382703c7f31b0c1b139acb44a2", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231755, "uuid": "d3aef3f4-0a4f-4727-9242-4bc0122f6e27", "comment": "Malware payload (Mirai)", "value": "6ff4c0ab17979b860cfb5cba854a5243095c70258077389bf0fd98c649ecd8c0", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231755, "uuid": "b540a002-94bc-4103-a018-f9499bc2b076", "comment": "Malware payload (Mirai)", "value": "ce75b8ed483421c0100a35eb65e8715922e666a6", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231755, "uuid": "e87a2be2-5384-4169-8a78-32b89b4f4713", "comment": "Malware payload (Mirai)", "value": "97a234d91035b7a6c3a17fe5c53e547e8f328a5c9224f22b8567c00f1150b4026ef5048649c867164359706ac043631f", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231755, "uuid": "d1d5e77d-868f-4e88-93bb-e55268268301", "value": "T12833F17B022284C7E9B219F4A0D86F954FF55BA285C2DEC7581AEB52CD840647D02FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231755, "uuid": "451764d1-d100-4195-b3be-7a927581a21f", "value": "768:MuV9nTHUq18VJINWBKM6Y22qBpGziU/bovMmr7knZJgGlzDpbuR1JH:3T0qSJINpGdqBpGzim0vcLVJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231755, "uuid": "e2e2a45e-d3c3-4233-99ba-352ff9ba58fb", "value": 50448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231755, "uuid": "e92b95e3-cbb3-496d-8143-6b3c71e4e216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231755, "uuid": "a2f8a8b9-cddc-4585-a414-dbe31a2ac32b", "value": "log21.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d6e7fa-aa6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676160814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160814, "uuid": "c463fd91-237f-4190-8150-37ad932f897b", "comment": "Malware payload (Smoke Loader)", "value": "cd3b4edcf6f438ca20c84b509e0de2ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160814, "uuid": "df90d2ec-bf70-4cb9-b9b4-99c920e6252b", "comment": "Malware payload (Smoke Loader)", "value": "705770f54ef72d3b2d8b44b8f0e062a6769eaf121527da31f0fa0c9c178ede2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160814, "uuid": "7f5629f7-b9bb-4387-91b5-fe7353aaefde", "comment": "Malware payload (Smoke Loader)", "value": "257be767ca06292531debb92c6b2476aadbbf8ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160814, "uuid": "f1e5a4ab-08a8-4a80-a00a-3e4b755476ad", "comment": "Malware payload (Smoke Loader)", "value": "5a71d0b6671b6f31f37a06706394fe2dcb4d1193407580969b04e5e7ca364275d6d983ddf7fe5ccbf4a20152aa92cf25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160814, "uuid": "e40582d9-af44-4fd7-9c49-f73f2c4f53f4", "value": "T1F814CF0536B18072D57346B52A329A952B6FBCB15764C2CF3308D66F4F313C29E7A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160814, "uuid": "2d3ad17e-d0a9-43e5-8380-7a2fb64cad14", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160814, "uuid": "0f0aac82-a107-474d-b10b-b7df1df78e10", "value": "3072:1jqx5+0JT5K5Cb52jcUUpAI/Mx0EIAET3R4oBpMNjoEnXLtG:1GrRTbAjkEIAEThB3MNjBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676160814, "uuid": "e0cb6466-e844-42eb-b60a-d4ae71e3aea1", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676160814, "uuid": "d4b41982-4dfb-425f-8c82-e07ec19ed052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160814, "uuid": "13d05726-e93e-4543-a717-495663f41e34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cbf069-ab0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676230708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230708, "uuid": "11cb2fec-1343-4f6f-8c75-18bbd0e9b5f9", "comment": "Malware payload", "value": "df9095938de30fac76ed7f593991dfcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230708, "uuid": "d3ac7e3a-cc16-4746-9ad2-1b4b9290aad2", "comment": "Malware payload", "value": "70adbbb35fcca77001b44e89ed90ac8d841b0ef3e4be6bff7e4b8e618a57e224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230708, "uuid": "860df1b2-ed35-4292-ad24-cb02046392c2", "comment": "Malware payload", "value": "3a63b9c91cc0c139fca0f383be7fa8b3f7cb9d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230708, "uuid": "e29c8908-20ba-4737-8fff-131ee1afb33c", "comment": "Malware payload", "value": "27eba697fca7e0943afe879ac1e8ee58bb1bc07226018fb79f1f98edfe74550b622ec7ed1388e23fc06099dc88783bfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230708, "uuid": "bd719657-5f5f-406d-9b37-ced7a9ed5aa8", "value": "T19F14DF81BDA080F2F45749755421DEA4AAEFB8B167A1C0C723C8576F0E317E25E7E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230708, "uuid": "4f389662-8985-4b81-83e3-24fa69623c7e", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230708, "uuid": "814bda4b-ec53-4eb1-a0fd-54323ef91809", "value": "3072:j7fY6+HyU56a4yRHiobT56/poiGb+gR5x5t/dgU+rtHQscD:f7Coa4yRRhWdo+gRbz/dg5wsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676230708, "uuid": "b6e68933-5f38-4adf-a77c-41f06debd0fc", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676230708, "uuid": "b1adc317-ac79-42d3-a342-3819960fb543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230708, "uuid": "83067da7-a05c-4fbf-8a71-a7f80d008d08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1b0efb-ab2d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244732, "uuid": "70293270-5e73-4314-a28b-30142adf7f3f", "comment": "Malware payload", "value": "77902140cfa68240af210030b0ce7ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244732, "uuid": "f782e623-1960-449e-a30c-c8065f4f8eb7", "comment": "Malware payload", "value": "717c638409497e57f9637a28ab443d5316dbf3b4170e7fbe5268e8257e696380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244732, "uuid": "a21196cd-0b76-4c0b-8677-12761f828553", "comment": "Malware payload", "value": "b1b1fa52fded3eb4786105d5b733eba83f85671d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244732, "uuid": "02c09b57-72e8-457d-9e30-17c4282efb94", "comment": "Malware payload", "value": "7f939f77fb280ce6beef6b25ab0332e82f09ea9b559d1e605b48c48bd68169d6565e629842a151d8df148277a25d5bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244732, "uuid": "53a1a1ca-8c4a-42c8-8d97-bcce46c791eb", "value": "T142E48D017702D13EE8F711B68DBDA66EA12EF661071615C3A3C81A6E4F65AF23E31077", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244732, "uuid": "a9ba4e65-450c-4658-8b91-a68b3489100e", "value": "5ccee8073802408b5004adf1c6169d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244732, "uuid": "ed6da752-2c76-4762-b57d-5668760e350f", "value": "12288:OuLZD27Y3kjEUwtkusGmW/LhkylgLVdlhMoxhCYem+yQHZTSEDVY+8:52E3kjwZn/LGqghdlKo6YemB8tp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244732, "uuid": "0639b366-8729-47eb-acc3-584c90085f3f", "value": 707792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244732, "uuid": "c3769115-1937-49f4-8a6c-f78f7a9bc47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244732, "uuid": "01e3caba-718c-45e0-b640-25375b8b99d5", "value": "SecuriteInfo.com.Riskware.HotDownloads.AB.8941.23555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69035ca8-aae2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676212491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212491, "uuid": "c627dcd9-fe15-4c3c-a650-6b846fe07743", "comment": "Malware payload (AveMariaRAT)", "value": "379d19e542b906f722b3eaf389cf494d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212491, "uuid": "ffbec686-35fd-4dfc-ad73-d845f9ff8322", "comment": "Malware payload (AveMariaRAT)", "value": "723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212491, "uuid": "f219eac6-9cfc-411c-9763-49d44ef64e2c", "comment": "Malware payload (AveMariaRAT)", "value": "50de550e205b82e095610e9f552e8bc46f3e16e6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212491, "uuid": "7e77e5d4-f122-42a8-b7d4-3d32ea4345b7", "comment": "Malware payload (AveMariaRAT)", "value": "00f23a85b6012075fe062af90f6524867d4c9046d5dc76f4ca0bf3ec8bcc9f6ee8a1ac2c7b64681d993b2582ef8d6c04", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212491, "uuid": "72d37ee0-ecd4-4d41-8f2b-0709bb04444b", "value": "T16794F1947AA16447D89ABBB55AB7F33C9136AB543A8707077331372D2F32794BE402C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212491, "uuid": "0346d24e-3215-476e-a79c-3b308fcd0160", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212491, "uuid": "eee4d870-d4f1-4344-ab1f-bacff49e47c4", "value": "12288:G/ROa54qs5gy35edFxF1/uz64GIxSvYHV:65fZyEFFsz64GRv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212491, "uuid": "26cf49f8-df9a-4dcd-91c4-d018dfc2076b", "value": 434032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212491, "uuid": "0f8ef330-1a6c-443c-91f7-823df993d771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212491, "uuid": "404eebae-c3c5-4e3d-bbff-d2e7afa2242f", "value": "TNT Import Invoice 11-02-23\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381b01dc-ab2d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244622, "uuid": "86f5cef7-545c-4fe3-80ae-4b9b93aba42e", "comment": "Malware payload", "value": "5306b108f5e2cd16181523e42df08d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244622, "uuid": "b64c0f30-c930-40ba-b4e2-8a9f3899e6c2", "comment": "Malware payload", "value": "72dfb0952a60b5c403b5ec622be4407459a6d64f60453cc7d8059dc4a5af0f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244622, "uuid": "dbb8667f-c548-439b-8c2a-1cc652d5231a", "comment": "Malware payload", "value": "e29b27aadab3d4263cb24308b829be02eee47bdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244622, "uuid": "c7fd30f9-5327-4b11-968b-5b0ff22635a9", "comment": "Malware payload", "value": "9e8ed849aa265bf05e64f32d45713f33100a16482d0d34ffd420bc612b54b8a029fbb846b3f14dc1206f8b25dae764ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244622, "uuid": "7b8cdc4c-5f2f-4561-88ce-b3e2bb678b01", "value": "T1F3F4124BFBED9162EDB0677005F313C3273BBD515A78926B228E6D290C72A60B134767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244622, "uuid": "535a2234-5b2e-4eb7-852b-7c4a321e6f64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244622, "uuid": "7b2734d6-f951-44b0-a7ca-4f9a48d7d733", "value": "12288:9MrJy90dVZFLU9JncrbNaPCmxeJmpdPkuCmjhR0rXkoEUxM473I:Qy+VY7MxrBuZSTFHbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244622, "uuid": "382031ca-b1a6-4c07-9b7a-373af371b990", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244622, "uuid": "cb068889-0d7c-4835-98ab-950f3129f8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244622, "uuid": "fbae9d95-9042-4374-a857-d35c2cb9ea12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d328d5da-aaa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676186470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186470, "uuid": "7b699b12-90a5-4ffc-a4aa-5d236d0a75f2", "comment": "Malware payload (RedLineStealer)", "value": "3032b5b0c7e4144919c8edf320386196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186470, "uuid": "5f24d192-fdd4-4938-9fce-d74099cf791e", "comment": "Malware payload (RedLineStealer)", "value": "73238183bf04b267a71bb8411d73db2245aa4e845c83befe06674a87ce2cd1fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186470, "uuid": "71a8491e-4be6-4ee0-a2a7-014df70d348c", "comment": "Malware payload (RedLineStealer)", "value": "cba74f99c8a31a820640b0265787b3b94b283dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186470, "uuid": "94b8d45c-f918-4516-bae0-3e5e1725ea26", "comment": "Malware payload (RedLineStealer)", "value": "992dd3c783c1604b0238daea06ed9e8ec210cff05c98420695e0d5394017be8a52634e69a171628935c3a0703f7f1065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186470, "uuid": "449f374b-c81e-4243-9e8b-50c7b334a7e5", "value": "T15DF4125BA7FC9530F8F1237119F613C31A367E604A79828B675B6D0A1D73290A6703BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186470, "uuid": "d397f9bf-af24-457c-a6e8-f863323eb61e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186470, "uuid": "b6101966-a9b5-485f-a6e0-b482c0914f97", "value": "12288:3MrUy90YEI/gZ+qsiofoe4M+edueJpXH6vsm7FwPlnUXo:7yeIYciofoed+gpXavsm7FqKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186470, "uuid": "09bc5ad3-64c2-48fb-a0f6-650bd7c10c48", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186470, "uuid": "d2d60df2-1991-4694-9219-a760f49f2660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186470, "uuid": "4b9086ea-221e-4992-9ce1-fb2053cd7699", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369007dd-aa99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676181054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181054, "uuid": "7040b709-ddec-4fbf-a96c-01457b1fe7dc", "comment": "Malware payload (Amadey)", "value": "20ce5afb86aca28c43de4e42e8c14981", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181054, "uuid": "560d7148-92de-4d93-b722-7b41e73e419e", "comment": "Malware payload (Amadey)", "value": "7324e8042afeb9cc2627b8a020dc01ff546e0071b0abbc41ca79b184cf3d7ef0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181054, "uuid": "840bb95d-c642-4cd4-8184-a2e8d94e0136", "comment": "Malware payload (Amadey)", "value": "be7cc808947a1486631c16c0610ee614bf490317", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181054, "uuid": "82d8ce79-153b-47a6-951a-3ce90f3f321a", "comment": "Malware payload (Amadey)", "value": "c019287f4ab99d842386a0b63fc66af3c84ea351cc9f8a67e9bfeb62299f7daa78682140259ab25e0be7c9717cf6de73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181054, "uuid": "a5bbcc2e-f567-4aeb-bbf1-e8bae16ccb4c", "value": "T1B4F41243ABE8A473E4F417B01DF503C31A31BD51563447AF238F6E1A0CB2AA4A679767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181054, "uuid": "87da14b4-8826-4849-927c-9b183aee8f0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181054, "uuid": "f915b7d8-6646-4b1b-9d46-fca11ad5d671", "value": "12288:/Mr+y90EjUcc9B/h7iflljT1eJTcnWdQyiBmp7hOs3EGvShT:1y5jUb79YITCWdQGp7huT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181054, "uuid": "1f89afaa-6d12-479b-9412-d3bdd112fb86", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181054, "uuid": "02119e3e-910e-415f-b356-e8a4ecd3d148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181054, "uuid": "4a6aa13f-ad12-4af1-9803-60ca2517fe7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6517e7d4-aa8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676175119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175119, "uuid": "49710c57-9161-4db8-9a71-8d913f3e4dac", "comment": "Malware payload (Amadey)", "value": "b9852314865684c4047e5536c3ec3b24", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175119, "uuid": "22d935dd-58f2-4109-88bb-521e0bc4dff2", "comment": "Malware payload (Amadey)", "value": "73ca902ca390698e26ed8e089bcc2c82cc4ac28a0b4ed5dc3673938de4849720", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175119, "uuid": "a13fb2fb-cd08-4f45-bdc0-d369490eacaa", "comment": "Malware payload (Amadey)", "value": "2d4ee3f0e9fe03816b5607f4f52b79f8aaa25988", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175119, "uuid": "775d4410-a759-4b19-b4d0-9c489b025b37", "comment": "Malware payload (Amadey)", "value": "702dcb6bc4203f9004669c11e4038072f857ce4769a3626c5b6b368c223a790f80608b5113955dd44027e57ca7c0cdb0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175119, "uuid": "2c6eb6e3-f3ca-4788-9782-dfdd0617c00a", "value": "T1ECF4124BEAE88072D8F4677019F603D31B357D909B349357234EAC6A1C726B1B6347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175119, "uuid": "32a06f0d-95e7-45c8-b85c-00611a1a2976", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175119, "uuid": "ca0a6ac0-df37-48dc-83c8-24b6e0782321", "value": "12288:wMr9y90ix7YCuCTr6KEs3lueJxulOGXG4yLYSTe+CBfV86+A:dy3YCuCTrz3hx4OQ2LY0hCBf8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676175119, "uuid": "f9412ce6-8ce0-4aa4-937a-aa21f308e954", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676175119, "uuid": "114449bb-a874-45ea-aa0a-290dbb9d4417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175119, "uuid": "93fac7e8-e9c1-45d5-a0ae-6cfb5f09f49f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e9b7aa-aa9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676183495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183495, "uuid": "2168cee5-b9b6-4b4f-aa79-b924cbc55e4b", "comment": "Malware payload (Amadey)", "value": "e9969a1a711080596bac75a484bacfa6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183495, "uuid": "36aa6d7d-e69e-4a5d-a384-692449ffbf1c", "comment": "Malware payload (Amadey)", "value": "75579c7f14276138573d69a97a35a954ff00b925dd78c0cd75f12193606208d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183495, "uuid": "62606bc6-b374-4389-b913-822c014ead76", "comment": "Malware payload (Amadey)", "value": "09894b7b647a95a01386963d3accbf84f55d0648", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183495, "uuid": "40b0efb7-627b-494c-801a-54dc17931b99", "comment": "Malware payload (Amadey)", "value": "8f886dfe1023fd9add79fcccf06fccc222e0c15ced5d1e1a80b4f730982663aba3aff44119995fa809fd8281c7eef907", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183495, "uuid": "3600691a-14d0-4442-9b0a-e74e383e7940", "value": "T119F41207E6FC9032E671277049F203D32636BD6069789367638FAD195C32AB5A13973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183495, "uuid": "21aa8800-4de4-4508-9d92-cd4474d3c402", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183495, "uuid": "3d2b6d63-be7c-44e0-ace7-645f6bffc6e1", "value": "12288:VMr2y907ERfTRxdeOInHYu/Qp0Q3gCsdeJmZjNeM49EX3OSx1/Nl+DP:nyuERfTlXInJ4FtPCkM49EX3OW/+DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676183495, "uuid": "0966e137-c717-4c16-a750-deefe3d5dd84", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676183495, "uuid": "369e609b-45d1-4a15-a259-922206aade72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183495, "uuid": "8279a730-3615-418c-b068-81933708d769", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e22044-aa70-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676163651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163651, "uuid": "9ce8fe6f-e2ce-4413-b093-a583b6d2a384", "comment": "Malware payload (TeamBot)", "value": "71f1efa336374447d14ecf8e321207ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163651, "uuid": "d15ecaac-be49-4326-a268-f722e0d88045", "comment": "Malware payload (TeamBot)", "value": "762ad375d3bf33744e96b3dfc4a7d0fdcd88b4917cd96f89d89dec8c95b2a643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163651, "uuid": "13f014aa-9485-4649-892d-a15a11343190", "comment": "Malware payload (TeamBot)", "value": "f240bfde4cfdc3022f20a73e7fe7ba374a7710a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163651, "uuid": "abc17db1-5caf-4a42-990d-8b2e13629285", "comment": "Malware payload (TeamBot)", "value": "89a9b96dfc3209902caf5fa31363af66e700dc18789542475c5600ff6b8d33dfbd49fae49f0b3e1839fc35af3c95c96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163651, "uuid": "bc0eb7e2-b413-4019-a0d7-147f9ac82931", "value": "T1BA14CF1336E19073D4634AB02D31DAB56A6FBCB99BA5C1DB3308069F1E313D18E7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163651, "uuid": "daa56f1e-3a71-4eb2-973c-bcf960b7cd11", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163651, "uuid": "84b04799-723b-44a6-b1cf-42368dbf7a2c", "value": "3072:hjq5y+0JXwEi5C9wTW9Ez1tyx/8TmqkjNunZM2eVdtG:hGkRToW9Ebg8Too3eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163651, "uuid": "b3e2c021-7919-4f3d-bcfe-f83cf7de48bb", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163651, "uuid": "8077374e-7c00-464c-9a49-59c949b8adcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163651, "uuid": "a55a2762-881f-40de-96a9-8139e79e4087", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadbbbb1-aa68-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676160257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160257, "uuid": "8dad8aa8-bea8-4920-b7e1-1bf7d4b27a93", "comment": "Malware payload (GCleaner)", "value": "dff93f6200cde2c67eb0e997c9474831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160257, "uuid": "eaaf0b96-1736-4d1e-bf7f-5ad41751e7fa", "comment": "Malware payload (GCleaner)", "value": "7668c06b97e2eee713d77c992670e4157be85db1f3903fb3685d5fffc4509c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160257, "uuid": "d848d733-f3c0-47a1-b551-eb1c8474086c", "comment": "Malware payload (GCleaner)", "value": "e03999037bc74520393abd1168ef6818635abf82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160257, "uuid": "57812cfe-90a9-4407-81fe-c9770a851584", "comment": "Malware payload (GCleaner)", "value": "93960fbbd699685d110a7e65a4863049ea8832ebd6fd4b0bef224bba46a8c5a5d26aeedfd96bca774b6b02d79bf3eb68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160257, "uuid": "38cf409f-b759-40f6-b359-ae7a24b07308", "value": "T1A9B5127D7554C86DD280FEB4883AC4E75CEA2DE3E9E4A42270D9BF3F42792845A0E117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160257, "uuid": "788cce64-13c5-492f-881b-4f097adbb967", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160257, "uuid": "9ad19f54-06ba-4ddd-aec1-15dcfed92f09", "value": "49152:rdHKUYNikaMgA7wHgQB5868jzXcLLCgv2MR:JHKPbggwHt8BXAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676160257, "uuid": "b6bfaaa4-b776-4d24-86d4-822dee03f9f2", "value": 2455197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676160257, "uuid": "0d2fb86e-c90d-4aae-a420-a12e367228ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160257, "uuid": "6e6468ed-4bd8-48b0-8028-a4c9d4a85502", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b194e287-aad5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676207030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207030, "uuid": "c0fcb0fd-47cd-4cd9-8184-b653d8427a0e", "comment": "Malware payload (GCleaner)", "value": "c9cb5cf4b05a3f2526a7922feefae207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207030, "uuid": "5a609b31-29ee-4e68-9ec4-6c1c7e19f23d", "comment": "Malware payload (GCleaner)", "value": "76aca6e8127c61c9c25921793c5be2b55132532e87a3b2822ebaebf342fe99fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207030, "uuid": "ad669f98-72d9-4a61-9803-1a0feec6d587", "comment": "Malware payload (GCleaner)", "value": "d9300522dff9fc4f180106c89f32c77805506c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207030, "uuid": "be0979c0-af8b-4488-8ac7-7961900814ab", "comment": "Malware payload (GCleaner)", "value": "a745ddbe37c37968641cf92ba2998922d6e7c2e7adcaffd5a36de2addba82a28fe0573b391497896e42ffcc714488a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207030, "uuid": "72501109-5987-4763-bdc3-de6b311e00f8", "value": "T1F7F522BDB040D86DC280FE748839D4E75CDA6EE3E990946270E97F3F95792899B0D603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207030, "uuid": "af1d9847-0996-436b-ac1a-5a62657f3d70", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207030, "uuid": "b360e9d7-a1ba-4b15-8e2e-526999084e22", "value": "49152:rdH5bPYP0ADYetBHe/noL0gBgjFTnWDQWNdKLb9lT//cj+2t9ZaUXA64zQNemye4:JH5OBmoL0yQ0Ub9lKZtszQNc9tv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207030, "uuid": "53690f6b-b644-4ac7-a8fb-4fcf91a65e38", "value": 3576876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207030, "uuid": "43bba262-ee1c-4463-8c7a-fd5b497f87ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207030, "uuid": "850e18e4-40c6-44b9-b856-20ed49275756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca9194a-aae0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676211719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211719, "uuid": "5c6898df-59be-4004-b7f3-a037ab2860fd", "comment": "Malware payload (AsyncRAT)", "value": "93713221ec3d756d1091b3a05d489ef8", "object_relation": "md5", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211719, "uuid": "0938a471-1845-4db3-b9ef-2dabca6edd12", "comment": "Malware payload (AsyncRAT)", "value": "76e50a76cc320a29117e8466db4f31ba6f04510f07811536654e5316ace67b2d", "object_relation": "sha256", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211719, "uuid": "c9dd685f-f442-46f0-a1b6-60bc56f4a5ba", "comment": "Malware payload (AsyncRAT)", "value": "1314a70eea9319ac8658b2047648c2093307fc5b", "object_relation": "sha1", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211719, "uuid": "38997dd7-840b-4881-8c85-bf6b72e44a61", "comment": "Malware payload (AsyncRAT)", "value": "d29a8d0025caebe8d9a429e331e9c44c04513a34526d9051880fd3df3357e3bae11bbe05a9b289f9f60d895b60ae277d", "object_relation": "sha3-384", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211719, "uuid": "cf778fab-6bdb-451d-b4b7-2cf09e1bfb4e", "value": "T11C020021C66FBEE7122930B73518E87621D4160E79651CD4BDCD2072372D21CCEA75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211719, "uuid": "0299454b-d2db-4bfd-8dc1-29cf8111f786", "value": "12:4XF1YOUhNJeyM121Evnps8Cnon1YVkVfNb5j0BbRZBbwGk3:4XFSZXe8EvpsheaOVfsBbRZBbC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211719, "uuid": "67898ee4-458a-4de0-9748-b963f00bf08d", "value": 8777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211719, "uuid": "78780158-db52-4239-a254-028ec85a4b56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211719, "uuid": "ba91bf54-dc92-459b-a184-8d841499d156", "value": "BNB_Beacon Chain.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e6f20a-aabe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676197046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197046, "uuid": "56b3a060-9f2e-495e-851b-5779857fed73", "comment": "Malware payload (GCleaner)", "value": "8af261160bdb20debed436156e84514c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197046, "uuid": "8d30087a-3453-44fa-83fb-eb17ab045b7f", "comment": "Malware payload (GCleaner)", "value": "78386b15f6ba6269ff168cc48ab672d812b52edcdee8a01744b6f8412028d2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197046, "uuid": "34e1bc56-e4a3-4c92-89cd-ecfee2b506c4", "comment": "Malware payload (GCleaner)", "value": "bc8c58baa709965e75ed440e70e55dd0faeaeb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197046, "uuid": "9665c184-9de1-4c33-9a0b-e9d359c9378b", "comment": "Malware payload (GCleaner)", "value": "4be888e40258b974a3820dfdf626d344ecb61b42a600775504cf5db16f0a0c939a5840be00e4c9e2081766756f69623e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197046, "uuid": "ee724716-5a3e-414c-b08c-b6604456daa6", "value": "T1A5F5127CB115C8ADC2C0BEB48C2698E35CD76EE3E994E46270CD7F3F55B92849A09607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197046, "uuid": "87911573-4bd0-4a1f-adeb-69be573d1a1a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197046, "uuid": "71cb2f37-123e-48ee-b0eb-6ec2cfe6d857", "value": "98304:JHfiYzRn/Etd04Ppp06lkgJ3BqSu269Vxw3+v2MR:dfiY1ncb1qla3Vr69PwOvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197046, "uuid": "83b54855-cad1-4c76-aa56-83badb0a25b5", "value": 3436275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197046, "uuid": "c800a74f-9687-4449-a96a-a147456a00ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197046, "uuid": "80e08c9b-72c8-47c9-a907-91dc0d33275e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1b9fbc-aa7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676168851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168851, "uuid": "f5f89738-d4d2-4b28-ae3a-ebdf347a0e74", "comment": "Malware payload (RedLineStealer)", "value": "2613dc4a9fcdcb3c28ed2b6bf7a20543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168851, "uuid": "282e9d02-5102-4240-8b91-cdddc0e00ea2", "comment": "Malware payload (RedLineStealer)", "value": "786529a35eda832e060abba4d564a9c4800990550c069debe5cde64428f06c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168851, "uuid": "685ecc8c-5262-4825-9a23-265b1086325c", "comment": "Malware payload (RedLineStealer)", "value": "4dd15fc38b219826d202b5c4bc329be8f932ad5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168851, "uuid": "2d75821b-3485-4abd-a195-1ef8fa456a38", "comment": "Malware payload (RedLineStealer)", "value": "0e52fc4cc2e8cbfca8c7b15df82c2dd3a73809add96334d22f8ed4681a269283f9777ff9d49108b2fd4e3308aab920b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168851, "uuid": "4598a891-2c32-4132-8d45-a62d0a6ac934", "value": "T1FDF4120BF7F99022EDB127B008F713C31A3ABD615A39825B225EAC995C327B47075767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168851, "uuid": "8fc237bc-706a-4f0d-af32-e3967c16c689", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168851, "uuid": "2fbc5854-ed0d-49cf-9ff6-d970d0dd4c57", "value": "12288:TMrVy90LyWlzghPoqwoKK0E8gh8RsY8eJfTT/YzUskFjPGsKdp68ZQDz5KznW:eyZDhPVwoKK0EDfwfvlsSFoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168851, "uuid": "1bc049aa-706f-4110-a143-cba0b67542d9", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168851, "uuid": "2ccd7b60-632a-4dc8-b7d0-524641c3f140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168851, "uuid": "3a4d13cd-c0d3-4937-9a8f-0063b50b9777", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939c0dcb-ab19-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676236185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236185, "uuid": "e1e53c98-cd41-4f31-9b69-16f39b031c11", "comment": "Malware payload", "value": "8b5405328e3dddd242e2155b43546b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236185, "uuid": "e85b309a-ca41-4fcc-87d2-caf4e71b89ce", "comment": "Malware payload", "value": "78ec40259be97c35f66cc10fee0ccca650ecb71bb67a94a2c8db3c25914ae73e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236185, "uuid": "c3c21d28-1178-48b2-9037-050d2da7e5bf", "comment": "Malware payload", "value": "eb44f204ce343d53df5a6cbb7a31d741190f7f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236185, "uuid": "67284e3f-0012-4c70-a15c-af0679e60562", "comment": "Malware payload", "value": "8e72661ecd37c7ec5a0587369710933ebe3a3091fee4484764d85fc04cbe0f957d06396405443652775727e24a0f15ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236185, "uuid": "0e30f057-67ea-40a4-abd6-2fd7d2415903", "value": "T17EF4120BF7EC9022E5B5177068F213E30A31BE915F39879A638EBC1548325F2A53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236185, "uuid": "417c4f25-c85a-4b85-be6e-210d7c268c58", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236185, "uuid": "0e0f49b7-2f0d-4166-a369-385e91c26a01", "value": "12288:qMr7y909T0VZ0ON5Tz3dOs5nBeJao4cs5hc2iK/PCnnoqQN+:ZyzVi6n3pQaom5O2iK/PCSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676236185, "uuid": "4af1df33-2edd-4523-9bba-ec7bbf657c4c", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676236185, "uuid": "99ba97bf-4c78-4612-8ab3-1eb154bd170c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236185, "uuid": "5f940e3e-9c7f-4bc5-b6f9-21741c7b1c71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d1f7de-aa8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676174553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174553, "uuid": "0b4b3d66-9d0c-4173-beec-5e3280d7fe7e", "comment": "Malware payload (RedLineStealer)", "value": "5e2cefcd287e9d7d99d7a421d11b6f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174553, "uuid": "75ec1c89-08f5-424c-8012-d19e68504123", "comment": "Malware payload (RedLineStealer)", "value": "78fe0ee9f7f88a0ede608a6750d73e983fc345fd05cd16aa1f3c58674f53ec3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174553, "uuid": "f0554658-261e-4eb7-ad68-bc660b6c54fe", "comment": "Malware payload (RedLineStealer)", "value": "6cced19f1686eed9af475f31bb697a7bf1bede29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174553, "uuid": "480839bb-6a8d-44e0-adc1-3c9eb1415837", "comment": "Malware payload (RedLineStealer)", "value": "45e91d6e34d7ea67a8cb9be76f0a171d8c75159420fb28e25afb4cd8a2d64ce6dc79e745b9c1658353d3296384e491b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174553, "uuid": "fdbe7f4b-9ab0-40a1-bed6-7b175f7dc5ef", "value": "T1B354F1113AB18073D79385B16921DEB5B93FBCB587B181DB3318026F1D313D25ABA366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174553, "uuid": "32643e1a-3d90-43f1-aad9-17a88eced71b", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174553, "uuid": "69badecb-cbd1-4ce1-993d-365f91244d27", "value": "6144:BGiR/tlELjyvu4OTbXHJpejvOmpzyuXJb:BGcMLkOPp0jvRzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676174553, "uuid": "c0e404ac-d6f9-4b05-88ff-43295e9aac3d", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676174553, "uuid": "df2b7450-1379-4808-bfa4-ae3b23dcc3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174553, "uuid": "d639d296-6693-4731-a367-947595cdcec4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc9e342-aaff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676224817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224817, "uuid": "d8d14b0d-fdce-48a6-8d6b-2d6a46fc81e8", "comment": "Malware payload", "value": "29c06a82c776a931a0070cc364d77039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224817, "uuid": "a27e5e98-f330-44ea-b815-717962d12e02", "comment": "Malware payload", "value": "795bb131d838b75f03bbaa0158b10b186b17fba788a85ef9026109f29ae6b39f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224817, "uuid": "c475daea-6ef2-47e6-a67d-cd5cb2e68cb6", "comment": "Malware payload", "value": "5cc04e7ade757fcb5c81e5e9ea3f4227883ecc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224817, "uuid": "5fb67879-6b04-42fa-8ade-3d052177977f", "comment": "Malware payload", "value": "67e41baad1eaf5c7614662a974d2a6021e55592af63330e958c2f78609037e52ab5e86d704772113956048cb8b50c96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224817, "uuid": "20c8359d-6af2-4581-8b31-fc83e107efbf", "value": "T15654F1F235A1C073D16748755125EAA0A96FBCB2DB52C0D723C81A6F5E713D08E7A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224817, "uuid": "46769746-4936-485f-acab-949f31945b71", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224817, "uuid": "9295f645-48a3-4544-873a-80765d695eb6", "value": "6144:fmCtcD/C89HJOZB4hun5zOfBABRh4pXRQS1Hw:fTS+89H+y0K+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224817, "uuid": "fc845248-16b5-48a8-8805-418c3595a506", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224817, "uuid": "2911c7ff-3c17-4c68-aa97-440c6d6bdc4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224817, "uuid": "56c9904d-a481-4968-9532-bf3fc2d7d5d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e04326-ab27-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676242036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242036, "uuid": "beff89ed-1f85-4907-9f3b-a0c792a7aa91", "comment": "Malware payload", "value": "0dd73bdbad9afdcd0f83788b872b62ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242036, "uuid": "abee1b67-c876-42a8-9d68-62b56ac4e2c4", "comment": "Malware payload", "value": "79ba87fdfea941f930c2b106b00eb3942042127a2c46bdebfad552821f76602c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242036, "uuid": "3bfd658c-b8ad-4148-a354-d1c4c41c5bdf", "comment": "Malware payload", "value": "c90e6f76dba9bca009e2810cc2e42b854b505bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242036, "uuid": "32edbbef-2791-4a9f-8834-809f47f5e426", "comment": "Malware payload", "value": "6a541c86296698dedee3b1e1ba6e82641497df18f36391e78ea8a537c8d11c71e287c642a9dc9f1316a9b881d7002b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242036, "uuid": "dd83213d-86f3-4eb9-a515-40e8e82ead70", "value": "T1C2F4124BF6E89026E8F547B009F207C31B7A7C615B35836F23896D9A4871670E27573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242036, "uuid": "69c7658b-410c-44f4-a80a-471a0d2411c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242036, "uuid": "f4c8fd73-3d26-4048-a770-d2d8902aa8be", "value": "12288:XMrmy90FqbXOvjy7XS4Akx97QGeJYcnX15TC9jiR0r9NeqP5:lywq7Om7XD9x9YYcl5TDSRb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242036, "uuid": "5fb21847-97af-41d7-9912-4943f4ae9ab5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242036, "uuid": "2305bfa5-0091-4d15-86e5-63fb37c36b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242036, "uuid": "83076e9e-1d17-4481-83c9-b020993b1d41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781338cd-aae4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676213376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213376, "uuid": "0d1283b9-e75d-4241-80b5-67648262fa67", "comment": "Malware payload", "value": "12b06e6a6b0508663e27725d0cf392a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213376, "uuid": "23677bce-2674-494a-a32a-4404231729ae", "comment": "Malware payload", "value": "7a18717c506eea8f8ea517b9e6f3d88d16dd3386850187895a882b3b62a5a026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213376, "uuid": "edc7db09-acfc-42ab-ac48-fbc5e6670faf", "comment": "Malware payload", "value": "d4597536ad5bb83df6d273037886f373b40a3faf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213376, "uuid": "e8cf7937-3e05-4ebc-bb36-55aa740987bd", "comment": "Malware payload", "value": "0400ff28f5106f55d6b7f670e6a4634d984a0c5f1c53f018bf31bd961d1b9d5683dcc1607b5b980ed6b34eda97becf73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213376, "uuid": "f8bcc029-d4dd-40de-afbe-b766a3651668", "value": "T15AF41247F2EC8422E9B167709DF607D71B39BE504B3C829F534A6C4928336A4A37476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213376, "uuid": "72b64191-5348-4a4e-9619-ba6c31ae35d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213376, "uuid": "eb139ea8-b918-4c64-aba5-1a38219d1fd2", "value": "12288:xMr+y90Rm/aYIzCgZ8CCoT/mOg9I56ZUjCeJ+Jt2FoOPRYxhsl5gMOPiIYXGUx:3yl/1IWgZdrzY2f+Jt2FfPRvgMOWXG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213376, "uuid": "f14c86b7-4a8b-4c26-b4b3-bfeb4dc83397", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213376, "uuid": "0ae8c872-0ef4-42c8-ad0e-2c5829f7f373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213376, "uuid": "cf391ff0-79c3-4e5f-8299-3fc5793b3080", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb94114f-aac7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676201141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201141, "uuid": "b5a545b8-bdfc-44ba-a937-7ca8692596ce", "comment": "Malware payload (Amadey)", "value": "1cedbf6f0a10014030bf8bdab9bb1c90", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201141, "uuid": "bb9c1d2f-6327-4a03-88dd-c10ddbfc1a32", "comment": "Malware payload (Amadey)", "value": "7a84f8b9a93eca53a07494676bad1f6fdb287d2cc3ec29a0dc15fccbb91d1a4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201141, "uuid": "b56fbf85-8d30-4a96-b88f-6d4c2cadd345", "comment": "Malware payload (Amadey)", "value": "ac777be6e9845fec50ff7b43b9944686fb93338a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201141, "uuid": "147de0a1-0517-4129-83e2-f701b4509d5e", "comment": "Malware payload (Amadey)", "value": "c773fa49c4b96bddbea64cc6c5d5aea31e5031ce3dfb961221150fa303eeaa6b33654d9662dc28dd4d2f06c4636b2682", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201141, "uuid": "a093b703-e089-40f0-82c7-f1c12730c03b", "value": "T136F4120BB6ED9072DCF5177124FA07E32636BC505B74C39A228E7C596C326A0B5363A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201141, "uuid": "5b35f1d5-8cb5-4db7-950f-cada63b19085", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201141, "uuid": "63280ddd-c579-408b-8fba-136453fdbfcb", "value": "12288:+MrMy900WoeAl2S0kKFH3oiT4v9sfM+8C4qTn3xUJeJPUo9udYqnZND2BOdT2G9u:qyTWoeJHkK/TOsf/8ClTRPUo9yzSY9pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201141, "uuid": "3e03405b-fb44-4491-b688-c57fef39c894", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201141, "uuid": "a034fc35-8b8d-4c32-bb9a-c8132a0d35ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201141, "uuid": "f2cfcfcf-e57c-4ee6-874d-8e087ba1f072", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1bb646-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676229358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229358, "uuid": "2c660258-8abf-4f36-b5b5-fcb05df3d593", "comment": "Malware payload (Amadey)", "value": "216456aea74559b4a537365a23b5a334", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229358, "uuid": "026f785a-b55d-4db8-9e1a-ffb8c2943746", "comment": "Malware payload (Amadey)", "value": "7b3502683256532f1329798a57267c383c9e02f0d71f8d039ee852d49e39ac43", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229358, "uuid": "bb67c8ff-d5cf-450a-b8e9-c1ed9a116475", "comment": "Malware payload (Amadey)", "value": "f680a86ede2f69bbf4d78781f5192414a94c572a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229358, "uuid": "8eea0a3f-7933-47c9-b8c0-c0d182c3b7ac", "comment": "Malware payload (Amadey)", "value": "8834d3b59d20f05e921f989b2922e23ae10d85c4e7676c05911668895bb60c1fd26049ffec15f211e6efab277ed628b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229358, "uuid": "48072ad1-2e0d-4ec7-a089-f50f9a164e93", "value": "T1ECF41207B7FD4072E5B25BB069F703D31A39BD612A7883AF234E5C591D322A1A635363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229358, "uuid": "3cb2cf15-44dc-49b4-ab55-64865dfa919a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229358, "uuid": "1f3b2e3b-feed-4f13-9115-a122ecbc54f5", "value": "12288:oMrUy90wtkE8XVWpu1B27gVh02EloKGuSzQ88D2aIPROkWkm7WwPVOD363AFy1G:syHtkEyVWg/geepoKGTzQ88D2aIXWkmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229358, "uuid": "15a595db-23a4-4ba3-aa5b-29f1c8b6324c", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229358, "uuid": "63f3f180-8aa2-4947-a0b2-fd9735418466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229358, "uuid": "0e319030-7a77-416d-aad3-70252c79cb5c", "value": "216456aea74559b4a537365a23b5a334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85a721a-aaa2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676185244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185244, "uuid": "a3f66eb5-1b69-4302-a690-724b4572b8a4", "comment": "Malware payload (Amadey)", "value": "b40644772ecb78d39e0c6402946684fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185244, "uuid": "eec700bb-d2a1-47c7-8eb2-61038657b83e", "comment": "Malware payload (Amadey)", "value": "7b98278fdf9a43526c77957cecc625bbcee439ca2d878961a17dccfdc33c2171", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185244, "uuid": "269a1d20-8388-4414-a2aa-4a1a0bb225bd", "comment": "Malware payload (Amadey)", "value": "4676602813669b4e332d9d00fa5c887ab35114e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185244, "uuid": "515844de-8446-405b-a6ac-960699278e06", "comment": "Malware payload (Amadey)", "value": "38fd118b26b0ae072621318da6976c3b3ba0d62a60379ad9262a2e144cf1fd92bd76f0b6f843123d553841db898766f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185244, "uuid": "62fd4745-664c-41b1-9ec3-0efe3787d909", "value": "T1B2F41207A3EC4022E8B157706CF707D31E32BEA1673483AA674B6D591D72670A335B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185244, "uuid": "7d4c844c-6fd1-42ac-a0ad-6d6ed77ef0e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185244, "uuid": "2345b889-3872-4e76-a23e-6eec902dd55c", "value": "12288:KMrWy905mjncksD6WB51Ug3Ci0kZ50aeJiz0P+/NpXoZgm7+wPhLDn1SqJ:UygmT9sD6WCg3Ci0kZ5KL+QOm7+24w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676185244, "uuid": "ac4078ce-b353-4b57-afd2-66743afbb4b5", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676185244, "uuid": "2e6e1f19-57e1-401e-8177-9bce0e95c6ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185244, "uuid": "ae9dc8af-218b-4142-a2c7-450c741d55bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734e264f-aae8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676215086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215086, "uuid": "712cbac4-47fd-4de2-b600-c2e0791717ca", "comment": "Malware payload (Amadey)", "value": "5cfe39ca60f20a623a2b348ed6f99f15", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215086, "uuid": "c6d29004-87d2-4e59-b8d7-e82cec17a892", "comment": "Malware payload (Amadey)", "value": "7caa22a7609d4b6f766c053c7daf70e020f1fcb365272d2483e9a4fe387c3d77", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215086, "uuid": "50013af2-5c77-4742-8ca8-6a20f9cb7b04", "comment": "Malware payload (Amadey)", "value": "aacb8087dca4b18222b4bcd380c2efcc1004e542", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215086, "uuid": "9651cd2f-e891-447e-9e2e-495c069e9046", "comment": "Malware payload (Amadey)", "value": "714a4e19ccd6b78c90f7aef162a719a175f107751051a9590cc94c57dcc100b8c8a8a53da931cd96d2ee745b4d0be8f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215086, "uuid": "e9db95e7-76c0-4406-89b6-3832b67b9f41", "value": "T1B7F41207B6EC4032E8B167B048F202D30E3A7DA15938565B678E6D494C736F4F2797AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215086, "uuid": "88a237e5-007e-42b2-a8d8-c322544d3551", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215086, "uuid": "6a0be250-6fdd-42ed-b13b-8bf3c6ba8e7b", "value": "12288:yMrycy90k8SbCAMwmtJgX1b3hxgWfHtvlcaeJrAd3vMwcuR6DuxPj:hyKqCAMP7gXR3hnvlkr23vMwcCFxPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676215086, "uuid": "8728b52d-8132-4157-b06a-41e421f046ad", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676215086, "uuid": "7833cb80-f750-42d7-9783-76bbb115d1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215086, "uuid": "8d7877cc-b7b2-41d2-9bfa-38fbf655bf9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af54ada4-ab20-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676239238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239238, "uuid": "2e70e1fd-f1b2-4bdd-a1c2-b364c124f968", "comment": "Malware payload", "value": "3d460005d54563b64d76061decf5d20e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239238, "uuid": "7aed926e-46ca-48b2-9e39-56058b7a2da6", "comment": "Malware payload", "value": "7cc37fe7b16b9bba2b798887f6bdb04f43a6d8f00f37e7bcd86eb7bbcdbbdb28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239238, "uuid": "e373201f-d7fa-4c04-82f2-c0f5eb4bd70a", "comment": "Malware payload", "value": "48d3ad7a20ec46f5254ff7c22e4380ec1eae5f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239238, "uuid": "1bacf822-456c-4152-8f26-ecdf5e15a036", "comment": "Malware payload", "value": "34594e5d45d63d98e078af5f99d913b2140218f43b48c14a9e323d665c8c09425eb149accc531fed63a10242609fb3ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239238, "uuid": "c41aa8fc-0217-45ed-923a-4c4eacd4fa05", "value": "T1D3F41247A7EC8122E97467705DF303D31B3A3D60D638469A528F2E4D1CB2AB4A67137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239238, "uuid": "0411b88e-ec40-4c74-97f4-58f917c2ad0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239238, "uuid": "d12edacb-9cea-4ee0-b45e-c0369932bb55", "value": "12288:0Mr8y90rjJBJtTgNjHs9ves2Rq8Nxi2eJ1Owe/Np8chsbDCQMWT:4ykBJtgDhz01fekJDCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676239238, "uuid": "2c06fbe5-863d-4cd4-88a1-467dc02fcea1", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676239238, "uuid": "85119b19-d62d-4fe5-b882-f273d28c9985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239238, "uuid": "5d2d75dd-0c8e-43f5-9da0-4fac5ed9bb7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4814943a-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229616, "uuid": "e2275799-9e53-427f-bc47-7f3ea9bc3bee", "comment": "Malware payload", "value": "e0937345b0012ee917df15a4a70b8126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229616, "uuid": "dad0bcbf-e2c5-4717-a6a6-bdd47df568f2", "comment": "Malware payload", "value": "7cc99a89a6b930ada9d34905acc1770f583d4b214858cd579526bff471c8c2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229616, "uuid": "f1ff1396-6825-4b8a-aa25-9c338cb54597", "comment": "Malware payload", "value": "a9ccee9a0ca64b81a0e394a594f37fa169edf0ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229616, "uuid": "c3d72e7d-2f6b-4301-86c2-a52cd504dd1f", "comment": "Malware payload", "value": "c1d7d53a486d2d315d37e68bd200eebb0541ebd71438bab6f65272c7ffa650b9409431b77f27b1e6ea6c447d332232c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229616, "uuid": "8e05fb5a-cce8-4b66-b348-02000dd9fd49", "value": "T1E07523117AC04831D9722E352EF557B06A3CFC201BA68EEB53947B1E5A309D29E37763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229616, "uuid": "d0d14399-23ae-469a-828e-7b17e48f86b8", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229616, "uuid": "050b5286-5bbd-4412-8ad7-deebce1d2795", "value": "24576:I/XEXjJSFHUKwTiKzMb/+a9UBXhoHm7AwIoYhJAibFl8Nvct9Mmqr3vrH3u0e6Hd:I/oSfJBiBXOKjTYhFr8Fct9MmgyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229616, "uuid": "e4b46e68-b056-481f-ae4e-919146d02f62", "value": 1599684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229616, "uuid": "c7045b08-65c4-45e0-bf24-1ce9347d7dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229616, "uuid": "b79389cc-66c7-43c1-a410-66b2d9a61438", "value": "e0937345b0012ee917df15a4a70b8126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfea033-aace-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676204151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204151, "uuid": "0951dc5e-4f48-4eac-bcdd-c632e6323779", "comment": "Malware payload (Smoke Loader)", "value": "98a5dc82f18a22360dc5041dd2bfc0eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204151, "uuid": "edd7cee6-39c8-4365-9198-d6e1f087e107", "comment": "Malware payload (Smoke Loader)", "value": "7ce081410071f0ddf5bc8f4b96bf1f1b543073014d0deb6370c5ddf12262aa16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204151, "uuid": "1d856d75-dfa5-40fc-81a8-6656da7fe68e", "comment": "Malware payload (Smoke Loader)", "value": "25f9ffce1a45b026010ccdaff51f3242ee359050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204151, "uuid": "d515c760-3dc6-491e-9e0c-f03d780a1f25", "comment": "Malware payload (Smoke Loader)", "value": "d6d51a8128a40b3b008394d50ab00ccb7950b62a14940a89ded7740fb64aebc9f1875cc4d4f6afc417f13f5adf1595ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204151, "uuid": "807fc783-d374-48b8-bc80-39e483db2492", "value": "T17C14DF127AA18072D1938EB55935DB90BA3FB8B15751F0DBF30817AE0E313D24A7AF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204151, "uuid": "803be7f7-9366-4fd2-a326-b82f505935b4", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204151, "uuid": "d0eea5ba-62ae-48d3-8fe9-4ee28161853f", "value": "3072:Jb9T+FyfOjsRs4P+e3tLyvx6WVKjnBQg/vHA+O1cRlPNQ:dB5Wt42+dyvMWVKjnP/o+AcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676204151, "uuid": "aa0b6a2b-5373-43c9-a355-bbeb2a9e2866", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676204151, "uuid": "7b24bac0-0cd2-46f1-9738-0c785607ca84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204151, "uuid": "e9710661-d73c-4d0c-b75c-89ea0fe71924", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fb2b62-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229346, "uuid": "1e727842-1aef-4a94-b86e-20bdd07dce6d", "comment": "Malware payload", "value": "97e28bd7e6d9ea7270a59f8fe6db5b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229346, "uuid": "aa3084e8-939f-4d47-91b0-0c79afa21395", "comment": "Malware payload", "value": "7d99d9dc8e69d9adc8bf0f44170eef5fe06ed8b58560b432c7349924cc74e591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229346, "uuid": "fbfceb83-dd5c-485d-9260-30fe9d98d0fd", "comment": "Malware payload", "value": "de1c58b8bd9132f05a664dffa781876a3341f5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229346, "uuid": "71e6d357-da3f-418d-a2bc-2a9444b6fa27", "comment": "Malware payload", "value": "7d0b625842144f216755f5561fb7f38ead842bf4e1172248220a09a2b8a17f302ec54c34b911d0629e1cd28387d8d9cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229346, "uuid": "f89c72d4-f746-4c73-9db1-f839d9792d1f", "value": "T1F8F60217AD69CC28C5E394331092C397D21AE18DAE0DDB9F13B11945CEE096B5F12BEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229346, "uuid": "764ab6e4-d456-497d-8846-3abf7c2f4e39", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229346, "uuid": "818ab246-baa0-40c4-a89e-56810489f29f", "value": "393216:MYmOng4xPBM7CG4k2woJuQFkyRmazVNEJ7KJ5DPEmLjJ7:MYmO3xpM2G4kZoFVRw48mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229346, "uuid": "581c6e99-58eb-4bc2-a9c7-8c5bbc0ed931", "value": 16141328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229346, "uuid": "b61f0d1b-24f4-4640-af3c-8185b117664f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229346, "uuid": "4d8c983f-86cf-47cd-9d8b-d0799d660935", "value": "97e28bd7e6d9ea7270a59f8fe6db5b6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64911700-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229664, "uuid": "0fea788c-b7c7-4cca-bb36-aa9ad0774083", "comment": "Malware payload", "value": "9d38ac60661d27bbc080bc6cc964bf8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229664, "uuid": "53adacae-0a54-4041-a286-769f647dec39", "comment": "Malware payload", "value": "7ddef240da75c36d17a3eacf16873d767ab23a30d8369f10f1dbbe88573b0a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229664, "uuid": "4ab405ae-4823-410d-8a1c-6e89e8d0cdba", "comment": "Malware payload", "value": "4fa56e08c5e61e1e9eafc06621bb25c0671b5122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229664, "uuid": "24d88753-2a89-4d4d-854a-49efc9497fae", "comment": "Malware payload", "value": "4735f3b834821e460c40ae0f0b76524662104f14a6186becd0c85469396cf2070bfe979849e90942e65b864d0e1836d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229664, "uuid": "e389518a-b77c-4b8a-b227-2e78418a6916", "value": "T1057533B3CAEC8DBCF53448F49864C36C075398490DB6C17136565B378BA64A0BD3EE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229664, "uuid": "47f29578-830c-4343-abe4-e8f87365857e", "value": "49152:HIx5Ub2o4iW0Wc9vFWLmDeHtzRf668XzRC8e9DQbT68PtYg:ocio410Wzmizg68hmsbx1Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229664, "uuid": "aaec82f2-17ce-47f8-be64-82c0525bf7c7", "value": 1702015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229664, "uuid": "532a42ba-7eb9-478d-9740-2d4f5caa1586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229664, "uuid": "bf2fd29f-b066-4dc9-a1d0-406b423a0240", "value": "9d38ac60661d27bbc080bc6cc964bf8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c42c64-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676229377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229377, "uuid": "a6fec6f8-5292-4592-87ce-6d585a108a30", "comment": "Malware payload (GCleaner)", "value": "b2211714b0632c5dc42da59db265a011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229377, "uuid": "f11556b4-3e99-4429-8edf-4ff5a39903a4", "comment": "Malware payload (GCleaner)", "value": "7e2078636c31473a61616c80317bd47bddb90a4a957f2f635ac2311c7893bf4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229377, "uuid": "b0c4c1f5-8d2a-4bf0-80c3-8d580798152b", "comment": "Malware payload (GCleaner)", "value": "da8acaff54b22da73c5db3845eab0b66583b4ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229377, "uuid": "818fe811-84ce-4d26-9ffd-799dbb8e9b98", "comment": "Malware payload (GCleaner)", "value": "3d66a9c9b0886cdbb8dc14471d394afac4b9522a592cfb31e9f4228c58837d28a91089d3bc1b194ad581764969c22902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229377, "uuid": "bc348825-ca06-4c7c-9544-25d0da48bd81", "value": "T152F5123CB505C8ACC281BEB88D3A98E39CD76DE3D994E02370DD7F3E9179185960A617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229377, "uuid": "1f7d55f7-430a-450e-9c88-7ab45f3390ce", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229377, "uuid": "e79654d1-03ff-4891-9afc-be2865bb6309", "value": "98304:JHF3sFiCj0PKsL2Txwu6iAOFSuwvv/v2MR:dexpsL2qu6iAOPo/vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229377, "uuid": "f0c701ba-a639-4f64-bad4-3917577cfe8a", "value": 3625819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229377, "uuid": "18225958-fee2-4584-839b-c0b8e8f84d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229377, "uuid": "dd2281e7-5e66-4db6-ba37-b6d0ce158f37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c01b12-aab5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676193377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193377, "uuid": "8f9ef80a-9669-43a1-a82f-dfc0c94ad2ea", "comment": "Malware payload (GCleaner)", "value": "d65f405e56e10ab632bf9b93099dba41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193377, "uuid": "c8cccffc-eb38-4cd8-b401-2acf8065386d", "comment": "Malware payload (GCleaner)", "value": "7f38c5e557841dc8e9d52e1f7ff411b712182202e5fd0e016b3f9167b7440f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193377, "uuid": "bca4f4d0-5f30-4f99-a1c0-76cd1f40dc05", "comment": "Malware payload (GCleaner)", "value": "42da79e52ddaecc5de276cd64104c3768ad4dd7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193377, "uuid": "c351734d-163b-4ebb-bc16-73e7de55588b", "comment": "Malware payload (GCleaner)", "value": "69a5617dc049ea21ccfc1171fbcc04ec64b867344eab91ac0db3f9dd351fa637beab1b15043060b407e8a13f79e7e3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193377, "uuid": "b2e1383d-6021-49bc-9562-69002eb1f199", "value": "T1D1F5127C7105C8AEC280FEB8993A94E75CDBAEE3E8D4946371C97F3F51791889A09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193377, "uuid": "03a8416a-6118-4b55-8177-600200025d65", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193377, "uuid": "f3e90376-2527-4df7-ae9f-377cdac63b1b", "value": "98304:JHHzB3mc/HUkAOIljfQ67iyWLoXrjWKzp1B5/odv2MR:dHzB3msAZQ5JoXvR5/odvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676193377, "uuid": "a3bdac5a-8f1c-4a45-94a8-32ca2a154f87", "value": 3414509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676193377, "uuid": "c5ee2e93-6179-46ba-827a-2662fee901dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193377, "uuid": "87b94b21-bd4f-48c5-9b65-059e9b214d7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7260ff64-aa6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676161827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161827, "uuid": "d0177b4e-aaf2-4058-8ec1-86927d635e5c", "comment": "Malware payload (RedLineStealer)", "value": "931bfb8d925f53073ff60ba9d752bf1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161827, "uuid": "c269ac2e-c175-434c-a0ae-ea043c0e6a5f", "comment": "Malware payload (RedLineStealer)", "value": "7f40b6923ee5cb187eda60bd42fb247ec42f551cfba81a23ce61b75ff0e8be24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161827, "uuid": "34eb8a72-5bde-431c-a1dc-2ce324945df1", "comment": "Malware payload (RedLineStealer)", "value": "201f516bc52bd87c1df1bfffb9d269f435fb35ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161827, "uuid": "6e4ec95a-8b18-4683-9df1-c98af998663a", "comment": "Malware payload (RedLineStealer)", "value": "708687740665fd4a80e6c01d447df01900aac30317246a683005e0cc8f2be20557e0601852cce32b59516724e1e80bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161827, "uuid": "03743e85-ca29-425f-b4d6-1da182ad2742", "value": "T16754F1D27AB29073DA9685B15831DA802A3EBCB19B96C1D73758069F0D303E19F7B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161827, "uuid": "a620cf98-1f05-4646-8c8d-7f214c4e18ad", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161827, "uuid": "b2d29071-52e2-4215-9d7c-867b06eea8b5", "value": "3072:vjqE4+0Jrmr5ClTba5ojvsiQ9caItyn28CTI6yS+vpsEfYhkyU8ROl2ZcPtRU1yr:vGLRh969c9yn28CTRyfwhfU84Qqtm1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676161827, "uuid": "3139423b-9b87-429d-8a82-8b49de7b2361", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676161827, "uuid": "c04d41f7-3bc0-4188-a149-3797f7d06b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161827, "uuid": "4e99755d-c93d-4870-903c-5c0b600364bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ed6168-ab28-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676242494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242494, "uuid": "7b6fa6c5-9409-4252-8969-e25318a1d35f", "comment": "Malware payload", "value": "9909273f3f451922ba68f5fcf299ad38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242494, "uuid": "6ce642bc-8a0d-4ea5-85d7-f401965f53b3", "comment": "Malware payload", "value": "7f724fa685242a499be5d691f1a45b31c12ffbf82bb0d333f9959a3c78b6ea31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242494, "uuid": "a13c3679-4276-4d1e-84cf-927e19c07f1e", "comment": "Malware payload", "value": "45d5e6928eadfaa05d1d7065353ece16de0689d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242494, "uuid": "77a72c18-055c-41e8-b106-614973541c15", "comment": "Malware payload", "value": "330430b5fb8dfa067241b68b122d1aaaedabc6d13933ca2546c83ba69cc7846206ccc71bb605a4dc30e9e47e89c1bfd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242494, "uuid": "b2a467d4-c767-4fa9-b052-10ec675ae8d5", "value": "T1FBF41217F7ECA062ECF46BB119F707C31B367C505278879B228AAD1A58725E0B139727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242494, "uuid": "b247348b-3160-483c-88e8-e0e0a3c9aef6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242494, "uuid": "a72b8592-d16a-4263-a247-d27803a021d8", "value": "12288:4MrUy90/glkSA3jpatumbTCg0LkeJ33bI2Sq2anCmjKR0r9BYqo2A:cyGgySyjp2mgS33VDiSRy2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242494, "uuid": "ed6709d6-fb3c-468e-b5cf-925b90eab30d", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242494, "uuid": "3b08dc14-ffd3-41d2-a6e0-4ef796e8eabe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242494, "uuid": "b301304b-3892-4add-984f-5d36f660f40a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b122e36c-aadd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676210465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210465, "uuid": "03158752-c1ef-4bbb-abd9-aa1ffe4ea6f6", "comment": "Malware payload (RedLineStealer)", "value": "6cace5a26ec539726018660ad2d84ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210465, "uuid": "2c377983-13ea-40f3-9db8-c57ad4cd26a2", "comment": "Malware payload (RedLineStealer)", "value": "7fff0f3634751a3f0d51eb067ccc784340aeacdc2f2d17e82dcd48b584a8ec0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210465, "uuid": "037e4112-daea-4fce-9e2d-1de93e0b18f9", "comment": "Malware payload (RedLineStealer)", "value": "834b27011a112c45fe22cbf1ac2ff403ff5b4a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210465, "uuid": "f5a3e07e-3dde-4502-81de-927eaf8ce36f", "comment": "Malware payload (RedLineStealer)", "value": "a81a58e7436ac2e03bb657c3661c246cf9f53adbe9f2851b107d984733b27bca3ae918fcbb063e59932cd2f57f0f675b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210465, "uuid": "705aa883-f924-4cd3-9020-2539a7de4495", "value": "T1E5F4120BABE99473EDF4673059F303C32A35BD615738865B628F992C58336A0B1347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210465, "uuid": "dcbda174-8510-4722-ad20-5f63e42ac255", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210465, "uuid": "9246b8e7-e4b0-4995-bbb6-0e0ede30a199", "value": "12288:TMrGy90/0CNPzsrrcI5E8GJYbYehrZdeJeo5sdxk9RDTgYsMq:RyaPEdBY0Ye26LkfDkYsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210465, "uuid": "c90a10c7-6998-4799-b3c5-5e4102748be9", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210465, "uuid": "f9af8020-92e4-4c4c-890d-b02d1d2aadb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210465, "uuid": "23aacef2-8a76-4178-a3c1-ab9f34553d32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c567123-aa8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676176876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176876, "uuid": "a13f597f-dc90-470e-b03d-0716bd01c6c1", "comment": "Malware payload (RedLineStealer)", "value": "36e7d1e6ba2bdb158632dc5da64aa37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176876, "uuid": "69eb7ef3-0bad-4141-b53d-e6cdd252d7eb", "comment": "Malware payload (RedLineStealer)", "value": "80020f3a2393381d1824c4e77667834c3cca0d36494853715040152975436f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176876, "uuid": "2d292c02-eb29-4cff-b0ad-f7444d97f6d0", "comment": "Malware payload (RedLineStealer)", "value": "e084d78615f87570058583527da004c9c431497b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176876, "uuid": "20fcf04d-117f-43c8-bd35-585512a2892d", "comment": "Malware payload (RedLineStealer)", "value": "72dd2571d64e796570eaad7c4a2de2ff0064e67d6bd1fd5aeec4ea6a9773e2cf8057795106496b011d7a717c0ffddc2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176876, "uuid": "06ddc2ad-3d6f-456a-a47b-3b58a950acd5", "value": "T1BEF4124BB7E95163D9B527F019F603D30A367D209A388256238E3D690C72AB1F23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176876, "uuid": "e6bcbd49-5ad2-46cb-8137-cab4cfe123b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176876, "uuid": "7f85134e-1e20-4b1d-baee-82392ab5d23d", "value": "12288:kMr6y901EixDQMWRMMt9Cm0zgG4slvDFaksMeJHMylitgNZw9Te+Cj4O2zhYz:+ycuMkPUnz1lhy+imxhCj4hYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176876, "uuid": "42343182-dbe6-4cf4-9cd9-9fa19b62c738", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176876, "uuid": "00f4656c-f475-46af-8400-f69ecbf59001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176876, "uuid": "66ab32d9-027f-48ef-8afc-3b26ec80e7d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb3aaa7-ab29-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676242916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242916, "uuid": "01bc06b3-7f3d-4dd8-bd7f-efa9459c3a7a", "comment": "Malware payload (RedLineStealer)", "value": "3b81320897e6db720403e8faaa6d1a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242916, "uuid": "4f05498a-fe07-45c6-82f5-15789a4ab3d7", "comment": "Malware payload (RedLineStealer)", "value": "80155c784509cc4a88e5e19f22a02cfd274d20d8825a81451765d5c4a641e8f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242916, "uuid": "55c2e77f-6cdd-4b48-8a4a-581c47d396c4", "comment": "Malware payload (RedLineStealer)", "value": "51eb93e092797adefbc6efb8f42839833279be99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242916, "uuid": "4ef28278-c87d-4e83-bac8-6cc4290eb24a", "comment": "Malware payload (RedLineStealer)", "value": "b6d82cab538ebb115cabeb7d7f8b35abb92fd4ef84eeedd6b9fd643e00470e02ddf8b3ff5470826789cd4bc80f5a795b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242916, "uuid": "3569aaaa-0ad2-43c8-b6ec-a4faef6c6219", "value": "T16B54F13075A1C073E167417B6931EB909E6EBBBF5BA280DB730426DF1D302D09A75396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242916, "uuid": "a87b16a9-f170-404f-9676-a11cd8174fc3", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242916, "uuid": "b916e985-2e03-4f2a-b554-e52458b1f11e", "value": "6144:7HEppg7+qXPKWywbZb74lAAmlN0EXVQTQr2k9Gck/:Ag73XBpbZbclAn/XqEMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242916, "uuid": "a9b98482-ab41-4f23-874f-593fed605570", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242916, "uuid": "a820359f-4116-4a40-88ba-ee84cbabef62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242916, "uuid": "8f4596e8-1222-48f0-88df-bd220dfefdab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157d43a4-aaba-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676195171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195171, "uuid": "cfc03156-4cb0-4a84-ad3d-3c84e0ddb2a4", "comment": "Malware payload (GCleaner)", "value": "cc3e2eccd5610af751d8a993931324aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195171, "uuid": "2d73587a-98e1-4370-b4c4-a0206a6c31aa", "comment": "Malware payload (GCleaner)", "value": "80f8500be64e2d880dc9c01c90d81f69fa087e508074972c8b04203598ea5288", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195171, "uuid": "be101c2e-7d20-4ea9-b982-a74b112d7a64", "comment": "Malware payload (GCleaner)", "value": "8b9cb6c99b19616fa892d82e2c00c99bee6c8408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195171, "uuid": "fb3e00d7-cb96-4997-8789-1924fb4366fd", "comment": "Malware payload (GCleaner)", "value": "c4493fe7abb0b2991ee4004f2a2502c20083e71cbf37b82af0dc11986e3808e2d130d548539c81fe3f7b9cb1d3d1c783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195171, "uuid": "afc24357-d7fd-4d16-a352-91db681672b5", "value": "T198F5123C7115C8ADC280FDB88D2AD8E75CD75EE7E9E0A062B0D9BF3F45792858A09147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195171, "uuid": "dbf0ef0d-e161-4300-b929-2380766e731a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195171, "uuid": "bdc41f1d-854b-4125-b108-a4721c3bd6ad", "value": "98304:JHWfol60wQyc8UiDTNN7lCCIJDjtmv2MR:dWfowHDnvw1mvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676195171, "uuid": "0864a1a0-85e7-485a-a333-cd24e87edfa9", "value": 3584750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676195171, "uuid": "dab05c23-b7f6-4428-ba18-e1e730c51d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195171, "uuid": "50fbd84a-b532-4d52-a0ff-ab77652e371d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2beb5b-ab08-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676228653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228653, "uuid": "fe3865aa-3c0e-4471-8417-aa7f6a2f9e45", "comment": "Malware payload", "value": "ac281654decb3d72952d52cd8112d4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228653, "uuid": "3c97e1c8-c0b7-4e0f-ba0e-5f1e66472182", "comment": "Malware payload", "value": "81ab3f1ed0fc6ecce684c139d2c54d7ad608035b81ab0ba28a37c33dfa051753", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228653, "uuid": "49c06afe-5bb8-4afd-b4b9-55b8da8a09e8", "comment": "Malware payload", "value": "3d144853c61e2d4313637e9a7b4e3b709d485e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676228653, "uuid": "f2bc296e-63b3-409b-a605-57b278be8bff", "comment": "Malware payload", "value": "93b09c5f3bd56a2f4914fcd9e4d0a43e8b163274799481619d412d1adb3967ab900b8f7cf5c1891ad96f947df33ad27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228653, "uuid": "bbcfec05-c446-439a-a5ff-7ad194b3daf2", "value": "T1FD54F11275E1C036D2578E753621D6A47E6FB8F15BA181C7234807AF8E307F29B7938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228653, "uuid": "9c018e57-1b7f-4378-b21b-d57c952ae08b", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228653, "uuid": "b290dd96-0e75-4f6f-a552-9f462358b807", "value": "3072:T78u/+H+cw56Qnz1ndcyxTkZC/b8/vz4zmPTHxPK0kUlUkvLuhr9JsNHT0DlON:vpCx3Gdd0Ab88STHxCZkvCRsyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676228653, "uuid": "d6b7f036-f23f-4e24-87cf-1a0f89c8b747", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676228653, "uuid": "333bb098-56b7-4046-aca7-2257b2fb3d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676228653, "uuid": "24202f08-8e12-49e7-b3e7-1a5eaaf2d314", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ab74a7-ab12-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676233048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233048, "uuid": "9bb5ae56-0cde-48a8-91ed-478f305ff2d9", "comment": "Malware payload", "value": "e7aa024138efb18d8aab5bd3fafbf5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233048, "uuid": "e547590e-1961-4d5d-8fcd-b8fcc64f46e8", "comment": "Malware payload", "value": "81d1f05b95bff03b8157b0093097983800556e85cc3eb9b58ff562b54f86f5fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233048, "uuid": "2dcf48f4-4a88-4304-a141-b747f56eb432", "comment": "Malware payload", "value": "da036940ddbf7ab56075e1cbdc6fe4ece587a679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233048, "uuid": "ac579275-39d0-401e-9ed3-3f636dac7d21", "comment": "Malware payload", "value": "2faf0c9aa76588f25604f5e3b75a1b8203124ed4d82bd883f4e369f9eaca2b741ebb4637d0b4fe2cc7b21268996c96bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233048, "uuid": "5cc53d6a-4686-4ea5-81fa-a0278585ef7d", "value": "T1F0F5123C7605C46EC290BDB88C2AA4E75CD65EE3E9E4A423B0DDBF3F427D1845A1910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233048, "uuid": "d3d365dd-b53c-40cb-9350-be8f516f15af", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233048, "uuid": "1b30d91b-0165-44b3-a82c-536f3dc9d2cb", "value": "49152:rdHOMYx5NyRaAyz2mNmXzuS5PTnUduM9rn8nMmaMAVI0GulLCgv2MR:JHh+CRiWXbtTnM2aLHGwv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676233048, "uuid": "5a207e1d-d025-4cf6-a058-3f656a5d7088", "value": 3453192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676233048, "uuid": "2e617660-60fe-401b-8ab5-c30284075d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233048, "uuid": "0a88358f-0794-49d9-93cc-6ab72c14ee71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6ee745-aaa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676187159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187159, "uuid": "3bbca031-eca3-4928-b567-b0da53e0076f", "comment": "Malware payload (GCleaner)", "value": "0aee134c830b4c421da05bd72c2c9e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187159, "uuid": "e89b7e63-4ce8-4ad3-808c-51b9e6966226", "comment": "Malware payload (GCleaner)", "value": "826236448111b8e946e673a234d0ef53821b2ba79d178c07573d8c39c36b3542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187159, "uuid": "94bb26b6-d190-4d4a-a4c0-9e3a0d9e6151", "comment": "Malware payload (GCleaner)", "value": "59ed75c9df7ae6af60e36a30faa34e32d511bf42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187159, "uuid": "6b03d748-b691-4ab9-87f7-c2ae283405b6", "comment": "Malware payload (GCleaner)", "value": "a440fe5624bcb634c792add9789bcd279100a25173e03a0b733fd3ab43f85bb741d05c1fe326b089e1262d1fd916f2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187159, "uuid": "1761efd7-fb2f-48fc-ad76-9755a50ee1d0", "value": "T174F5227D7645C85DC2C0FEB48C3998E71CD66DE3E8E4A422B0DD7E3F92792459A0A213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187159, "uuid": "365ecda0-117f-49b5-b937-9d09ba4ce146", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187159, "uuid": "c79e4910-118b-4c00-8b28-04eb93d4cd84", "value": "98304:JHlmr01zHMqPPPvkK39eJJGUAQYGgk330G6MFv2MR:d4QlH5sY9GJtAQYGRn0GhFvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676187159, "uuid": "49f6894e-e709-4d51-b7ea-2154d7ef3f13", "value": 3633178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676187159, "uuid": "a0b2bdc3-2e73-476d-8a76-5873df1378b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187159, "uuid": "7ac27114-92cb-4c34-960f-be91eaec5308", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60824b6d-ab16-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676234811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234811, "uuid": "28613569-ed2a-4113-a474-488f1e9c628a", "comment": "Malware payload", "value": "a91f27c902796cccb7a554e06389eaa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234811, "uuid": "fc8db66b-1713-431d-97da-19e417415a0d", "comment": "Malware payload", "value": "830f29bf1cd9a4ae34d89ae35493c8b83acfdb4101a6a31347c371234bf505d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234811, "uuid": "6ba54d63-8951-47e6-b8c0-6b13f70a2f85", "comment": "Malware payload", "value": "6a67a91222393da27b7c54bf015185fbf144159a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234811, "uuid": "4d350b55-adf0-491d-b3dd-3e7192f8ae9b", "comment": "Malware payload", "value": "b21d503812f10c8318afc4b1b9a5830118dd3e911d9df7af9220c5c37013f4a352130e466b8a8fb9b0cd20cbc90ee333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234811, "uuid": "849c50a1-2521-4f08-8a62-7f996f5c0b6d", "value": "T1FCF4120BF7D99162E5F063705DF203C319367E505B3C82AB224FAD2E5C72AA1A235767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234811, "uuid": "1468f147-d74a-4cdb-a1c5-b6a8c9cecedf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234811, "uuid": "1b4a9ba1-8d61-4eeb-9073-8184ad2fbcb4", "value": "12288:7MrTy90Ej7nBK9ygoinTNadwB45tCYseJxvmzJ6Bo+HeCnyMMP34:cyHPnBK9ygoinTfB45tCcxv2JSheC5Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676234811, "uuid": "46346ef8-81e4-4112-b93c-71fdc56ddc8a", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676234811, "uuid": "eff435bf-79d5-4a7a-a02c-bea1b9623fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234811, "uuid": "1829bdf5-c616-4d65-ad49-4df0b28008b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25cd69c-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676229472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229472, "uuid": "eee51aac-a389-4a91-a95f-e4966dc7d2d0", "comment": "Malware payload (Smoke Loader)", "value": "d73a03b520f7e90584f51e5c8875d4d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229472, "uuid": "0632d8e0-46a1-4954-a04e-831a2879f2aa", "comment": "Malware payload (Smoke Loader)", "value": "84720b2a462a8793fc661a6998ee6d3a971c5cddcc370167472da2c45f5c4158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229472, "uuid": "be1f3fdc-42c3-42a0-aa74-81bfc9e553d2", "comment": "Malware payload (Smoke Loader)", "value": "23109969f756b97a71cc198791cf50941770074f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229472, "uuid": "ab2d0ced-9280-4b04-a205-a1f108df65b1", "comment": "Malware payload (Smoke Loader)", "value": "7ce89a74c68116037f59cc138c03e3a7fa5b35057353765672a7f2e3818fd6352dec168f7a7c2fecc6384bb9d89735fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229472, "uuid": "f3e32a6c-8e8a-4789-a82b-73a53c0fb1f3", "value": "T15804CF1975A2C073D49BC6742421D6A4AA7FB8B55BA2C1CF33841BAF1E313D24F3A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229472, "uuid": "a0d7d6d5-8460-4db9-9bb9-25770eed1444", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229472, "uuid": "12dde7fd-efbb-4fef-b404-8a018d5a0c11", "value": "3072:776Qo+Hac56V006I0yw3DZZX6kzeehLZVzV:3OCAV006UtehFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229472, "uuid": "73863181-c1f1-4647-b350-bdca0f1717d7", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229472, "uuid": "363f85fd-d508-4d49-9963-0183a8e7457a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229472, "uuid": "00885337-14ac-4b28-8e58-331a534701e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc9691-ab25-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676241197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241197, "uuid": "daf6dad2-2534-473b-8d0a-ed4029963e19", "comment": "Malware payload", "value": "a9edee313d2f46b11c40cdd522077010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241197, "uuid": "ba8375db-5dd2-4a77-acde-88769e600dc8", "comment": "Malware payload", "value": "84eb2f58a52445dc4a0d8de029214209ece058ec84b27982b1e12a2a2f16351d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241197, "uuid": "c53b9a2e-a84a-484e-a56f-1053b1f67c42", "comment": "Malware payload", "value": "046f2e7b26ae9b590e1ba011259b7e587da33385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241197, "uuid": "c8744488-bb40-4b84-9691-ee0c3cadcceb", "comment": "Malware payload", "value": "4113956a056d7cf8d669563d7138f9e50c6df0dc0282343b3090e16e2b6fb326a2ad216cb72f218e628aa08622472332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241197, "uuid": "1af56b34-86a1-4261-8bef-237db51ca577", "value": "T14CF5123D7141C96DC280FDB49C36A4E76CDA6EE3E894A02770DD7F3E52B92848B1A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241197, "uuid": "fa6a3436-a41c-424a-8387-1c017ccc89e2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241197, "uuid": "eeb45257-21c8-401c-8c17-b2fad7c264e4", "value": "98304:JHPRuLp1h/WGGJuT8jp0hg1K4WGWj3pUGv2MR:d5uLpz/6JuTk6hadWGWFUGvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241197, "uuid": "1ccc3c41-568d-4e6b-b84e-8b1de232afa2", "value": 3444782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241197, "uuid": "2899b98b-3881-42a5-8fce-4563acce5865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241197, "uuid": "bae57f7a-f784-4e64-8ec6-8540403c557d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d069f3a-aac3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676199050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199050, "uuid": "ccc3b70d-8a49-4c1a-a6ac-4fd7460890e8", "comment": "Malware payload (Amadey)", "value": "1fdf69f314599378ebfb0926597ee2ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199050, "uuid": "4760e7cc-7782-4b99-b054-4856371c7a13", "comment": "Malware payload (Amadey)", "value": "855cf6d3e14acbc45ba11900365eb4c93ebcc156f9c88975bce65de2eec2c8b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199050, "uuid": "92da241d-9648-4c04-9515-d9b88a0f5a3e", "comment": "Malware payload (Amadey)", "value": "b6d31e1f72fd65afac754663c38703a0dbf42644", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199050, "uuid": "939994e3-f837-459e-89b4-c8d0a1615f3d", "comment": "Malware payload (Amadey)", "value": "d996c382eede8483e7853aff036bc4e6621ea7b47404aec304e40ea732268c496bfdddac9a5ef9ab2f8dac346ee32fea", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199050, "uuid": "f9f35e86-b617-4566-8a2a-7e8ffd198ff1", "value": "T178F4120BAAED8222E9F4637059F603D326327CA057389317239E6D1E1C727B4693577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199050, "uuid": "b02238f2-279b-4691-8f7f-c32e9921ddda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199050, "uuid": "ecc184be-b07e-4aee-8939-72ed5876ba72", "value": "12288:yMriy90WWKXdwP4wInxZrZfq0HkwMeJEPRWRj/+WaBGnMIzzhGf1l8/lr:QyjXOP4BnxZrZiRWQWovBGMqAfTqlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676199050, "uuid": "eda700da-899e-4538-960b-762b848c2cf3", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676199050, "uuid": "f7433969-ce6e-4ccb-bd1b-5703d4d209ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199050, "uuid": "91c253d9-1618-4bf1-b556-1dab753a4627", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1888725-aaf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676219458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219458, "uuid": "4e62be95-d70d-4de7-9dde-2436674d354b", "comment": "Malware payload (GCleaner)", "value": "214c215df88ad1146f81ed086b037514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219458, "uuid": "aa491339-342c-43a6-afce-c11cacd75e65", "comment": "Malware payload (GCleaner)", "value": "8648121a838fafe4fa493dd6b5a4bb0b694a1efb3ba82f8f08d7c48d7e5a3d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219458, "uuid": "3086a91c-4097-47ea-8676-e24aaa96c6cf", "comment": "Malware payload (GCleaner)", "value": "18da147b0284d0f74ade4906d1444cd756de0337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219458, "uuid": "08734a0d-0b81-4b92-b9f0-b4c3c7d209c9", "comment": "Malware payload (GCleaner)", "value": "d75e580be4076282ac02cc560b3b32bbb892c98a0cbf64b577c53c33be4e113abb651abb61db8f57f160c6332f082913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219458, "uuid": "2f58143c-c041-4c2d-b355-8b7af19f5fb7", "value": "T1CEF5227C3506C8ADD280BEB8883A94EB5CD76EE3E9E4915374C97F3F527924C861A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219458, "uuid": "784ad30b-f876-4a0a-afbf-dc78effb7f4e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219458, "uuid": "b69c4b13-4f5b-43d6-aa6a-32f6f0a26c0f", "value": "49152:rdHGotxOPRQtCGXxWyHudCpAB9jUXObsYyEfYhKvUdQiTPEugyBNLhe86LCgv2MR:JHGKxPtp4yWwABdbycYWQxgyfLhsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676219458, "uuid": "9ca54ecb-42e8-4a2d-ba56-a1c2312cc12d", "value": 3445795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676219458, "uuid": "2172d45f-51ab-4148-9c33-a9c7476c90c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219458, "uuid": "55ff5184-c444-4002-b4a6-b890e9a0a4a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323fd7ba-aaca-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676202092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202092, "uuid": "17467e7f-b0ff-4120-8ba9-9acca75be123", "comment": "Malware payload (RedLineStealer)", "value": "1815272d639cf78a5d4a6ce213e9c938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202092, "uuid": "a4ab4d78-93f3-49f8-bff6-56285f12def7", "comment": "Malware payload (RedLineStealer)", "value": "8654860c0c4e54690b3aab64f1e5c343930bcd66641c000b95bac219518d5799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202092, "uuid": "70bf87e1-c787-4377-bfb0-539778e9b056", "comment": "Malware payload (RedLineStealer)", "value": "d3796da0110db588253744f66aa02b77cd492c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202092, "uuid": "ff335a45-2316-4a21-bc2a-66f6837aa2ad", "comment": "Malware payload (RedLineStealer)", "value": "d8383e60b3e7aa2cdebeff692912f9593c342e01d0df2150817916c8b38e871cea6ed085390f19658e57bfef4027f734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202092, "uuid": "e1926100-8f48-4c6a-a490-ab3f5baad477", "value": "T1B3F4120BB7EC9422D4B523301DF207E32636BE905F388396228E6D6D1C73AA4A575777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202092, "uuid": "88079776-f5a0-4ad2-83f9-49270150b9bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202092, "uuid": "8edd7be1-5f84-43de-8e04-2ee93118bc97", "value": "12288:WMrmy90F1/WHCMLVFtcZmuyoI/yN4kO8VlHctWeJ8BqIQRZWD0BVipSBE+ci:YyuuC2VFGZmus/Y8V8BqPRQEVg2ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676202092, "uuid": "d5b8d4cc-c6f8-4946-a7e9-5d260788d8fd", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676202092, "uuid": "a92c0ebe-7835-4e46-bbcf-2f7110ec2e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202092, "uuid": "7be1264a-5ba2-43fd-8999-506dc6b2a918", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39596bb5-aac9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676201674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201674, "uuid": "24985e03-7e6a-419f-8903-767ab6ab2aff", "comment": "Malware payload (RedLineStealer)", "value": "9ef75969fce2ec1777a6f22cefab1cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201674, "uuid": "ee16cd34-4b3e-4457-b6ce-5655e3281669", "comment": "Malware payload (RedLineStealer)", "value": "867e0f084bd57432a739ba763af146071bef8c5061e37d69edfd3a50c772e7c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201674, "uuid": "288c8ca3-761a-4223-bec6-c5f90eb10f14", "comment": "Malware payload (RedLineStealer)", "value": "0e27c05a7e916281eb19c740dd4cdcd7748e6b8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201674, "uuid": "b2f8803c-a9f4-48b1-9c70-1ff5ac4f8033", "comment": "Malware payload (RedLineStealer)", "value": "3560a87e1b24554e79b6009deeb01659d27935df438508fdfb787c17474215230f452dad3d13a2d991d9d049782aec16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201674, "uuid": "d2bf2379-223d-43ae-8abe-2c827957fb46", "value": "T1FBF4120BB6EDD022E9F8AB7019F307D325353E619B348346235EAD590D322B4B53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201674, "uuid": "40d84830-79ad-4355-ac37-46c103bd883b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201674, "uuid": "e68b2bc8-4af9-4cb9-8ede-98157d0e7171", "value": "12288:8MrBy90FjOeVsuqtXYT4lnOlZeJvXHHKprjZZ2D+BcipSBP+H7w8:1yW5Vg5k40cvapZcicg9Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201674, "uuid": "bd1c481a-70eb-4430-a53a-ee689d8cb97d", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201674, "uuid": "38f7dce1-9b31-4ac8-b72d-30a9f14567b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201674, "uuid": "5a232a71-d6f5-47f3-b79b-f2e805e1c0f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c2f407-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676229778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229778, "uuid": "b7216f9b-bb46-46f5-99f6-f491510614a8", "comment": "Malware payload (RedLineStealer)", "value": "5cf0bf58133a5ccba8e4e390b053d50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229778, "uuid": "0fe4a607-c244-4a99-9df2-e3bcd07bc197", "comment": "Malware payload (RedLineStealer)", "value": "87ba81bd8ca15ca720539fca25f03617e527b2c2a428d543eefd1948d2d3211b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229778, "uuid": "e9422728-d050-41a4-ab47-0fa6578c2ce7", "comment": "Malware payload (RedLineStealer)", "value": "1c16ae8f65b522982cf42c62bd3b8c7ddca81b43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229778, "uuid": "5017bd75-7ea8-42af-876e-2ab032d34fbc", "comment": "Malware payload (RedLineStealer)", "value": "7fc0a15e14f2bc7d5281eef3c6a1fb52ed1dd1378c1728e0702d025eba9c4bafdf34bdd25661de865b56c283134403d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229778, "uuid": "8880a944-a991-4dfa-87ab-20411f5f9dc8", "value": "T138F4124BA7E89073E9B5137118B603C30A3A7DB10B7853AB274E5CAD4963AF05A35377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229778, "uuid": "91597ac8-59a8-4839-b84a-ab076ea701ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229778, "uuid": "5e19a358-5885-4769-b9ce-f2251bc165f8", "value": "12288:HMr9y90Zx45AH+3AAi16JwwSW1Qg5+No88owQIPkHFQVNon685uDOJnIHPwgYW6J:iyI45AH+jiOUW1QFm88owQIMHFQ365uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229778, "uuid": "e05ed05e-24e3-43f9-83be-38de8d695880", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229778, "uuid": "b1a71260-5c69-46ad-b885-489104be4938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229778, "uuid": "d3e20b53-a683-4038-b913-2d8ae9c3052b", "value": "5cf0bf58133a5ccba8e4e390b053d50a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2324af64-ab00-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676225259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225259, "uuid": "347d02a2-cad4-4f10-b39c-0b40f28a042a", "comment": "Malware payload", "value": "9275339d8a6f73e26ff142e8a846f627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225259, "uuid": "c74cc0b4-871c-47ac-9b33-90ae576b584c", "comment": "Malware payload", "value": "87ea7cd5107ade708abb4f7f47815fccab81bc11af9837f43a39e05b8c846fab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225259, "uuid": "2a6c6c39-4108-4e9f-a37b-0fb61c9f1c91", "comment": "Malware payload", "value": "8f26249658af2f1a65324499f74db39a2f5ee91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676225259, "uuid": "748d01a6-ef1a-43d2-9f56-8faf2946235b", "comment": "Malware payload", "value": "43961e9f91876cb3d632556ef0891b2e190b4e8125ce55d2c3ed2e06203ec2c2472f5add263b110db71e4fcf875dcd3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225259, "uuid": "bfa75e60-6263-42ff-a9f5-76890f0c9fc6", "value": "T1EAF41207F3F88032EEB467705CF603C31B367EA09A38939B668AAD591871564A335777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225259, "uuid": "561baa01-d781-4bb2-aab2-21b34c3d5867", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225259, "uuid": "a07b7064-d96d-4585-9c57-1e1fee4a7170", "value": "12288:5Mr1y90zTiBEhjY19HI89inCZRUeJCPHSqiV+PeI/yXMV8cCscogc6BS:kyjBaM19o/nCZHCDPeEyugh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676225259, "uuid": "e60fc829-4632-4819-bcc1-6c75dc9ac811", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676225259, "uuid": "946c2d66-924b-4d4e-819e-c93499d7e227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676225259, "uuid": "407c4df2-eb9f-495b-a84c-741695cff5e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9f215a-aa97-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676180421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180421, "uuid": "d23ddb37-54eb-4362-a0f6-aeb17d33236b", "comment": "Malware payload (AveMariaRAT)", "value": "c5e8642e8f49440de053d0b91c5a9d26", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180421, "uuid": "35f1bc40-753a-475f-bf77-b74c55cb2d2e", "comment": "Malware payload (AveMariaRAT)", "value": "88af0757b5651471d5eace5b8de13aaef8de57b81522198ece66b09528e54610", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180421, "uuid": "dda532f9-2e45-4cdb-bd4b-05e2734d0b98", "comment": "Malware payload (AveMariaRAT)", "value": "dfe0f7016666b9a339c06b44bec27348689a686e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180421, "uuid": "0093453a-5909-4412-bee2-a06ee9ac8145", "comment": "Malware payload (AveMariaRAT)", "value": "0acdd1c70579f326223a3555333c45c5844a7deef211cca8f07e5ce18d9fdb54d8535d412e97b62899197151b7ad48e8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180421, "uuid": "b2a7e40e-f61a-4861-94c7-01bbc87180ea", "value": "T153F4135142FDC6D0DC5A4AB4DC6132A513B776293034EE2C9E8824EF6E22F45C6B3A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180421, "uuid": "450a23c6-36a7-4b33-a2b0-d2b9dc32851e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180421, "uuid": "bd26cf8f-b47f-4e56-867f-eac7edf3e1ed", "value": "12288:0TuPA3UtOsyR9aURwJFI48apFw4HYbqA1F88lhAmB+Orx7p58lCrd4gyQapWMs:DA3Ac5RAjpa44bf1ZlVrxN5IC54TWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676180421, "uuid": "6a32b6c0-1d30-4999-8dfc-86fdabed338e", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676180421, "uuid": "fa6a45ea-74c1-41a4-987b-72e1c89c2a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180421, "uuid": "ac13e303-3156-4e4b-ba66-f4a9cd579813", "value": "c5e8642e8f49440de053d0b91c5a9d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b30b28-ab05-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676227631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227631, "uuid": "cb6b99af-9f22-4f77-9d22-06033d84338b", "comment": "Malware payload (GCleaner)", "value": "fbb5e8e8efdd67193b8e96a4dfa0fbed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227631, "uuid": "a4f5946b-f376-459e-b057-8d5eb32d264b", "comment": "Malware payload (GCleaner)", "value": "88f352540b61a98d9594999ca155cda9ba4cfa4377586fcb34fc0fc8dd30948d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227631, "uuid": "95db167c-72cd-4332-82b8-40b8bc043411", "comment": "Malware payload (GCleaner)", "value": "5e4f05721b0bfacaee12e743f64339d173e7b4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227631, "uuid": "6d3f8f32-b145-4534-8db9-41752c1f1344", "comment": "Malware payload (GCleaner)", "value": "41962e079b8045eb904064a2210dbf2e393de51f57bf56148eb85699226b995cafabeb208f0a2f729887350b56fb66dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227631, "uuid": "2e931431-b0cc-4734-a743-4d2130e5bec2", "value": "T16BF5123D7115C86DC290FEB4882698F79CD66EE3E8E49062B0DDBF3F51795888B0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227631, "uuid": "7aaa822d-1c46-4d34-83be-ace046e3c375", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227631, "uuid": "3a81f95c-9098-45ee-82c9-720b34d2adfc", "value": "49152:rdH/QoIgtUbEVItAAkFUUP97ukNLy3R++peZCjEa/NcBeg+wHIXvtaEasiWr+LCU:JHI/gtimI6AanPP03dh0H7Mkqev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676227631, "uuid": "1b8a6d89-918f-4ff2-aed8-b4b65104eb8a", "value": 3609887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676227631, "uuid": "6e107151-b320-45ee-b5ee-232357b2e2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227631, "uuid": "9ef00bf1-c3c3-4313-a9f1-c1e7ca2ba65b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e150b45c-aa9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676183917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183917, "uuid": "a5c60988-8de8-4394-a4ed-5acdff7342b5", "comment": "Malware payload (Amadey)", "value": "c4ecaf43972ddfd22e17d5c706fae365", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183917, "uuid": "65055cf4-3a62-4a4a-8699-b8b3e04c3e06", "comment": "Malware payload (Amadey)", "value": "895dd70b599977394169086273ffc43932234bde4430ae5f0d90493983219e87", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183917, "uuid": "0ad4fa4d-182a-4a3d-b860-3ec5a45756bb", "comment": "Malware payload (Amadey)", "value": "42f38364f28740bd517bd823f2cdd50229d60cac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183917, "uuid": "ff2007ab-0858-47fc-8483-bfee413bc838", "comment": "Malware payload (Amadey)", "value": "f726329761877f6f68f7762bd5185d220d6bfe678aa3c029eef5cfb5fda65ea6ba543383df20c524adea991c5e815d66", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183917, "uuid": "9bbb6d37-d80d-467c-a409-e51dcda9df29", "value": "T14AF4120BE3ED8422D9B217300AF302C32B3ABE61573893AB575F6C599D726A46534737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183917, "uuid": "ebe7fe28-2620-4f25-912e-845309be08f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183917, "uuid": "c90ce07e-bf87-4e40-bbc7-041c4cbab8ca", "value": "12288:NMrFy90+UWfjx03sZEgobgsnlPLoXQo1pbeJ/IscSNNKd3X3Orx1rZt1gF:EyjUWfjzto8sNLoXQD/C3X3OPrZt1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676183917, "uuid": "83d1a24d-89e1-4503-acd0-c48229d3ffb1", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676183917, "uuid": "4e53ff03-72c1-4698-96ed-27a3d8ead453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183917, "uuid": "660b7e11-09e4-4297-b38f-7912bfe03f95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d546ef02-aad8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676208378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208378, "uuid": "0ce23a79-9e91-4c10-b7e4-45723fe8246e", "comment": "Malware payload (RedLineStealer)", "value": "85b581c73cee98c604bab168de75ec7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208378, "uuid": "3bf6c61d-0204-4e00-b132-22ea05b0017b", "comment": "Malware payload (RedLineStealer)", "value": "89dd56dc6f73d57ee0839d583b18f02fbe50b267628f6f7aadf440d91077eb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208378, "uuid": "fd82ec9f-010e-44af-bb20-0f69f3f4415e", "comment": "Malware payload (RedLineStealer)", "value": "2643b4b5b3b83d8261c810c997f87021324902f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208378, "uuid": "ea4fcb93-11fb-4f6e-b7ac-4c9cab26e55e", "comment": "Malware payload (RedLineStealer)", "value": "41eb4426daca619213727df64760a20e2259c0054f50e37dbfea0ad6a35d1986ca78ec623ba1c0497ed4f489738b5105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208378, "uuid": "2fe77577-c39d-42a6-8fee-44de9677c2b2", "value": "T186F4121BB6F86422E8F6B73059F702C31A36BD614B34939B638A5C5858727B0B13537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208378, "uuid": "c292506d-2194-4059-a839-a360fb370266", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208378, "uuid": "8e25c9a4-46b1-4a47-a05e-5a44504257b5", "value": "12288:0MrLy909GQ7e8gKnNMTIwWSPuJfoceJlGT9NUdkREtorfXoX3g/9ymk/:ny3QBg47wW9JaS9REtorfR/IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676208378, "uuid": "4cc8279d-1593-4f89-820b-a7a06761f9b2", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676208378, "uuid": "aba89040-1dd0-49ad-9da7-f103fd0926c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208378, "uuid": "88b836b3-55e8-4003-9f2a-59c520ef235b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cc9235-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212112, "uuid": "7dd73e93-d522-4213-bef3-aedc0ce620e0", "comment": "Malware payload (SnakeKeylogger)", "value": "38727f3a7eabca224cf879bd19bd6b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212112, "uuid": "31bb1a9a-b4bc-4a57-9315-14590dd058b5", "comment": "Malware payload (SnakeKeylogger)", "value": "8a7607db6a72435fb002c2f9480c08c33e42beb4d2b73d3ec14e8208f5900e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212112, "uuid": "0dab4f7b-7a8f-462d-a1c4-97c93ddcdb82", "comment": "Malware payload (SnakeKeylogger)", "value": "a1862472ed17645904ab5ea962392fdd40312409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212112, "uuid": "c56b14d0-e09b-48a0-9657-e828b9417e0d", "comment": "Malware payload (SnakeKeylogger)", "value": "bc119db363ace8ad04f218dfe507c65b62b14dd3fbf1306cc125d536ef771a5145e7e9953737aada18e9275763b71e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212112, "uuid": "79bfca93-337c-4fb0-8cd8-5d5e7931b5dc", "value": "T1D4E3291D2BF89800E5FF4A7305B16112C776BC52192ACE0D4AD2F55A2A7D690CE1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212112, "uuid": "6764bb02-4f0c-41b2-b492-9f81b4ee5772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212112, "uuid": "3de7289b-820c-4703-a3c1-96a93290e0a8", "value": "3072:SAgAEzoHj/LDdBEMnb82pdtywBj2iFbY:PaWwsbp2Gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212112, "uuid": "ed3a1999-151f-413d-a7dc-68a9140562f9", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212112, "uuid": "47250c31-5492-4a73-8227-568630875905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212112, "uuid": "74080a8b-cad3-4c57-8cb5-dfb096447548", "value": "38727f3a7eabca224cf879bd19bd6b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3466833b-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676229154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229154, "uuid": "55f01548-8829-416d-ab03-4ddff52f208e", "comment": "Malware payload (SnakeKeylogger)", "value": "27336a1e57433ad6061be9ffc60a8ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229154, "uuid": "be1804b2-c839-4827-b303-40cd49f7fd78", "comment": "Malware payload (SnakeKeylogger)", "value": "8b1b5fea910a93b2ac0a5a245e21796e1cda2bf180e665419ca369d167775552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229154, "uuid": "ba9fe7f2-65b9-4179-930a-0baf628fdf51", "comment": "Malware payload (SnakeKeylogger)", "value": "e96a0c9b26e5bdcc43d840297e8f759f639315b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229154, "uuid": "df0938ed-f532-4822-bdbc-480284bfa31f", "comment": "Malware payload (SnakeKeylogger)", "value": "80587840c997a4be30a9b1144baa63a3504f42882a061e547cb6afe2ff1df50106dc00bd7edac3ddaf7dceb6f27473d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229154, "uuid": "2cf50f5c-6e9f-4927-a0e5-08888b6dcadc", "value": "T17D243A5A7BE48810E5FF593304B09561CB3AFC521A2ACE1F57D1B52A1F38690CE16FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229154, "uuid": "80a1b95c-2a4a-4295-a0fc-599f6a4580dc", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229154, "uuid": "f3bf03ef-d30d-4891-a115-842ff546408e", "value": "3072:+qqaM97eOTPiK3DruiiF/XbKjPY18ljAgAEcCv/IgOYrvQ6pGNF5b8Q4wwBWjO/Y:9CteODDmzKNwFyI69pkF5bVOtbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229154, "uuid": "ea208f52-93e6-428c-aaf8-d490759996b3", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229154, "uuid": "f792dfd8-eb0a-4de4-b292-deefad467351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229154, "uuid": "2a743c5c-07da-412b-8661-0876f92136d0", "value": "27336a1e57433ad6061be9ffc60a8ad8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9de0247-aae3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676213110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213110, "uuid": "6fec38d2-2647-469d-8ae4-ed63e0124158", "comment": "Malware payload", "value": "cc2a02b46d15d0482d6f21428736c8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213110, "uuid": "08f48e62-cb4f-4018-b759-793b47d9e8b9", "comment": "Malware payload", "value": "8b2abeafd2a4ceb6a3a70e5cca44fe62caa77109cb66bd8d76f38a16931ff486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213110, "uuid": "0ce594bd-c3e7-4962-8803-c34ab555f560", "comment": "Malware payload", "value": "7b17810a60bfea80efbd09449a3ff4037ca09afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213110, "uuid": "7dbc5624-40ee-4b42-b698-6eb4c0c1420b", "comment": "Malware payload", "value": "6bf75ce842527b158f19e71e14524cc464ef223837e143fc57a543fa864d5fe41f3f93b8f0eb2ebf232ea242d96efa73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213110, "uuid": "5142329d-59c8-4825-8c1a-a5ec89f6f5eb", "value": "T118A52301FDD18573D41108354A24AB6265BEBE312F16DE9E73EC6EBD98740A1B730AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213110, "uuid": "0d36afb3-cb5e-4b5f-ad75-7a47b9cc1ae0", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213110, "uuid": "87fa26f7-d08c-49cb-bec9-99d2c4de431f", "value": "49152:V5ODyZ2wb44qp42v/Z6S156cY08b/S1ihzUVxjeu:V56KE/AVRS128cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213110, "uuid": "cfac40f1-aa26-4e09-936b-97cbce13e587", "value": 2152100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213110, "uuid": "14f8729f-e535-4d28-96a1-8b4c922cd191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213110, "uuid": "3ff49d07-e6cb-4940-957e-8373ff44f4b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a206318-ab2e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676245135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245135, "uuid": "88c5fd76-8794-4af8-93cc-d5de8d51f86b", "comment": "Malware payload", "value": "7181484c833fc298ba1e87fb5393eb61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245135, "uuid": "aab9c345-3c70-464c-b0ab-23efd96df72c", "comment": "Malware payload", "value": "8b6dbf9359d5ca55f91ffa60880e7b97698c32961faf50974eaca488eb0edbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245135, "uuid": "cf897649-2486-4103-812a-4dd1c2d5050d", "comment": "Malware payload", "value": "7c022ae3fa3cfac3e86d9d0ed16b73dd735d842f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245135, "uuid": "a3dd05ee-0aa9-490c-be05-24e239b0b345", "comment": "Malware payload", "value": "ab2516b9a8edc3e8d0f49be9959fc9d6d234f283e05144a25eeb3f4022deca8b133d9866bb190ca30ea5db876944f074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245135, "uuid": "d42f251d-c12a-4577-9346-d7a4364cd651", "value": "T1D4F41217ABEC9032E9B6537019F203832B3ABD614B35C36B134AAD595D722B4F13572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245135, "uuid": "c3166868-bc5a-4c26-8bff-888c35bd294d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245135, "uuid": "3f466a25-6620-45b4-89b8-39063b10f074", "value": "12288:DMr2y90OQw523gDShue5RFePttqsyESceJxt4MVvdC+jnR0rjkoqHRk9:pyppyXseleHty/P4aXSvwW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676245135, "uuid": "c8792c9b-3b5b-4d66-abf5-7ce9b100db53", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676245135, "uuid": "188e8fdd-7ddb-4a93-9618-b908de8b6350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245135, "uuid": "bce7ff5b-1889-4f56-8a32-27275a8380cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b2802a-aa9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676182656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182656, "uuid": "90b24b86-cbaa-4c24-a895-2df8ddd7a045", "comment": "Malware payload (AgentTesla)", "value": "5b0486f9e916e11a47c1e4e4059ad74c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182656, "uuid": "6ed0a3b5-9140-4d03-bfb2-6cffe96f84ea", "comment": "Malware payload (AgentTesla)", "value": "8dc848fe48c310842fd7f7376f5f462e65587a6368238a94b851428d184c8b02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182656, "uuid": "c8b3b742-23e2-438f-9f68-828f1346c32b", "comment": "Malware payload (AgentTesla)", "value": "c36ebc54830eafe3161d93bfd053e0c9930978a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182656, "uuid": "c9cf161d-5561-4753-99bd-27f3ba3a77f2", "comment": "Malware payload (AgentTesla)", "value": "bd4994de0dcbe62c523cfeaf21562e5613ab59f6cb281e6321abddc4e9e192b59fda6d3dd50d49b357f4ea9914d7134d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182656, "uuid": "dc03959c-fb05-4ffb-9f82-e22ec388efd1", "value": "T11605063D697757D6C338F93186E18420B6EEA1823703F969DDE61AC14F02682BDCE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182656, "uuid": "b124fd14-62b3-43b6-932b-856a777bcec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182656, "uuid": "ad50f19c-d4e2-402c-b1f7-6801379f6f6c", "value": "24576:tojP3jseHKNTn7tunA+/kS08MfmBm8Jgyrx6KlgQZx/MrEVIG:POayIugQPWtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676182656, "uuid": "98feef6b-62a7-48b1-b534-145b75c84d5e", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676182656, "uuid": "7816e2f7-27cc-4e33-9134-3e375f360f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182656, "uuid": "aa8953ac-2956-4da0-8288-81b509482216", "value": "Balance payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60811d4-ab23-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676240618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240618, "uuid": "1f460dba-3b73-4fd4-b9e2-46069d34ec49", "comment": "Malware payload", "value": "fee154981447052751b53f7146c9a49c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240618, "uuid": "e8d14526-98f7-4371-b7e6-b47ae7d7d709", "comment": "Malware payload", "value": "8e27abe6714d45519758ad1ad6a7aad3d3c3632bf7eafffa3cfaa2f6ab7cf80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240618, "uuid": "3e28b525-d90f-407d-a15a-eeb120f92fb2", "comment": "Malware payload", "value": "43e98cd2e0bce78c92b0d6843e2d234cf0200be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240618, "uuid": "b61324c9-0a23-41da-b475-615e18092671", "comment": "Malware payload", "value": "9aa58c62226312ed25f4f98b61f1efd98540c20589e4dd9645a4d4d85a49a219e582dec7c05b93db4aed6431b9d3d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240618, "uuid": "6898b3b3-f3c9-485d-a642-e17020b3021f", "value": "T145F4120BBBFDA432E8B597B009F203C32A3A7C515B35469E234B6D4918725F0B63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240618, "uuid": "43ea106a-77cd-4892-ace9-cc0d9121aaee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240618, "uuid": "241583f7-7ee6-402b-93cb-16bf4a422fe6", "value": "12288:3Mroy90B+/lvVABtgVhCWOBd3VeJxxv4mCUjqR0r6k2qGRg:PyLVjVhCfBdmx14m4SG1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676240618, "uuid": "521242ff-1830-4cfb-9111-3260145099e8", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676240618, "uuid": "03b06cc5-4851-4f6d-9de5-f55a4f36f103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240618, "uuid": "52319862-94ba-468c-993e-d1917ad19c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc019e2f-ab1d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676238025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238025, "uuid": "b7fa1d4c-8354-4ee4-9cb0-ef01d566f7a8", "comment": "Malware payload", "value": "eb29869c725dd87bea4cdefb0bcc9426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238025, "uuid": "dd5e518b-a4a5-4613-8fc8-cf5b68ea9d08", "comment": "Malware payload", "value": "8e6f43381c9f193767c4dfef68e809576baebdd47bacfd77a1dec41826f4a77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238025, "uuid": "08e7c063-207b-4c0e-b74a-b4ad58697ac5", "comment": "Malware payload", "value": "ba42e8b7fe5cd8981cce8b2f99d5366f9d2b0334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238025, "uuid": "6ddb1d5e-7106-4a9f-a151-a28bbddbc1c9", "comment": "Malware payload", "value": "909406f4e8f48a2eeb99596bcddc576077135850d0b79c8566f844dcde6a42a139112a6c64e0eaee7ab7d9fdbfd420d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238025, "uuid": "52a06e2c-e453-4130-a435-37f61cd6ca37", "value": "T170F41207EAFCA022EDB123701CF513D71A357E905B78815B528E6D0E1C32AB5A27576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238025, "uuid": "c81cc6b7-3169-46c9-b819-5b92d00f41fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238025, "uuid": "dfac5beb-d8cf-4f44-bcc2-17f0a0922436", "value": "12288:+MrNy90p7rfLU5ir5Rk/eQqiKoivyHSaieJCUKiECV0RHcg:rym3DQYy/PqiKoiKy8CUKiEzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676238025, "uuid": "dae27b75-62a9-4834-9131-8849e924e539", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676238025, "uuid": "c7e3a44e-8ace-4fbd-a1e8-c3c649a52cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238025, "uuid": "3bf6de33-6ce6-4e7e-b80c-1a5b638a65a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d9fc23-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676179415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179415, "uuid": "eccb7d49-f24c-4d7c-a414-c379655755e0", "comment": "Malware payload (Smoke Loader)", "value": "82ff63a0c5c11b9851b1271d5f35e512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179415, "uuid": "c41ebda5-18ab-45e1-8a20-a147bbb83e95", "comment": "Malware payload (Smoke Loader)", "value": "8ec153006001710c5af009de93c309fa9ec47c74cc204be54c024ead4965998b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179415, "uuid": "9c31856f-6b9f-43a2-9c88-f98ffad642b2", "comment": "Malware payload (Smoke Loader)", "value": "924cc0612ab020389492e0aeb80b0ab83be9f188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179415, "uuid": "c671bb06-1db1-42f1-9e6e-10f009b81b3e", "comment": "Malware payload (Smoke Loader)", "value": "a1c5119c28f96c8a9acafc38f32b8b83632ae1502599f667508b68ffef771893144eb8c101d82aaa1772dd651cade0ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179415, "uuid": "1c2f8b1f-41d1-467e-a21e-26f12e4bcb4f", "value": "T1D814DF0176A180F3F5674AB51924DEA16AEFBC715791C1FB33C81A6E1D303C28E7A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179415, "uuid": "29f8c333-4d78-4d26-b60a-393426fc9683", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179415, "uuid": "ef8b9552-d495-49fb-a009-0d6de51fc3ca", "value": "3072:KjquA+0Jy725CgCjyVrA1zZEYB6roO5KrWqnPRyTLfyTbtG:KGNR6gyHB6rbKr7PsTLfcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179415, "uuid": "ed121cf3-4c0c-468f-be71-ee097296269e", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179415, "uuid": "2a437d18-22fc-4ba3-ad28-8995db712b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179415, "uuid": "ee7c2aa3-e168-4dd1-a3c2-fd1f9a7c03b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dda622-ab04-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676226935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226935, "uuid": "1dcdd8b2-5783-4460-8448-f0deff647034", "comment": "Malware payload", "value": "78aad99fcb139ac6f53cfe542687bbac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226935, "uuid": "a4e7190f-4c53-4119-8c9b-8e0d18f70b78", "comment": "Malware payload", "value": "8f1e234ac214c7cce8cf922577f6053c954e9325ec3d5f1b3b4b99aa07c38ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226935, "uuid": "22fe9f5a-8f89-4944-ae30-c8a8e10b66c5", "comment": "Malware payload", "value": "1dda1e3a89a1fd762cfbd98ac26268aba0e38657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226935, "uuid": "d8248aaa-6ef0-4156-aaf2-2a6c8505ac2d", "comment": "Malware payload", "value": "f7e34fff3ba272910619fa313bf651d4611b393520549b0557c213c2bd13aaec55c2f0373497296b734b55391bbeaa5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226935, "uuid": "27ea42a7-c1e0-4228-b1d6-326bf790d98a", "value": "T10304CF113691CC72F192C5755433DAE26A7FB97157A9C0CB23043AAF2E3C3D24A79396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226935, "uuid": "165e86b1-c8f8-4ad2-ab30-af2002043a87", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226935, "uuid": "fe3718cb-ca6c-4c1d-aba0-760a2cadfcfe", "value": "3072:X76kS+Hiks8R56U0Gfp4tJx/ldIje3PgKZ5hfPAhr:LICg+pQJxdCa73hfP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226935, "uuid": "dcafb2fa-c191-4f69-b570-3eba4677dc56", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226935, "uuid": "4fddaaf0-1a46-4c69-8e96-163ad44cec77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226935, "uuid": "19e64465-ef2a-45ed-a073-a91c5aa422fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bdef8d-aaa2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676184923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184923, "uuid": "9cd3853e-d59a-479c-bb0e-abbf84620ea8", "comment": "Malware payload (Amadey)", "value": "4466e779194aadc20a7261aea5a19dc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184923, "uuid": "bc4ff493-4d56-4786-9bed-90da5c8ba66c", "comment": "Malware payload (Amadey)", "value": "8fb3eec35e6e4954ccb4891e8b388c31003d59fef7d2a45df9b766d4fe658548", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184923, "uuid": "78d2ef0e-0dd9-479b-87b6-2b3c8e1b8ce6", "comment": "Malware payload (Amadey)", "value": "a9000e2371b2b6851d90d577659f6a7b11164b21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184923, "uuid": "d275abcd-1c35-4ca1-8dbb-4ece195d3e16", "comment": "Malware payload (Amadey)", "value": "bf3f290fd38c424c79ea56711792d707f40d70b39bfe510b80ef5843e70984bab1464de8f1f57e6fa9a919cfc72a6fed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184923, "uuid": "3cdba917-373d-4b70-b32d-940975488a91", "value": "T197F41217E7EC9532EA7167701EF603C30F3ABEA05674525A139F5C5A18326B0A23673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184923, "uuid": "96287a38-593d-4fd6-bf16-7853a9833052", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184923, "uuid": "336d9f02-346f-4f05-80f9-b70240ff4080", "value": "12288:7MrMy90Ci/if+eo+QUVVeD9/ySjI0TeJpHJWhbhxnJBHX3O/x1WZt6B0Qf:/yo/if+kTaZ6SsLppqHX3OjWZt6SQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676184923, "uuid": "8d582f83-1449-4c7e-9e1f-87f63205f2cb", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676184923, "uuid": "7143fc30-dc04-452c-b4ae-f9958b9e83e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184923, "uuid": "49742f32-dd61-4ba6-802f-c5efe4bdd784", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ef1aa-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676212049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212049, "uuid": "585f1873-e3ff-4450-aff9-9ffe0e56893f", "comment": "Malware payload (RemcosRAT)", "value": "b6f9ea1de43b41616fe3729b5cf090c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212049, "uuid": "cb29d98f-a0f8-4cce-9d72-67d97cd54890", "comment": "Malware payload (RemcosRAT)", "value": "9172e039e1e9412067ba121f93ec85c4883992eefe71438b6b02e0635152732d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212049, "uuid": "fe8e7248-9ff1-4b62-b37c-b9e656628952", "comment": "Malware payload (RemcosRAT)", "value": "c0d829beb198e8bee4be996ca82a05ccd275e847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212049, "uuid": "4e08703d-64d6-4a2a-9d9d-a9e248a43122", "comment": "Malware payload (RemcosRAT)", "value": "e4286d954bf06510d0c10a8118b9f5c400a805618915407e28ca756433a5fe4d1713cd900e2e1226f747008091d18b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212049, "uuid": "5e65a7c4-9552-4649-9f79-23498a289a1f", "value": "T1DD5522652214DE50D06407BEC8B69AF017382E79F960EEDB6EC67DCF7A31B616044AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212049, "uuid": "1731ee1c-f6c0-4049-a5e9-91d5fa103df4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212049, "uuid": "8fc87e44-1fa9-4423-9d61-11b3d9d27e14", "value": "24576:T1bgzPGhgzfY1r3OIc99RORYpnOOH6WRwbeXWJ0+DwMYeP:TZyPyywYIcXRQmnvHXGiy0EwMYeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212049, "uuid": "d23c8d46-b991-4730-8a7e-a4ae080fcdf9", "value": 1294848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212049, "uuid": "f9fb9153-ae65-4dac-a374-c2d316d15a11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212049, "uuid": "33fa3ed0-225a-4088-bdc0-ced06f20ea4d", "value": "img Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80ef793-ab14-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676234099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234099, "uuid": "93e15ec2-9a05-4abc-b51e-4c5ff864a396", "comment": "Malware payload", "value": "66a2fbd13bdd6f73ca3081d8886d1c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234099, "uuid": "4e7c49f5-b09c-45ac-9527-832fe9bdd8ac", "comment": "Malware payload", "value": "9298e890ac4830d1d5bbc81c5d4db01580733536f0d5464e9951821e11ae8c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234099, "uuid": "e7a527d7-3c5c-4e0b-99c6-341cbad58194", "comment": "Malware payload", "value": "83ca7dc798fcce97590a39d0b4649987b6358c96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234099, "uuid": "2b22166a-868b-4eaa-8f23-914e314f258c", "comment": "Malware payload", "value": "8ab0c0dcd5ddf463d599b07fae513f83cffb03b6cc6ea06d21515abbeae8be592660c7eaad38cdbd08e173709004d17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234099, "uuid": "213e1aca-693f-4184-8cf7-2f7bb8e48873", "value": "T105145A1C68F99311E1AD87FE86A36534A37F7B83B88AD61D0DD661DA1D347E31084C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234099, "uuid": "f0875c82-b3ff-4c35-bb39-c5918445112f", "value": "6144:/HCtn9BoO/PF6f3A8/MIx4Qw8Gei7UzQqONWV/E+oWk:/HCtn9BoO/N6f3AKSQlQXD+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676234099, "uuid": "4bc78ad9-300d-4010-a279-a94d364bafed", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676234099, "uuid": "6fad883e-d5ea-45ea-a0cb-5b9fd72cf655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234099, "uuid": "d0520f9c-3731-4e66-8b16-1eba350e9e4d", "value": "SecuriteInfo.com.Trojan.GenericKDZ.97438.19379.2571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d24d39-aa94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676178989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178989, "uuid": "675fdf4b-6cd8-48a0-af60-7355dfc1b6b7", "comment": "Malware payload (RedLineStealer)", "value": "c62f2f58e0be58e2af6673686f0feb6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178989, "uuid": "65d7986f-f4ce-4ebd-a598-1f1b311456c5", "comment": "Malware payload (RedLineStealer)", "value": "9314e825a99844dfd01d986cabe7bd005eabafcaf74db166c33c8ee020b75e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178989, "uuid": "d53fb2e0-20c6-4b4f-a740-06c1c577d3b7", "comment": "Malware payload (RedLineStealer)", "value": "40aa481ded4fab522684544284b78ef24077214b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178989, "uuid": "1631b21d-a53d-4c1a-8961-08cecc1635b4", "comment": "Malware payload (RedLineStealer)", "value": "05f8a3f468bc3da69fa622c0ab60973ae8b56ecde65f63d6dbca7dd0715ca1a011bf1066909c24ffa14163001713f4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178989, "uuid": "cf315a7e-d505-419a-9388-ce7edfb6c638", "value": "T1B5F41207A6E89032F4B567704DFA03D31B31BD516AB0832B238E6D6D1CB267523757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178989, "uuid": "4431f651-917c-4792-a79f-df2aaf53b4ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178989, "uuid": "cc06496b-b02d-4742-9ee6-5e2fdb324e5c", "value": "12288:SMrLy90B2JwVbuX2xSV36rTTsMgZ7LyeJxAmxvIFZoCZnr6:Byg+wVb22A42R1OzZnr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178989, "uuid": "1ffa0ce5-c90d-4942-9526-b313637749dd", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178989, "uuid": "2ea0506d-612a-442b-a58c-86e4bd4c179e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178989, "uuid": "10eb1379-0afd-4e90-9d8f-45c4b0830c1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011215a1-aaff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676224772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224772, "uuid": "40447d80-e406-4122-b985-048c659e1442", "comment": "Malware payload (Mirai)", "value": "ad405259b06f9d7e9d58026543566d84", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224772, "uuid": "80b6de1b-4dd3-4968-a742-aaa58f6b4bfd", "comment": "Malware payload (Mirai)", "value": "931dc9c6a90b90f622adac475ef14aed302edd09079d0e0f11b820b1e27fa864", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224772, "uuid": "8e0b0799-5a93-46a9-aadb-178cc60581bf", "comment": "Malware payload (Mirai)", "value": "a100c9e12a3e0244c53005dac7a183608e0e2d32", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224772, "uuid": "2a52624c-df6d-4398-9905-967a3979d99f", "comment": "Malware payload (Mirai)", "value": "8efae63c06c8b4c21082854822bc7ffa893faf8100099e93b4e49cc6c119764818df2d2279b97057411534d087b6ed42", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224772, "uuid": "0dce75ab-1161-479b-8de3-05e8f8ba5a79", "value": "T106345A93AB03DD6FF86F877609E7DF7077E1A2A216A28453D1383F2922552C09D15ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224772, "uuid": "7137deae-549d-418a-a350-05aa3b57f32d", "value": "3072:L9zn//i4EtcH2WD4IT26EzXeqGMq3alA1M83o:LV//i4Ei754zOqGMNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224772, "uuid": "cb695713-45ee-43b4-a8e5-6bdd8766c715", "value": 235668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224772, "uuid": "3ca9f436-2130-498f-930f-21051bd8f1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224772, "uuid": "d89bf178-452b-45dc-8de7-744dc784320e", "value": "log21.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d392e6-aa8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676175497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175497, "uuid": "38b0cf7b-6f7c-49e0-b832-be5c37934831", "comment": "Malware payload (Amadey)", "value": "705d23ca4236a937fbffa39460e4465e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175497, "uuid": "2789e85f-04b9-4632-9985-a0c83e22ee12", "comment": "Malware payload (Amadey)", "value": "9342ac85bb8553e08d33f2afe4c31a765dd15d1928e2fc7ca4ecd056602001bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175497, "uuid": "36847117-8e51-4b48-bd62-16259fcf25f0", "comment": "Malware payload (Amadey)", "value": "6c29675a0123f04f156d67a7a17a4b9b56a11d10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175497, "uuid": "9f05010a-0f68-4177-8de1-dd061f16deed", "comment": "Malware payload (Amadey)", "value": "7f33d89427e6e3f50d744fa985a5a15fdd32fb928df4b6866c616dab370243c2fe47952e1df1fb3212052bd0049ec3ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175497, "uuid": "8064285d-cdb1-4b2c-8ddd-c0f81902f9bd", "value": "T136F4121BF6F98032E8B1A77018F602D31A357D504B74C76B278E7DAA0C726B5A234767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175497, "uuid": "f39887a0-4037-4154-ae24-5e070efad72c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175497, "uuid": "f672d88c-ae3a-41fe-8ea3-dd356c3c016a", "value": "12288:yMrSy90b6UGyFp1PxvwEhjQ8L7EnZtKkeJP76lTe+CHIcRuiQGXqB:wyKxtVwejpoZtuP76phCHI4Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676175497, "uuid": "9c6db688-e22f-47ab-90ce-dff43d733bf6", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676175497, "uuid": "aa61015b-a91f-4d64-9e11-2911dd7fd434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175497, "uuid": "cef79c38-d3c0-48d2-9e5f-2911fe2d5a4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eb0a03-aa9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676181502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181502, "uuid": "72179452-12e8-4212-b2f6-ecc644754daa", "comment": "Malware payload (RedLineStealer)", "value": "1a86d3aeca9b2125afb9beadd553484a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181502, "uuid": "6c99880b-7b51-4743-8046-927e90d475e6", "comment": "Malware payload (RedLineStealer)", "value": "93fc3af9de156cd76010d6173fb9aabcb0eed962838673b77f57bd7a4cab20ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181502, "uuid": "6f4df2e6-c8a4-4e26-8fe5-6c9e976d5989", "comment": "Malware payload (RedLineStealer)", "value": "3afe5317d490c213c06f9497276df60cdc71ce75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181502, "uuid": "7b8394c0-7a7a-4dff-836b-8374988e12db", "comment": "Malware payload (RedLineStealer)", "value": "5c6e510543dab29613d03f77759393e150341fef36554b410c2330f1154c3b12413e20ee5d5a1c36b3a61a9b959028f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181502, "uuid": "efc26a56-06df-4f18-8651-5c736cf6db04", "value": "T1D4F4124BEBDC9423F9B4577004F303C31A35BEA16B34826F274B2D856D71AA0A535B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181502, "uuid": "49b8fdbc-f442-4c67-8e33-a2df3e7c85dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181502, "uuid": "80952a7f-0f89-4398-8e3d-8c1269112339", "value": "12288:TMrny90sXnxNi73Tm3A/oylkKeJgYwGHm0Tx0j/InxPzf/xRxW:oy53mDjtlSZmi+uxPzf/jxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181502, "uuid": "6c389fb5-dc38-4aa7-b14b-987a42c2cd0a", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181502, "uuid": "6631c034-cead-4fc1-b1e3-344c3c07d87b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181502, "uuid": "435cf318-f87d-48d1-910d-a17cc65580ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31edb94-ab16-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676235003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235003, "uuid": "15bcf338-8f9a-4d2f-b6e5-5bd76fe002e3", "comment": "Malware payload", "value": "a385d324fbed97af65557e2cfd517259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235003, "uuid": "f838327f-c8e8-4f07-ad91-5aa88ca47e7e", "comment": "Malware payload", "value": "94f176fa4348e393a7088d23e73dd583319cf7dbabc306be05575cbde4a62338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235003, "uuid": "fcdbde9f-d212-4aac-9a58-8a958008e398", "comment": "Malware payload", "value": "392e50c716022c63935900a49294b6936c6e5caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235003, "uuid": "df575217-e56f-4d3e-bde2-810958583218", "comment": "Malware payload", "value": "24c8b5e260ae767e4a403c9319d387266b126fce49498c088d917dddeaa0c265375c81a9258cf7296bc44b3d712a9a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235003, "uuid": "609630d3-ac5c-4298-9ed4-872acd77ba5d", "value": "T101F4120B67ED8173F9B517B018F307C316357D905A3C83A6238FAD6A49726A1A1397B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235003, "uuid": "93ccbc13-66a5-4ea4-b379-afd2c2bb74ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235003, "uuid": "24589f55-0fd0-4f14-b7be-337fb4e5bde7", "value": "12288:IMrgy90od/sDk7GeL/+F/m2u8tONQO04LS7veJsqAatW2PSHaUCCnFxQ:YyjkwK2k+4B6ScRlUCCF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235003, "uuid": "2d9e02a9-cd1f-481a-9ba0-d1424961bb2d", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235003, "uuid": "2be79605-96e2-45c4-9b53-9d6c00289ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235003, "uuid": "e5a54635-a4fc-4248-ac77-0073612a8418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a014cff6-aaf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676220315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220315, "uuid": "0f5e8555-baaa-4a38-b276-8004a64b7375", "comment": "Malware payload", "value": "dca881c5f7bc04e6bdd77dedafd8335a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220315, "uuid": "e95f585f-c025-4774-bd2e-3862ca3f2ae5", "comment": "Malware payload", "value": "94ff4e97196284c9e00726860f888276b1470ca9e0d47a19d7b917de927829b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220315, "uuid": "25ef8b7e-a689-45cc-95c5-92877bd01469", "comment": "Malware payload", "value": "8c2418788690bbdfcc4f07861653a871328459b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220315, "uuid": "b7b5e4fe-7a86-489e-acb1-c034d7e3c172", "comment": "Malware payload", "value": "79b4cdecc2268e5e0eacb8dbafe3ec091f8f4cfd60444842cf1f09c0859d78a84068eef8f349e38eeda9d1554b73df5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220315, "uuid": "87b327c1-807d-4b5c-a634-e933b0fea6b2", "value": "T1F814CE1179A2D0F2F19645749835FEA46AFFF8A1936BC1C723C81E2F0E203D15A7935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220315, "uuid": "89b1c10d-4f31-4da6-b186-905ccb70a422", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220315, "uuid": "42660c02-676b-4fe8-b43f-36deabd574ae", "value": "3072:l7BM+rGmY5iPomJT+X/eHS//ajIU76KRaUV5a2TzZY/:hGLaPoOmGy/y56KF5a6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676220315, "uuid": "7b2bc6be-8b73-46be-a8c9-baeff85dd857", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676220315, "uuid": "e324056a-eb0e-408d-9ab4-5b56ff38ae08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220315, "uuid": "06196a34-9d2e-4d78-8d8c-d674ae80419d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cebc0c2-aacf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676204257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204257, "uuid": "e3c3faa1-4fca-42d5-a22e-d376c92447d6", "comment": "Malware payload (AgentTesla)", "value": "78dfa5994262c47d987d821d347b931b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204257, "uuid": "c92afd65-7e7d-431d-9891-993e099083eb", "comment": "Malware payload (AgentTesla)", "value": "96af204d2dfb74c2fba800c451c04b6c71443be7bd68fadcf718cfda4cfb20e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204257, "uuid": "07f75cbf-0fdd-404d-bc8f-4ac5be7f919c", "comment": "Malware payload (AgentTesla)", "value": "84ddd88987dbad1896ae29b2e9f90846e31279dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204257, "uuid": "32e0b463-cfe8-45ec-b101-4c647301d478", "comment": "Malware payload (AgentTesla)", "value": "cb6b7053c461c17b253d3fd02526c59bf15cef1532ae5b9e6a3ce9ce365cbc365a90cec7ccca34d79fc434f9cc869a61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204257, "uuid": "246c9203-f8d3-45c9-8027-840f74d95d60", "value": "T1C545482439FA501AB173EFA98BE474EADA6FB7733B07645D1051038A4723A81DEC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204257, "uuid": "e10a7808-de44-48e1-9e08-0a26d4f65828", "value": "12288:NauTzBmGbmJo0fFPNRLBSboXonvgu9ku88jTiDwJw2b/hd65SWuctxbjkGkBfsff:SUge/iDCYwh6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676204257, "uuid": "b0bec06f-46c3-4660-9570-68af52a090e6", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676204257, "uuid": "aa98a01c-3cc7-41c5-9d6a-f251fbfed850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204257, "uuid": "31af1a9c-26ed-4e42-a79b-6dce819b7d50", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b413201-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229702, "uuid": "3fae1b50-32fa-4a75-b3f9-1aa89ca69e8e", "comment": "Malware payload", "value": "df529cff84d61490c1a31ecf14d5b243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229702, "uuid": "0a3511bf-877e-4859-b804-5ef5f2f14b09", "comment": "Malware payload", "value": "989f96c87702737b2f45fd0dcc664009bfdab293a8762cb6b51a68fda0350665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229702, "uuid": "20f45d4c-580b-49af-8847-9cd69674a819", "comment": "Malware payload", "value": "e922ad2efb2733d0ba78603c3ced25013e8d0ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229702, "uuid": "a762fccc-95e8-471b-9f56-ecf83ed3a6f3", "comment": "Malware payload", "value": "8f15225c23924eccf1d36bc73bbc5697b1e936436905e866e049eb4ad68a7d36da3ca9a66c59daf068e0392cfe8048a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229702, "uuid": "2fba077e-b79d-4c2f-9dbc-20debb47bee2", "value": "T1D034E01176E18033D59F46F56A30D6916A7BBCB19BA5C1CB3338162E1F313C18E7A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229702, "uuid": "76574080-e639-4967-801d-415a354ce7b1", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229702, "uuid": "5eae3009-1580-4288-a99f-c75b410c978a", "value": "6144:JG1R2Hm4AFRmCHoi6P8MlkavqgHesjdpi:JGjkmzUlpHesp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229702, "uuid": "b3259416-2893-4817-a70c-d781d12d247e", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229702, "uuid": "dbfae8e2-7bf1-4c09-8631-2b996bd45409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229702, "uuid": "27ea535c-9a49-45ee-95e2-ffb44e283476", "value": "df529cff84d61490c1a31ecf14d5b243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59bbb3b-aa75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676165912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165912, "uuid": "22651951-a33a-40f4-b1e6-e87368946650", "comment": "Malware payload (Amadey)", "value": "c7e163267fdf57a99d2067668ae5531b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165912, "uuid": "bb5d3790-27ba-4baa-b18f-ca21147339db", "comment": "Malware payload (Amadey)", "value": "98bc1af9346776e92f2d06b35b63f1b98f32a9621af41383bf68dfcfaf9cee6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165912, "uuid": "659ef63e-3c88-41f5-a51a-c08f1f1769d4", "comment": "Malware payload (Amadey)", "value": "04122d07d931a9c0b64c3cec017150f248d36a10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165912, "uuid": "84d79fa6-49c7-470f-ad15-98941579f778", "comment": "Malware payload (Amadey)", "value": "7503f6e8f9ac45812e18f2e1170dabd5eeb7ce8fdf58f697e0e09e96514591ce87c6a2ba017effbac1dab00c0534fe8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165912, "uuid": "d9c9de21-1041-403e-803c-788541fb0c1a", "value": "T1D6F4121BF7EC8131D8B5977058F203C31A367EA15B38874B634AAC291C722B5763576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165912, "uuid": "5731f8fe-d4ce-4bd6-9d32-36634cb7c71f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165912, "uuid": "33aecc13-716a-4973-b770-55d5134fd2ee", "value": "12288:cMr7y90FoBVtYtErUnALzIFAodmsnheJLYizy8WUuuThHrp/yN9l3D:vyPV6vA3GAeFy8iPrNly9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676165912, "uuid": "315537d3-448e-4253-907c-c045954571e8", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676165912, "uuid": "7e895e73-4921-4c1a-ae8d-9f5d08dd3096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165912, "uuid": "cac880c8-da80-42b9-b01d-b7e106f454bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd1f601-aafb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676223180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223180, "uuid": "b46f626a-17e3-4140-a939-107d4375bc00", "comment": "Malware payload", "value": "ee648c4ace5d9ab6ddf0dcd92fd0e2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223180, "uuid": "41e9b47b-bd9c-4d09-9140-77b650ee8399", "comment": "Malware payload", "value": "98e5b5c11f5a35b4080ec488fe67d55e6c9a4a914822ba4493bc3a9c47ad1330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223180, "uuid": "869bda89-2ab3-417f-bd2f-43c6796a3ec2", "comment": "Malware payload", "value": "4ef1b023568f2b230b9a251804b527334ccde080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223180, "uuid": "d252d3b0-9d0a-4f0f-b35e-64cb954c9a72", "comment": "Malware payload", "value": "da35177dfba1d5fa2b996196eb7ef4ff162e62e2432db5a1180a3946717976fdbfead6b8bf0bc509ba6b0256ca7ed59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223180, "uuid": "a02fa271-806a-4d38-93a5-4c753b43e4b3", "value": "T15614CF1176A18B72F157A5B42822EAA06B3FF8B167A2C1DF33440B6F1E307D15E76352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223180, "uuid": "ab99f3cd-8378-4518-9c55-c7afa9fe6cac", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223180, "uuid": "5b988c08-4b9b-43b8-b357-b74c44ce9eca", "value": "3072:L7mAf+HIcE56OHz3W7hwClJsoY7V53MDi:nxC1OHbpCb2fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223180, "uuid": "e2ee637e-daf4-4c1c-ae63-5da0e68bc867", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223180, "uuid": "14c9fe27-ae26-4235-9074-f2211f02c4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223180, "uuid": "967f5cf6-013e-408e-83f1-58f536a0619b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368f4d8f-ab16-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676234741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234741, "uuid": "989508a3-6f74-4811-a8c0-358bfd704f83", "comment": "Malware payload (GCleaner)", "value": "b51b11e46152d6d07f32d780efeee386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234741, "uuid": "eab5b934-1ba7-476a-8fbb-2fe5a044feb2", "comment": "Malware payload (GCleaner)", "value": "9925d323833a28eccf5c0267f8ec23700dd3de000bcff8f2482589593a800c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234741, "uuid": "72755851-312c-4791-9927-a7bc77ca461b", "comment": "Malware payload (GCleaner)", "value": "5c2e622bba8d68e32f3cdc9e9b1a552ac96a6312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234741, "uuid": "df06292d-be52-4463-a7bb-00474af70451", "comment": "Malware payload (GCleaner)", "value": "1b9f8cb2b9fe2c176bfc09cd52e7c69ef31fc3eebc21813d8dbaa8a11cb2f42afdc78feac32b3f0ec82efdf0f28a2762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234741, "uuid": "51ab88cd-4fbf-4c56-aee2-c6404cdf3f12", "value": "T1B8F5127C7546D9ACD580FEB4CC2A98E74CE6AEE3E9D4A06270C87F3F427E1854619207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234741, "uuid": "cb0531e0-65c1-4eaf-9268-a469055b1141", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234741, "uuid": "333f0d9d-3b6d-4563-8775-18bb415339df", "value": "98304:JHlI0tt0n2pWt5uh96bD7sLKtmr7nJLv2MR:dDt0n2pWt5uh9QD7sLEmfJLvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676234741, "uuid": "18a24cb7-c5af-43ff-bf65-2c999c436b84", "value": 3612935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676234741, "uuid": "804176fb-c68e-4921-bd81-0fc4ce8b6a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234741, "uuid": "a07f2e56-4013-49e0-8b97-74ecce98d570", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6a4e0e-aaaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676190618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190618, "uuid": "3ed0937c-cc01-429b-97fd-c0eaae9f621a", "comment": "Malware payload (RedLineStealer)", "value": "93643ec32574a027573ebb216e83e012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190618, "uuid": "ff2e2a81-c6a9-4cd1-a8de-ee5973498c04", "comment": "Malware payload (RedLineStealer)", "value": "9942bbb4139a1a38ac990f88457c6fd07f71b926c777717048ac333f87c711f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190618, "uuid": "17ded912-60a7-450d-b0fb-07ac1c2661c0", "comment": "Malware payload (RedLineStealer)", "value": "8536282f131ec56ea458eddeddca27e05404242f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190618, "uuid": "4ffa8d16-3063-443d-abb4-3a4b6aa47de9", "comment": "Malware payload (RedLineStealer)", "value": "c0b1e404303b0d247eea07921116524a32fd3904ec58361d26a72d7fbac0a1ad10a37603de16179d13ed278b5c53b8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190618, "uuid": "c004dea6-7628-450f-8d8f-b05bb79bff91", "value": "T1AFF41247B7F88062E8F4477019F507C31A35BDA1663883AB274FAC590D72AB4B236767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190618, "uuid": "0ca8a47b-7b26-4608-ab12-98aae779b33b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190618, "uuid": "caa7a978-e07f-4ee2-b2c1-41489a9eafd1", "value": "12288:SMrhy90LGIwl1IHCtdf5k+QypZyQbeJYF0P+/6ZXo6Um7gwPogDT1YuM:zyEUlNS+QyTaP+rNm7goGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190618, "uuid": "1dd2fdae-3089-44bd-8ffb-26d80c7f7f39", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190618, "uuid": "fa78f31e-5937-4be1-a61d-6268b425f0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190618, "uuid": "b6c9196b-caf0-4f9d-b4c3-1996e7478334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d6bf9-aadf-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676211196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211196, "uuid": "7e275db0-3b81-471e-8cd6-43b4204b6ee5", "comment": "Malware payload (ManusCrypt)", "value": "eaf6246b024a3a96cb865f087e15e896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211196, "uuid": "389be1d5-e2a1-44f8-87f1-901b95c5a6ff", "comment": "Malware payload (ManusCrypt)", "value": "99c1e9b26ff369764907dd0576d3ac4d9aa4db2f8a85fea23a6dd22ff6df1922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211196, "uuid": "e11882e2-d204-43b0-bb53-d56b10f09a8d", "comment": "Malware payload (ManusCrypt)", "value": "7872f89912281e83438fa7dba673bd22753e74cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211196, "uuid": "98f7f197-138d-4430-a953-370d4e598f4e", "comment": "Malware payload (ManusCrypt)", "value": "3ae25a6ba3b52fab2174fc9755cc597c61315421c0121f318c1bf11f75fe01ec999800886e995c7b4d30138abe618e80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211196, "uuid": "3d3ae1ab-4351-4716-ab5b-be80374efaff", "value": "T11914D0217691D032D12384B19835DBA46EFFB8B16FA5C1CB33881A6F5D702E24E3D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211196, "uuid": "2a69bc63-59c7-4eed-8fb4-039e31cb68ed", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211196, "uuid": "9cb35d4d-1199-4cb2-a07f-226e903ab548", "value": "3072:V7Bx+rGe56XlNCs1SjqB6OgFCnf5e74bvoJTov2BU:xnL1XXdSjU/gsf5wCv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211196, "uuid": "cfd9f0d2-dc9c-4c3f-be84-6fd85db7d0a8", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211196, "uuid": "05261003-3a82-4734-bfec-83bd65b5f515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211196, "uuid": "c6fcf892-1db4-47ab-8b8b-e1685e9d6207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3a95f6-aacc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676203264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203264, "uuid": "e7d6b360-1290-43d1-bb76-5434ebd786b3", "comment": "Malware payload (RedLineStealer)", "value": "5f6cb4b4c68dff87d2f154a587509577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203264, "uuid": "6a2383d1-ddc3-4d84-85f9-8869025a6b99", "comment": "Malware payload (RedLineStealer)", "value": "99f13bda1fef34468cc3bb954f715af6dd8cc334afd6cc1c25ae8e8d57e8a8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203264, "uuid": "f447ba84-16ea-4c2a-8ddd-9641a1255371", "comment": "Malware payload (RedLineStealer)", "value": "93752ad2464b0c1d2a0f1d5000aef50317a9bad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676203264, "uuid": "f13ba742-fdaf-42d0-b2fb-7664be48bde6", "comment": "Malware payload (RedLineStealer)", "value": "805b27e6a434842c900b5a629b52560deb69c3dfdcef817db65ecc324ce57a5a3c21940413334e2472a4c7cfc21bd2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203264, "uuid": "264122c8-a0b0-4508-a580-d53f9cec9d3d", "value": "T139F41207B6FC9422E8F1177028F603D31B367E212B39D757228AAC591C726E5B57872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203264, "uuid": "819b4db6-b392-4bd9-a630-dc468a336d8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203264, "uuid": "c3892784-e21b-41f0-a63b-9c3c34a73a18", "value": "12288:2Mrpy90V3qJVgftNXGFjwBhiYqKeJ4j/FKu8B/uZcD1BHipSBv+qspF:Hyo3qJV+rXa8Pm4bc7luuvHgJqMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676203264, "uuid": "0ba07c81-ed6f-46e1-a92b-5557ac98fbf0", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676203264, "uuid": "a0ec9751-b4aa-4138-830b-b9b3f6746cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676203264, "uuid": "4414c706-a1be-4c42-b0d9-b609a3511531", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efee724-aacc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676202945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202945, "uuid": "1ad9fe58-6893-49e1-81bd-8591c8e69469", "comment": "Malware payload", "value": "c4d88069f1db21427f173beb291133aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202945, "uuid": "7af7f320-f800-4d9f-9db2-1e27ef8f3a6b", "comment": "Malware payload", "value": "99f4607f2a04e8dc8f3f49fecd76ca40b78bb8f9a907da4ab711af376944b114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202945, "uuid": "8401b9c1-a444-4305-9445-a3ff1afc7805", "comment": "Malware payload", "value": "b301714bd997b513e2ceb749e49962a10e43a766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202945, "uuid": "f92d9453-e081-4219-9936-185c23309da3", "comment": "Malware payload", "value": "e477175f5ca991b571021562ff1e7ae92a42bd95eff88c8521bf49a079b60b48a53a94675bff2402c7137878ef4f4504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202945, "uuid": "cbf12b67-a603-4455-b2c7-aa67ba3fdaed", "value": "T103F4120BBAE95123E9B067B019FA03D71E727E705A35834B338D6D6D0C71AB0A935367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202945, "uuid": "f0080192-b4d9-4248-ac78-070227a987d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202945, "uuid": "d6401ae5-14ae-4354-b8b0-0549d5fb32df", "value": "12288:1MrEy90IeeDzwdp/xBblyKlH5wAQg7FFnOPR8SOeJ+WFt03Ggz8i4ZaDGBuipSBw:xyjwp/xpE65wAvnQXX9JUyugPrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676202945, "uuid": "e626091d-ef52-4f46-a8e0-1375f6960d7c", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676202945, "uuid": "8e1b9c11-c9d4-495b-9b09-4104727aeb1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202945, "uuid": "985b453d-dbf6-40a8-86ec-f4a93434fbb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2005ed10-aaa0-11ed-88f6-42010a9c006e", "comment": "Malware payload (OskiStealer)", "timestamp": 1676184022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184022, "uuid": "7d14b1af-f57f-4138-bb40-9e286a654095", "comment": "Malware payload (OskiStealer)", "value": "c98eba0c6b6491eaf7a05618cab679b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184022, "uuid": "9066983f-dcf1-4a0b-b02d-23b33926d62f", "comment": "Malware payload (OskiStealer)", "value": "9a4949ef95975afceb281a33708ea8bcd90be831112bb2d89e7e3ba64a3e119a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184022, "uuid": "6cd820da-18a8-4a61-b772-b6e1615a5a92", "comment": "Malware payload (OskiStealer)", "value": "76081bc414d180a6184994d352af946cf9ba631f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676184022, "uuid": "cda23a83-a0c0-4300-8a03-b9248b368ec4", "comment": "Malware payload (OskiStealer)", "value": "a9886aff0ed3b9c0261dd6699dbfd20c2625aa46fca482670dffebc2de59cb7c3cc25294303bb21e9e7616a6547080c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184022, "uuid": "8e7d6bcf-c911-407f-a6e2-2892e9a1009d", "value": "T195146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184022, "uuid": "53c743bb-535d-47e5-923a-a074226074d0", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184022, "uuid": "6eb9c35f-e4ec-44cb-b875-c64a50b787fa", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIU1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN11Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676184022, "uuid": "6fa89304-981f-43de-868a-435b76826e7a", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676184022, "uuid": "44bf4d8f-5ade-47d1-ae23-5cb7761d89bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676184022, "uuid": "5878545c-31e7-44ed-b244-a97c997e2660", "value": "9A4949EF95975AFCEB281A33708EA8BCD90BE831112BB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a1505e-aab3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676192486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192486, "uuid": "4e09b450-2fb9-4cc9-91b0-3de134b6a273", "comment": "Malware payload (RedLineStealer)", "value": "0cb8dc97b9c35b3bd2e831cdc2e0b92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192486, "uuid": "3d798ec7-7950-4e45-8965-0ec8e3530ec5", "comment": "Malware payload (RedLineStealer)", "value": "9aa2f443714d0fb7c822ba1657dc91ade15bc2cfdbe894cecada87e06ff30ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192486, "uuid": "d71e4619-ddb0-40ef-9ecd-19735f47a1bf", "comment": "Malware payload (RedLineStealer)", "value": "1e27e9569ff106f9ae9920a6d0e686458a8a3b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192486, "uuid": "cdccf663-df13-416c-935a-473ee04ef768", "comment": "Malware payload (RedLineStealer)", "value": "c97541fe99ff6a2da39201a266d98d69cb6d8bf79e87df74618b61576bdef994b9684e6f39416ad275e502a7ff0eec4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192486, "uuid": "cc6420b0-de53-463b-b9d3-c0cf32dfba1f", "value": "T187F41207E6EC8433E9B413B04CFA07D719363EA0573482AB164FBD1E5CB25B5A63176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192486, "uuid": "12207e76-47c4-4fb4-9024-84d2c4833cf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192486, "uuid": "2b9ff906-106a-4e03-9263-00eb3a47d58a", "value": "12288:nMrsy900hVXWT/rpBkFcFTvIer63MeJZjkNy8wq+DYyBoEKZoQW4acfd:TyZX8/rpWFclNr6dZjko8wq+DYyGH6Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676192486, "uuid": "f576a536-dcc4-458b-b1da-46531fce05f6", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676192486, "uuid": "f6b90cf9-b2d3-4719-91fb-2983f64edab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192486, "uuid": "41c84975-31a2-4c30-bdde-e0502c593723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a683a1c5-aae2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676212595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212595, "uuid": "03d1b486-b5ee-46d0-8f13-31c35d541155", "comment": "Malware payload (Amadey)", "value": "09a4e6633439b512a4cc8c8ee6591667", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212595, "uuid": "3d071b7c-82ff-4f1c-ba56-ced5e8f66d2d", "comment": "Malware payload (Amadey)", "value": "9af3ecb61bfcff64f98d5fea98c8fc723d39d59855b1e0f1cbe4db0dcde8bfa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212595, "uuid": "4d34d0e4-40ee-4a3c-9a33-6a86b9175ef5", "comment": "Malware payload (Amadey)", "value": "b97b57bd874f435e39088363f5f07e3ebe49ff14", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212595, "uuid": "534d9116-da34-41b5-a41f-4d428ad600a2", "comment": "Malware payload (Amadey)", "value": "82cd8c1b8628080be8f03a2a9e6833240c9f6303fcb17037b99e9756e7896fec5213425d0b98168048165987c2bcd24e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212595, "uuid": "74506f0c-6807-4e8e-9edc-c6a88469c02e", "value": "T1B1F4120BA7E81432E8B897702DF603C31B397E215B3C839B668A6D5948B22F47575737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212595, "uuid": "d72c6f20-9dba-4742-9378-69d0d74d34aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212595, "uuid": "81558f2f-f546-4897-b4f3-bda83ce64921", "value": "12288:/MrNy90dWNIprsZRqNQK2mRzzoRPsIXC7Ln8gDkwz/eJ9RGRKiwzrpxh5gHYeC9a:2yQWNIdsbqNvzgt688bEI5wz1RgHcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212595, "uuid": "25142e70-0bfd-4dc2-bc19-b08cd48215f0", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212595, "uuid": "893acb4d-f11e-4859-bead-5c73e35b9502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212595, "uuid": "316235e0-25df-4832-bc8e-d6f95ad00706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65deb17e-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244269, "uuid": "4cbc7a5f-a85e-4155-a43f-9b01d451042c", "comment": "Malware payload (Mirai)", "value": "fdb89b0c84adfd872a8cc5d21338f2f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244269, "uuid": "a964f499-4a37-4074-98fe-3295b6e2366f", "comment": "Malware payload (Mirai)", "value": "9c2a816d223e2e266ae1a73ec149641db89e50b25ed1cd4314613e7d10a2e67b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244269, "uuid": "d582d52d-c73d-4ecb-8ee6-979f815bb886", "comment": "Malware payload (Mirai)", "value": "a06a4d38790d4881c6ddf18b2e3aeb35baf6bd30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244269, "uuid": "2c3f183a-0661-42de-9adc-2ff428ed6a27", "comment": "Malware payload (Mirai)", "value": "4a55f5a9bf4c04b6c5257c662ff70b005eba70a81b41d409a4ba288d6a573ac1b659cc7c2a19d1f7c81656764f643e25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244269, "uuid": "d952a1d5-2e1a-44f5-9d2a-256fa848e13f", "value": "T19103E1416503FE76DAE10D37A97F476B317D7728A0C63D9623A90BF88E81A426D7C809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244269, "uuid": "896495a1-73a5-4070-a060-680b5f6b6e43", "value": "768:z+Z3+VTTiESrsxtgAUrxN6XhEfs0I1xWIPB4IZ/Dwwq3UIktIh:zvtSrsbg/rx4hEY2IJ4iGPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244269, "uuid": "124f6dce-984b-46c0-ad23-f88706024e61", "value": 37864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244269, "uuid": "77763839-3d43-444b-b8a6-f71310773271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244269, "uuid": "798ca72b-5424-4701-ad4d-b1421971981d", "value": "fdb89b0c84adfd872a8cc5d21338f2f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecd6d0a-ab03-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676226836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226836, "uuid": "ef1e842a-82bd-4f80-b858-e30c2666b119", "comment": "Malware payload (GCleaner)", "value": "eb5cd2f95de9be40085570cdf5934759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226836, "uuid": "93eea402-1248-4c11-acc6-052dc9611c9d", "comment": "Malware payload (GCleaner)", "value": "9c8fab13b40190f48d1c7d117b96a92ffe981cc70340c0bac81e095072c4d150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226836, "uuid": "d2131a92-3bff-48eb-8640-6fa9d7eafaeb", "comment": "Malware payload (GCleaner)", "value": "290a7cc08e24519c9a6b379556aed39853557dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226836, "uuid": "1567dd6c-ce9c-4e37-8009-c983f720e374", "comment": "Malware payload (GCleaner)", "value": "122f1f65492ed54e73315cecc1ea5e8517c93553ff963e54a8485e1506cca4e0e304f75ea10969098975d3cb6c3c3f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226836, "uuid": "302c3873-2a5d-42bd-a5a7-95edb0249de0", "value": "T15EF5127D7255C46DC580BEB88C3A94E35CDBADE3D9A0A56370C87F3F52B91888A1A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226836, "uuid": "ee3da7e1-64e2-4b45-8938-417b89c39490", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226836, "uuid": "829d3353-adde-4d84-a047-dda87a3102b1", "value": "49152:rdHUtCGCAHYEojUE15P8DMoaAMPdAHGUYF069H2ReY+4OQ77jT4HqQiCLCgv2MR:JHUtCG3HYPUGbdAm1u6IRiwG75v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226836, "uuid": "a7d1f106-15e2-47b7-b056-d78057e7d05d", "value": 3605305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226836, "uuid": "49f3b91b-16ca-47c3-babb-f0b752c19cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226836, "uuid": "5fb29636-a894-4325-ac1f-a96bcd38e454", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7080a44b-aa93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676178574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178574, "uuid": "1b918eda-6031-4d89-98bd-6852a176c43d", "comment": "Malware payload (Amadey)", "value": "18fbaff69e542857e089839bd7d55b3a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178574, "uuid": "4748d055-102a-48ab-85da-7834c1be97e6", "comment": "Malware payload (Amadey)", "value": "9d01b1da796e522f944c8a58ecbe152510a1503e94262b1afc81c33b13be5e58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178574, "uuid": "98eaf9f0-6544-4476-871b-040897870f0d", "comment": "Malware payload (Amadey)", "value": "d388f63700f0862ca8d6ef1f3e75668ba8fbef18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178574, "uuid": "b2caafaf-6d13-45b8-97d5-62681b881470", "comment": "Malware payload (Amadey)", "value": "eccabaadfe933954d5cff2341f2f2f1843fa9fb444961e633e8c0eb9bf20d4a6d12134bacf42db5664c50895284c6b9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178574, "uuid": "b1ac670c-6437-45bc-84fc-4a0ae7c64c34", "value": "T11AF41217F6EC9071E5B523B018FA07C31A39BD21AA308267635F6CA90C726B5723577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178574, "uuid": "9ade7032-5b63-461b-aa74-17d8b0aa672c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178574, "uuid": "d70adea2-96c3-4195-82f6-12171aabb907", "value": "12288:wMrLy902Hfq4ShW0jH1ykmTURnitBoFCWOeJi0gZO1oO4vIL+oPRn2+BQ2:ryvH/S00r1qTURitBdcSOe2jRn2E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178574, "uuid": "9a8bdeb7-c607-410e-b5d5-4afce482f971", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178574, "uuid": "50e3d371-cb67-4aab-aa0f-619acdc58f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178574, "uuid": "7df1b892-c1f8-4195-8db7-83116cf72af8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce0c499-ab0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676231127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231127, "uuid": "4262dc3f-56ff-4c8e-aba1-2641c3e5f814", "comment": "Malware payload", "value": "422ec8c8da4faaaf01bda126376a53af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231127, "uuid": "b74bc85a-e3ed-49de-9ef7-c01379b77529", "comment": "Malware payload", "value": "9dd956d1544718bdb5247dcf638521e438eeec18373935d2577806f23cf0fb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231127, "uuid": "10323b89-c0e5-4654-ac85-4295876da526", "comment": "Malware payload", "value": "8bbaffd53154985ea80cd910e3c4879ab7982829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231127, "uuid": "0fca0fb6-28dd-427f-94c0-274eb6fc0e3f", "comment": "Malware payload", "value": "1a8e03d6a2d0766325a56807f4b87feb54be73858be62d9718e0e228ef99019eea9e0efa7ce2f0d49826decf0bbd782a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231127, "uuid": "cd267a27-2898-4885-90fb-c195c5ac7c07", "value": "T13CF5127C7245C96CC290BDB48C3AD8E72CDA2DE3E8E4A06770D9BF3F55B90844A1A157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231127, "uuid": "8c76ec22-d813-4632-afb2-17e247ad7189", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231127, "uuid": "4a865fe6-0e90-4ae5-9833-9d155c05d395", "value": "98304:JHNy5+A3jLYJSnPpoIq8FI46M3AsQn3MB+v2MR:dNO+ATLY2Z6M3AsQ8B+vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231127, "uuid": "afb59157-8471-4224-8802-adbe58c39370", "value": 3444371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231127, "uuid": "a9a8ef23-9b4c-45a7-ae76-e30af4934ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231127, "uuid": "c5c40101-5bfb-443e-aafe-f349e58a4802", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb195c7a-aaed-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676217434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217434, "uuid": "dea36ff7-cd65-44b4-a441-5c15196abaf4", "comment": "Malware payload (Smoke Loader)", "value": "795a28654df99df3fc48af22cd412d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217434, "uuid": "b48188e9-7604-4759-9a99-bfdde8e9abe1", "comment": "Malware payload (Smoke Loader)", "value": "9e957c5a40fbf1fc5f2db25e0529fa95ca80a72897c32fd97736927a0b9eb174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217434, "uuid": "319a00dc-8895-40d2-b9d2-ab31eb28e6c3", "comment": "Malware payload (Smoke Loader)", "value": "0f2d4fb347dd95fcfb47255876ff3f95c832ef65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217434, "uuid": "63281bf7-4df2-4330-929a-f82db4e83f86", "comment": "Malware payload (Smoke Loader)", "value": "5c63019559ea0db2378e209cd3e2cbd045ceee6a2d49a40a2840310bbc26dd0e9b2b1221b4a9ee095dd7a57d105ee5a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217434, "uuid": "161350b6-0ee6-4d1a-927c-175a821a7151", "value": "T17A14D0213AA1D07FC55786B41431DAB06A2FBCB1AB15C5DB33482AAF5E313D15F3938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217434, "uuid": "8a6b2f5c-9a57-4239-a376-ed6f3c96e724", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217434, "uuid": "c976d7ca-429c-40ce-a051-b86e7080e95b", "value": "3072:B7Uf+rG95ipTFv+/xgfHWlRl2esZx777t48E:VyLyhFoxg/aRl2esZVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217434, "uuid": "b7006338-84f0-49ce-b586-8158767c7707", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217434, "uuid": "527bdf25-0b55-4d4e-8cda-a671281e09d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217434, "uuid": "ed11d2a3-f8db-4a75-8b59-bfb08bbf27db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce93527d-ab1c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676237573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237573, "uuid": "e52b56dc-b3e1-4822-abe3-a850a6670495", "comment": "Malware payload", "value": "1d8c546a80c3b3371df46eec3e6f0512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237573, "uuid": "9b0d8a42-123f-4655-abb1-ca9d4ec6888b", "comment": "Malware payload", "value": "9ea8660e213d83a1cd9dbba2e668704852db3a3c9a33a6084755e9a972f59ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237573, "uuid": "664124c7-07d8-4e6f-8e12-879b8c9107b4", "comment": "Malware payload", "value": "ba957bba9d4bc4f9d1d2dc0ec1322608b76c40fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237573, "uuid": "8cfc69aa-2f8a-4c4b-b7f2-d941947a05e8", "comment": "Malware payload", "value": "2dac95b199437cba23cf841848a331c00769469a2b6ba5e0e2183d563d34e1f8416cd8250c6f80ad5084ba9144e8b2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237573, "uuid": "d05faa09-867b-43ae-b088-72794dc9d740", "value": "T1D004DF117AA2C372D157C6745860CEA06A6FBC719BA5C5DF330A0B9F1E313C14E3A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237573, "uuid": "df1d86ab-2180-4e01-8803-a4626227a3f5", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237573, "uuid": "e86c4e9f-35f1-4d37-829a-33cedb649d17", "value": "3072:wB4z+MGfkR5kOhE926XxXc0impjoe2eJpLPv5f2wdDBkuR3l:Q6RYpOc26hXcReZJpzF2wF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676237573, "uuid": "75a55ddc-58e8-4039-974f-301d6d3bf66a", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676237573, "uuid": "f5cf7f8e-95cd-4abd-83d4-a36ff6016d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237573, "uuid": "7137e83f-e484-4ce9-bad0-e5812a37cfc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b919ed2-aa8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676176472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176472, "uuid": "15acb3ea-0abc-44a4-8f19-6f887e8ca150", "comment": "Malware payload (Amadey)", "value": "e6d9b96bbbd312d2e78d88b0fd1e7ac7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176472, "uuid": "0015fff8-c80e-46fc-a012-9a05f8e5b74a", "comment": "Malware payload (Amadey)", "value": "9efbffb7c00e121cdd8b8dca2cce12cf29a00998823018cd55729165b32fa9a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176472, "uuid": "2ac01647-92c8-4d47-91ef-d0a35b1bb3ae", "comment": "Malware payload (Amadey)", "value": "c0530fca5d822cee5843d59436a24d6aa2d4fc8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176472, "uuid": "d06dca00-45a0-4610-9dad-8cdb4eb3d107", "comment": "Malware payload (Amadey)", "value": "65a9874d34fc23307ada6249fa0b197ce2cfbb91ff9bc6d70938609d5234b8ce9be7b929952e5de1cb8863a9f9748168", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176472, "uuid": "a017323a-ee27-4598-884a-999aed131845", "value": "T16BF41207FAF9C022ECB463B049F207D31A367E616E39422B678F6E491D726A0D174767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176472, "uuid": "6fc61132-46d7-4846-83a2-35c7ed705fc2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176472, "uuid": "18d8eae2-1974-4e03-8457-67482889a5a9", "value": "12288:CMrpy90Yy2xKydVWlFyiV0RYyyeJgFwr7hzitG8KwTe+CAf6r/FMg:byZ/bWHyU2hbcoKhCAf0FMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176472, "uuid": "ac9794c3-fd76-423f-b143-46a209c8a288", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176472, "uuid": "b3fc339a-7485-48bc-91dd-a35f98418357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176472, "uuid": "38555435-d7a7-4b88-93b5-a21ba0a1b281", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f3dfe6-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676212171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212171, "uuid": "8d4ee1f2-9093-423a-8a49-a8c6f4ee4fb7", "comment": "Malware payload (RedLineStealer)", "value": "914ab5aa1ab2ee9873c451144ca6b1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212171, "uuid": "b6ce4a8c-be65-48c5-93a0-3657a6e8f08c", "comment": "Malware payload (RedLineStealer)", "value": "9f071dd230c9e3949aef0c19023e9e23c0e764160dee32d2522114835e74404d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212171, "uuid": "fc8f6090-c675-4100-9d97-bd6f9b63d88c", "comment": "Malware payload (RedLineStealer)", "value": "d881ddbb6a00858c7af509b97f1b3ccb27f50912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212171, "uuid": "ebe54976-8145-4b97-a001-9fa20700f1d8", "comment": "Malware payload (RedLineStealer)", "value": "b5729b9e8313c3587adaf7cdd6029e2d666af40e8c8c20a3904f0f106e4064690fe2588251e31eb94eb75bd705b22295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212171, "uuid": "fcffc86b-87fe-4b37-8fc9-4993b86bc639", "value": "T10C051207F6E88472E5B05BB059F703C30A36BD612A74939F374BAD2958726A0B53437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212171, "uuid": "eb05d14e-18e4-4727-bb53-b0f4429b2591", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212171, "uuid": "6389508d-0e51-4da2-b767-bdd0828e3a6c", "value": "12288:9Mrty90K1fpVXoauvgRRDG388GZNIPnYdQVeM+Tn60+Poe8F9fHaoTf86frYV:8yPfpVusS88GZNIv8YXLc9fHaIk6DYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212171, "uuid": "30297aeb-ddda-40c6-87ae-9f5d73e1149e", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212171, "uuid": "364f7656-ac18-4b67-b760-cc16f8c8dbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212171, "uuid": "cddd3c98-a10d-425f-8eb3-1b30f8a8fe67", "value": "914ab5aa1ab2ee9873c451144ca6b1e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded54d2-ab05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676227747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227747, "uuid": "2f06d3f4-eec1-4b7d-817d-ca3922b3a73d", "comment": "Malware payload", "value": "75da5eefd0f0143a671a22131f9828e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227747, "uuid": "fedda675-7ec1-49ac-85cd-894cb29cb5f1", "comment": "Malware payload", "value": "9f672ecfe527575cf2b512c9e64799774e4de3340cb0e0f205a78650f575e052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227747, "uuid": "376c5bfd-77c3-42ad-8f1b-f5de606e7473", "comment": "Malware payload", "value": "59bcf4db3ef76c3c2255f3fc6b5d8e13ac9d501b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676227747, "uuid": "0b01fb2a-5de6-4de6-b7ff-5bc1857adf7f", "comment": "Malware payload", "value": "8c923a44652f63586a7f33fea4b2dfa5a1b7c0245b11c70c9d1d92c7d117584aa3e51d8a1ad70f1a0af37807741e9e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227747, "uuid": "49d4b4b7-66af-4955-aaaf-12c5de432018", "value": "T12235D001B5D1C072D5B325320DE4D7B99B3EBD200A6199AF67E40FBE4F70682DB21B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227747, "uuid": "8a4129ad-a637-46c9-8105-8b04187e3203", "value": "482f298d05f21a8742e0277338b51a7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227747, "uuid": "37186674-53cd-497b-931d-22c04788ee90", "value": "12288:ygX1AJ6tEIKMu1yxN/GT5Q6wxNPMGyaqb+X:LX1AJcKMu1yxNkCN7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676227747, "uuid": "bd128c15-d683-4c4d-9130-2df2d92629e6", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676227747, "uuid": "1b382d6e-3984-47b8-96a5-716e8ee56256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676227747, "uuid": "0213f5fc-86f1-4b1d-8a1d-f9b4b6a11f4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d588c05e-aa96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676180032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180032, "uuid": "d9b1f905-8040-418d-83a9-a06c539f70bc", "comment": "Malware payload (RedLineStealer)", "value": "ddbf47271ae6100eaee7ecfd4044c230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180032, "uuid": "d81095ed-022d-4e37-9efb-712f7a9ae336", "comment": "Malware payload (RedLineStealer)", "value": "9fea27dd4c8679f679446852c918e193b86576979090de3e34afe7c576e2f982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180032, "uuid": "ce1c8e68-77c8-438d-bb5e-00f2ac5ff064", "comment": "Malware payload (RedLineStealer)", "value": "165d9ce8cb8cb75e68eefcb253856278b1c6321c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180032, "uuid": "6f123a00-2b85-4d9f-9988-847cbcbff04a", "comment": "Malware payload (RedLineStealer)", "value": "26faffcd6a713b80dc0d6843fb57b04965c598407d9b71482222c4f9aabb985cb5157f3b441d7c8394fbf89fcfa1a6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180032, "uuid": "9d5ae228-0802-4980-a848-8f7e7c1d5eb3", "value": "T10354F11179A1F073C75386B16A20DA98AEEFBCB12B55C0DB3359165F0E223C28E77356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180032, "uuid": "37991987-915d-4f11-bff5-9b986d6fa4bd", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180032, "uuid": "f6a37639-12ce-4811-aa9a-1e002436da6b", "value": "6144:jGlROTsEiow5qThIw43a5vS+FGwhdyW1cF5:jGzwNrMvwhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676180032, "uuid": "0482be91-4032-4b0d-96ac-da9176ef1fe9", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676180032, "uuid": "e51630e3-209a-47b4-adf8-78b82ad9265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180032, "uuid": "06a7995a-6028-4d5b-833b-5eb29e5490f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7289cd47-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676212078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212078, "uuid": "561a616b-0c7f-486f-b549-3d23bc1bf83e", "comment": "Malware payload (AsyncRAT)", "value": "dffce796a69f576b2ce5161c5bf23249", "object_relation": "md5", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212078, "uuid": "3cbfd77c-ada4-446d-976b-3f2e7cc503c4", "comment": "Malware payload (AsyncRAT)", "value": "a1094fd210d9c5845758c9c144a863b0d98fcd71e5fff9ce6ea2abe6b25e0fc2", "object_relation": "sha256", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212078, "uuid": "9bfee0b9-4c16-4ac6-898c-8075c27316c4", "comment": "Malware payload (AsyncRAT)", "value": "9cfac609a83d93c7727a6cfa8ee75c2f3d5d7281", "object_relation": "sha1", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212078, "uuid": "438ba00d-136f-4983-bf21-f46bacc7fbf5", "comment": "Malware payload (AsyncRAT)", "value": "0efb61f1535149b8d7bdb0f273d23a049af5e1a6afb674e71dcd0aaeed377a18a656dc31e8051de13b5b3645b9895c9e", "object_relation": "sha3-384", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212078, "uuid": "c04a85f2-d5ac-4a78-b59c-44765f05a321", "value": "T120745BE022A09AC7D2B97775077099304AEC7D242AF4E91F3DD076AB27F1F420BD4699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212078, "uuid": "164a2743-3681-4855-a88c-d4eee429dca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212078, "uuid": "df20353c-01de-4a45-81c1-8556240fa5c9", "value": "3072:fub/CFYzAFsmRZIK3D8tjoBYOh8joBYOhVjoBYOhAeaqJsQy4Wr/CCs3iI84450v:fa/CVZ3D8OeaWyXVsa44vBjjzue8GMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212078, "uuid": "2480c441-7ba6-4c01-a7eb-694c8ba30d29", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212078, "uuid": "a15860cc-1cca-4e60-81b7-d3ba9720376e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212078, "uuid": "b27a6ad5-070c-438d-891b-34866de14374", "value": "GoogleUpdateCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561e716d-aa84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676172087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172087, "uuid": "ac105140-f365-449b-ad27-bb5d02ab586f", "comment": "Malware payload (Amadey)", "value": "f04e8ab08c02f3fb7336dcb0bd79024c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172087, "uuid": "aa682297-9efe-4e21-a709-b6e99ae67647", "comment": "Malware payload (Amadey)", "value": "a1141e73f444d27b73a74c25437d7b8198c8762eba62ed6607d929b741993a67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172087, "uuid": "18933778-470e-44ad-8907-4ff613eafc96", "comment": "Malware payload (Amadey)", "value": "f4d069171aecf17f1b72b29a53876c5330a9d2ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172087, "uuid": "2640b1e5-47a7-4a57-9781-8739e853bb7d", "comment": "Malware payload (Amadey)", "value": "1ddc8a0bdb870da325e93d19f2dcecf6f4ce16c43c9956935c34698326fe0e2d5091d6978f22af6a24db47890caef1d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172087, "uuid": "8382d9e7-7405-42db-9376-711e6cf62b6e", "value": "T166F4125BB6EC9022ECB55B709DF513D30A363E604A34439B279F6C991C32AF19131B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172087, "uuid": "65e8f75e-7493-4218-8b49-a7e0c519370c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172087, "uuid": "3a81a23d-7ec6-480a-9b42-f6ff23009262", "value": "12288:3Mrmy90EcpAEykTHjewAUS03VfjceJhLeLuVHSeHTu4H:hycDyYjetUS03VfBhCCVyWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676172087, "uuid": "7a724901-488c-4ffd-b30d-ef27c944a7a1", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676172087, "uuid": "1c4f9d6c-258d-4725-ad85-44e9647b347b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172087, "uuid": "5142c929-a346-4961-9620-dd7588e070a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b100e23-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231742, "uuid": "30eb8aef-aaad-4cf1-89f5-bfdc897d29cf", "comment": "Malware payload (Mirai)", "value": "fea0fa37ebb90fede10e3667d4b53ce7", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231742, "uuid": "fc8ab10c-362d-4a3a-8868-8c34940df2f3", "comment": "Malware payload (Mirai)", "value": "a1d25afc015cca35c782246de5259805bbfe5d5943505e52ef945eedc160298f", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231742, "uuid": "18a0ac0e-a821-413e-ae54-7911c10095e6", "comment": "Malware payload (Mirai)", "value": "70913e7e354026a5ed7f8bb52043458b55b3bd4e", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231742, "uuid": "a44aed63-5f08-4239-a22c-ba9c2f7b7868", "comment": "Malware payload (Mirai)", "value": "f91253ebb671ad0c6237f1ae9f6d57ae578daf45554dc50f2aecba4a93b0057349a2e0f77ed09cded26b9c9caeb1963e", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231742, "uuid": "053e3034-c08c-4cab-9b50-39c516cf001e", "value": "T1C4C35CC6F401DFBEF84BC6B64C5A0D0D65B1A390AF530626A7D77E9BBD360D4281AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231742, "uuid": "9af9d0bf-5aaf-40f8-8e2c-d6ce352580cd", "value": "3072:3WwugrhidFZ9cln+L8IqngQeuacWjcW0JcWcBYnRK8Fe8nqfiGj0GM:3Wwuyh0R2n+LQgQeuacWjcW0JcWcBuKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231742, "uuid": "a94230c0-6ddd-4ba6-87a1-e4d4061ff0f8", "value": 129820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231742, "uuid": "f9c0cb24-f69b-4e8a-ae44-a6f6020d3134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231742, "uuid": "532e0a9f-b003-4a47-94e6-4ee569c67950", "value": "log21.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726835ea-ab15-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676234412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234412, "uuid": "8f5e65fe-dbd6-4cf8-80ee-257889b18430", "comment": "Malware payload", "value": "46f79b0693f8bae136b2caee0872e9d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234412, "uuid": "0245b283-20de-42ef-a123-5c28068746ac", "comment": "Malware payload", "value": "a1f229d26e403922a714cbb64449f05d78dafdb5f54ca024acc19453270c3af0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234412, "uuid": "b35caae3-92ea-4a75-b696-133f65c0b807", "comment": "Malware payload", "value": "9639286ba4da9e912744f832fcb994ef9e33bc8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676234412, "uuid": "4ccc076e-7c6a-4677-b6d3-e33aa8473eed", "comment": "Malware payload", "value": "bad99b5575a869db5163d49e197ef4f099eec61663e4b65eeb57b59bad69c52e0f70294aebf7a44517da9d29eee6d841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234412, "uuid": "64fbc942-1754-43b0-96be-bf9a748c3e19", "value": "T14704CE1179A1F872F16685B56631DAE0AA7FB8F36761C0C32358079F1E317D02A7A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234412, "uuid": "5b10e9dc-03ad-4876-ab0b-01e4b6cb0035", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234412, "uuid": "ba44418a-b6f1-403a-8ae8-d5136946002c", "value": "3072:g7T3i+HEwt56T/W1xRgv6/rvuEpYOlI3pezT:ieCIT/wxRgv6/juEpBIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676234412, "uuid": "ed225f08-85fb-4b89-b3dd-271977ad59da", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676234412, "uuid": "779c8ee2-3924-4c6b-8dd3-73627d734154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676234412, "uuid": "d060df53-040b-441b-ba49-1f161354d249", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece8970-aa9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676183644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183644, "uuid": "f1322732-b41b-4462-af23-eb0b023af354", "comment": "Malware payload (GCleaner)", "value": "f505b7e9c7b4cb6c2cdfe1657ea1c50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183644, "uuid": "839500a0-57c0-4d6d-b40a-f4cc5380c6b3", "comment": "Malware payload (GCleaner)", "value": "a1fc24f2a1d9448449c7324195ba1f42ab4ff96b0c2919bb6d11c38848a1c828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183644, "uuid": "b9716b52-06d0-4c3c-a22b-aef0065f18d5", "comment": "Malware payload (GCleaner)", "value": "a9bf4cde403a1906e8c0637613ab998d8727673c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676183644, "uuid": "91db05d3-7671-43b0-968a-0c4e78bfec07", "comment": "Malware payload (GCleaner)", "value": "b430675e8c2ecdbc64a3b0404b49402d648ff7e209f289180120826e4ffc494a88cfef98acb1716eeae4c5d07d740194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183644, "uuid": "0d3e42be-9359-4993-ab73-a4817d5a9578", "value": "T120F5237C7545C4ADC2C0FEB48C2A98EB5CE65DE3E9E4A16231C97F3F81B91958B0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183644, "uuid": "f345c2ad-f701-4d37-8ecf-66da6a91604c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183644, "uuid": "0093bc92-8775-44f4-af35-32bfb426f236", "value": "49152:rdHcqgY71V2plI/vn9QyEc9lxmiFQzHEaG7IEHAmnJ25ruy8pjLCgv2MR:JHcqP712lITE6lFFQI7I6A6J6inv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676183644, "uuid": "f2da21e4-2933-40d7-b442-20ab6ba4d067", "value": 3445396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676183644, "uuid": "c10d2283-6cd7-4c42-8d19-bfa9efac77cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676183644, "uuid": "fc045250-6ce4-4997-ab77-9b30c9aa1853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321a3341-aa84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676172027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172027, "uuid": "06197488-1ef0-48be-a511-c3287d259464", "comment": "Malware payload (Formbook)", "value": "3d734fb96e17397d796961993832b394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172027, "uuid": "67e721b0-457d-4e86-a0a7-cae4bae48a30", "comment": "Malware payload (Formbook)", "value": "a21c6c623959c4995842ace85f7f5a7e3751c4930d28ebad92c7a737a7f8cfb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172027, "uuid": "86847e8d-f53d-4ad9-b1aa-0c2e7e40be5f", "comment": "Malware payload (Formbook)", "value": "308eae042a3fdb61af8e22f5e23cd0da5dab5cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172027, "uuid": "4091cace-b0a7-491d-a79e-a425d2889b47", "comment": "Malware payload (Formbook)", "value": "107dab571f9468f7c0c63ca834382ccd5095136fdd15e0da942dd14b8fc41a0efaa6399949847ca4a00396626057719a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172027, "uuid": "22637428-31ac-420f-8438-d46fb4b479da", "value": "T1865422091765EC97CDF203F2747AEAD24A6AE91524B9AB2F13107B487D74201DD2F3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172027, "uuid": "17ef44e4-149f-4bed-9f88-af9d6ee1242e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172027, "uuid": "eafb3e22-2853-4356-832c-7ab594e6305d", "value": "6144:vYa6WrYVSkEyqOIc5/Mws5T3Ckge18PtOgOa80:vYg07EyqOj9MH5T2e1g0gBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676172027, "uuid": "ff121ddc-3eb7-4c0f-be60-e8d851cab662", "value": 284418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676172027, "uuid": "c1cc7d21-0fc1-43a7-b8fd-3e26701de437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172027, "uuid": "10471d5f-b531-4035-b987-f3d4953cc14d", "value": "ATTACHED INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0ca57b-ab16-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676235020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235020, "uuid": "68cf2c88-2fff-4582-87a1-d8034ae66639", "comment": "Malware payload (njrat)", "value": "390aed0de579f6f6a7d67150ff70f3eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235020, "uuid": "4d9a1e72-d84a-4cc5-a49f-b72a87aea795", "comment": "Malware payload (njrat)", "value": "a23f6eee0818344bb7ee7e23c7b517fe66f80c67fbe89b98b2160e57891754df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235020, "uuid": "49839288-dd12-443e-9ebb-ab813ba14be3", "comment": "Malware payload (njrat)", "value": "7b1fad8d01335a9dad33527886a9b16b50c3de9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235020, "uuid": "9a8f8153-fd40-4125-b24b-1b92e4c7880c", "comment": "Malware payload (njrat)", "value": "ff6cc7f62ab1c162fc13bf2d5295cd661bed727fe3f0a28475714030f305a1673a9e0f84828465571ba24163ed995595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235020, "uuid": "2d79eccd-0d32-4213-bac5-7b8f0693da37", "value": "T18C432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235020, "uuid": "fd001139-e3d8-4789-96a5-037aefaaec42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235020, "uuid": "8ebdfa1e-dceb-4871-8725-130a56c2e4a5", "value": "1536:aqZMDnE4uNhty4X+SChDVwsNMD/XExI3pmem:3MDnlIk4XohDVwsNMD/XExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235020, "uuid": "3fdbe07c-5dd7-4e70-88a1-a782b8595fa5", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235020, "uuid": "56fd8bc0-b775-461f-b709-e14edadaf8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235020, "uuid": "7208da3e-0987-403c-b294-248294178882", "value": "390aed0de579f6f6a7d67150ff70f3eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c04902-aadc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676210068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210068, "uuid": "03c6cdb7-2c01-4789-9269-c277e1806b3c", "comment": "Malware payload (RedLineStealer)", "value": "0bc66356c213980f4c1ae9f718905ada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210068, "uuid": "7610fee7-a823-4dbf-8122-c4ea5d16e123", "comment": "Malware payload (RedLineStealer)", "value": "a350ad2511b0f330a1c722f0dba2eca07af635e38e544aa5131d5b5d59fa6ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210068, "uuid": "c0898319-881d-442e-a703-56c61b8baca6", "comment": "Malware payload (RedLineStealer)", "value": "be80d425d661390d5cb1cde85e4cbd853f8adea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210068, "uuid": "b5744a8c-6862-4e0e-874f-ee2776d717c0", "comment": "Malware payload (RedLineStealer)", "value": "1db8c30ecaed9eca618647ea26b4c8881bbafc8cb1cf299244917bdcf146ce9eca8d23e80667538085a5f04f40b49884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210068, "uuid": "476f6060-5f0c-40b7-9704-c5171a939b73", "value": "T120F4121BB6ED9422E9F5A77054F703C30936BD715A38839A674F7C2A4C722F0A0357A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210068, "uuid": "860aad77-70a2-4cdc-9938-2b181c5173fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210068, "uuid": "153a370c-628b-4e2e-bc4f-c6f9f96625e7", "value": "12288:BMr0y90KyLe6GH/GUB9RcukJFQl/RceJzX2qg4kAnXQrZyY1E:VyNEe6YGUVcu4Ql/nzX294xoZyY1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210068, "uuid": "fd870f38-02f1-4ebb-9f55-2ce5a7181c7e", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210068, "uuid": "2cc037c7-4a8f-4754-9dd6-bec798071345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210068, "uuid": "733e7e56-e222-4f9e-ad28-2f16f796fa78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440e2834-ab10-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676232186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232186, "uuid": "25e95d01-fef2-43f3-a178-0036555bd6f6", "comment": "Malware payload", "value": "07802d914deff75e65885c97ccb3f545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232186, "uuid": "f0e5cab7-6772-4ea4-a46d-717d1e3bc543", "comment": "Malware payload", "value": "a3a2921826172960cdb36c3b7feda6e13daad45f4383423687141bbaa4816116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232186, "uuid": "1e36554e-9eb2-475c-b240-981fdc68c896", "comment": "Malware payload", "value": "9d32f93dee647e5819540473f43c87c812b000f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232186, "uuid": "ac89dbad-ba93-49d9-be27-430c108746dc", "comment": "Malware payload", "value": "a55c7b3fdb6f4275ceb32a135129f2adc63972e4b9429726077f2e8a17ae87488fa121d8f67d5439ab401aa112a6f47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232186, "uuid": "30981430-6531-4cd2-9483-09653bff1d87", "value": "T11A04CF11B6B0C073D15A8474DC2DDAA46AAFB9B1BB61C0C733481F6E5E30FD15A3A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232186, "uuid": "3daa7608-13c6-43b8-b50c-f4ab1aed7ba0", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232186, "uuid": "5e42264e-9110-48c2-b459-d49c2a7fb05d", "value": "3072:Z70ES+HiV56qwSSIjNP6FLXNb2yLOl6f26geA:t+CJ1ShpUDcxkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232186, "uuid": "ecd9cae9-39c7-4f37-b9bf-e560b3f92631", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232186, "uuid": "861d59ef-dfc3-44d1-a058-f3da3e5f0a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232186, "uuid": "a194d5bd-26a2-47eb-9e9d-172b19d5f718", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbc6b6b-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231723, "uuid": "2282bbaa-c2dc-447c-9a5c-a6a4bf473970", "comment": "Malware payload (Mirai)", "value": "fad5b930da38afe0fe23c6335c068f21", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231723, "uuid": "e4c4ae5d-7907-489d-aea9-301568cf4dcd", "comment": "Malware payload (Mirai)", "value": "a3bd1189420a005f6efafe3ed05ed4187be07b05436e23bb6491f9cb4d06ee86", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231723, "uuid": "b67d6c0c-958c-4ac8-98d7-c1e1f39b0439", "comment": "Malware payload (Mirai)", "value": "8f12c0a35bc4bfe83dec359cd109a34d570c8528", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231723, "uuid": "1c9c01e7-e456-4139-adf5-42a38b30deb1", "comment": "Malware payload (Mirai)", "value": "d39487779a8a284395c8cb2047cf3f94978743fb41fc7ec808ca42d9a0584a975c09e2ffdd233e0980619700ab43faf7", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231723, "uuid": "4fcd1c49-2a1d-423f-a188-6dcaf29d940b", "value": "T1BA13F105C1E41A05E83C85F6A52FB72A9815E7FA89CFF4B949C172025E92F1D3D3B8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231723, "uuid": "804c2f01-7335-4674-b8f5-c47747398fd5", "value": "768:JzMBy0baz8P+OGXSiPXa2q3IBa385meVFDo4GQsnbcuyD7UHQRj0:VJG6XCiva2GIZ5JnQQsnouy8HyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231723, "uuid": "5952f098-cdbf-4b7e-9422-47b4b2f18165", "value": 43468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231723, "uuid": "79646521-4ae8-424e-bad0-5ff0b0695ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231723, "uuid": "34cf3bf3-e396-439f-aebf-21dbba6d7e63", "value": "log21.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b187c966-aa7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676167945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167945, "uuid": "395daf13-a484-4c7e-8280-bb65305aa0a4", "comment": "Malware payload (Amadey)", "value": "39939b86720f0e92918b06666574765c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167945, "uuid": "93d93999-81ec-4dcd-b61d-810e14cb2b8a", "comment": "Malware payload (Amadey)", "value": "a474d4e0942541d34a8fd53e137ecc137b9b1cb49dadd6cef42780980b0622f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167945, "uuid": "ece38634-e4dd-4de1-aac1-c0c5d24463a1", "comment": "Malware payload (Amadey)", "value": "c7f4d952b79a52d4a8790ab1b8be8a657a6b68cc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167945, "uuid": "da27a98a-e4ee-4370-a324-25bbe8d1e74b", "comment": "Malware payload (Amadey)", "value": "7cd46704efee36a365cc77ba9a2b4e7cf1f87eb6a66f59195fd6e3cc7ccc0afd6965dadfe284e496050eec8f1343b364", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167945, "uuid": "e3582c5d-51ac-479c-b69a-1d00acea087d", "value": "T1DEF4124BF6E88133E9B42B7019F203C316357D619B3043AB278FAD991C726A0D676767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167945, "uuid": "f96e5471-8873-4687-86e9-7b1471fd6bc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167945, "uuid": "91cc2fcc-d848-4737-919b-ead87b16d3ce", "value": "12288:3MrUy900h9smUcw5KJwFSvK2FasglRGY+khGIeJr6UbtlgGT/sKdpCXrhkOLH:3yGmUQJXbgXv7h0vIFrh5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167945, "uuid": "b2c4bf9e-c60e-4ba4-9094-252a2da1baf0", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167945, "uuid": "5ee8a0f5-f9b7-4483-aa11-d0716c7e1a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167945, "uuid": "f6ae3bec-e35c-4d5c-8f3d-e4cdfa095ae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45a5d36-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676212215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212215, "uuid": "45796807-6ed9-4e24-b01a-68def26e6cc2", "comment": "Malware payload", "value": "d7b02b977d428ea9ee50f2f326b54e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212215, "uuid": "537229da-6a95-436b-9d0a-850235cc4201", "comment": "Malware payload", "value": "a4ca5d0aa8d7bf54b19f902ac6bb909bbed49d27d30e02a90089deaee846549a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212215, "uuid": "32d82258-035a-477d-86f0-0a884bf1f4ba", "comment": "Malware payload", "value": "61639767f817ad881f602c3739a89a2533e28420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212215, "uuid": "784430bd-d992-4070-86e1-98ddf16f8fac", "comment": "Malware payload", "value": "b9ab1a06c9427c0b78fc1e90446b859c2fc5d20eb1bdb01374e5bc18295808a17dca9788a2bcc8dc6188be1a26de22a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212215, "uuid": "d4a622da-5919-4644-a5d1-339840665086", "value": "T1447633753DFB40F2E2992530ADA83EC9F647F3251F7A50B32718219A1AFC590C62766C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212215, "uuid": "efaf40a5-4530-4760-b384-7aafa8cd0a57", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212215, "uuid": "688e3173-cb7d-48b1-87bc-371d45d8cf39", "value": "98304:91OjotbJi98cStT7K6TmAhRHdk02M0aGaUw40PAhD6phjp16IQ3DIkucM2AGOIZR:91Oj+wmcSTTmgRHSEGa40ok6bzI2h4Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212215, "uuid": "4ccc80a5-695d-4d54-8e6e-b15a92826e97", "value": 7618142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212215, "uuid": "3919ba78-875c-430f-b8fe-3596234eafc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212215, "uuid": "faf811d8-d8a5-4afb-99bf-ad2cee79327e", "value": "d7b02b977d428ea9ee50f2f326b54e55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad94538-aab0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676191047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191047, "uuid": "22ae5709-c5ff-4dce-b84c-bd9cd026f2ae", "comment": "Malware payload (RedLineStealer)", "value": "8f8a31450d9dfeeb74d537725480f515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191047, "uuid": "d4a6eb10-3d38-4132-92ff-fb5e5074c574", "comment": "Malware payload (RedLineStealer)", "value": "a57e23508be28f1f2ef134c9d4f66f1b149dddc15d2db61a5aa1f1c42086f84c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191047, "uuid": "11f33bfd-797c-4fe8-9205-fa611c0916f5", "comment": "Malware payload (RedLineStealer)", "value": "6c961625be721be143d1ea5050cb53abb84cec47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191047, "uuid": "101f3583-cf11-41fc-be5e-a38213e8d808", "comment": "Malware payload (RedLineStealer)", "value": "e12c087b3936f1b1bddc96679e1359022bbaf38fad10b7457b7e4818d8266c44d7fe3e88eafc0dc726b448c92d2706bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191047, "uuid": "b7182c38-4214-43b8-9e52-4b0338b8f42b", "value": "T168F41207EAE89521D8B0973048F503C71A3ABD91563C82AF378A6D1D5C727F4B23976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191047, "uuid": "353db10e-3c67-4616-9777-efbecbeb138a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191047, "uuid": "71f68d69-8131-41e1-a14c-be607ff80423", "value": "12288:9Mr+y90tixNo1d47TVUGoX6uEbrb3eJu0w10+KQAkn4y6oEWxobGP6XmA:ny6f1wKubr8bw6EAkn4yrDiFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191047, "uuid": "3e28f4ec-7888-4b46-9545-813762bf2932", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191047, "uuid": "63eacf46-e885-4dac-b01b-80fa5f993f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191047, "uuid": "60e7910b-e092-4426-8523-9bd6860e2776", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2d2533-aa92-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676178214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178214, "uuid": "b66ffa9d-8f65-4635-a454-b3626a0cf8a6", "comment": "Malware payload (GCleaner)", "value": "89e26d92a0fd84a066cdb8c512c482dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178214, "uuid": "40a335ee-d25f-4f88-b89a-244714a1bc6b", "comment": "Malware payload (GCleaner)", "value": "a5b75948433105d1466747d53b673ea61dd7c6e9a2dd937a98a07091cf86aac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178214, "uuid": "9b4d52f6-f23e-409a-8862-94328adb110e", "comment": "Malware payload (GCleaner)", "value": "fa6f586345e1c2f2fc7ccc6b2859d17bdcd7f091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178214, "uuid": "b7a27903-28c9-4b24-aa34-b24915b498ff", "comment": "Malware payload (GCleaner)", "value": "dcffd586a386c26a8922eab79d8958ee1eac388ab89ffcf794368e908079cc6e954d4b921d6a82fd87f4eb639eb8e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178214, "uuid": "9b8d836f-7bbc-49e5-8938-9a0cf88f8b46", "value": "T106F5127C7109C56DD680FEB4883BD8EB5CD66DE3E9A4A422B0D87F3F41791849B1A207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178214, "uuid": "5e0cfe82-91ec-4b2b-9ff4-d6b1ae7eb423", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178214, "uuid": "e5358607-5511-4df1-9677-6925d507abc0", "value": "98304:JHoNhLpCVhDlp+ZFb2Q80cX2RDL1c50ESF0isqNv2MR:dogDlQZJV8d2RDJc50ESF5LNvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178214, "uuid": "cb1656d7-1d35-43cd-a4f1-915c1bac5370", "value": 3610670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178214, "uuid": "3cabc5a2-62fc-4796-a35f-3db362381a55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178214, "uuid": "cb4808ac-03f1-446f-b4a2-37be0b4cd610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5379f8-aaf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676220204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220204, "uuid": "3e757e03-c2d1-4d88-aab2-f5b2f8e540c0", "comment": "Malware payload", "value": "f9a1149ddef948d6a9d7f4a3797a5fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220204, "uuid": "4cd6e8f8-9b77-4f14-a21a-ea89be3d163d", "comment": "Malware payload", "value": "a606b38660e0ac1c6ac3e5bdbc9b573ff0fe428895ddc302fe03f01a5a0cffec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220204, "uuid": "eb3c5c13-830e-4b7e-a81d-f60089bd259d", "comment": "Malware payload", "value": "1a93e0dddb54c2bf7918aadeec688417c90d0eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220204, "uuid": "1eef79ab-f28b-470c-82e8-356b2b28051f", "comment": "Malware payload", "value": "57f7444443950a79880e26c9695d9a31ee4f0240fdef638fea74e7ff351636eb8c727639cb1e555d814213ce1988dd2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220204, "uuid": "8e84ebb7-2f6d-4a79-abe4-a5175ed56183", "value": "T19214CF21F6A28032D052497DD832DAA47AFFB8A1A765C5CB23441BAF5E303D15F39396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220204, "uuid": "27217579-2b36-48c3-adc7-4b0a8b66447c", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220204, "uuid": "10a39551-7538-4595-a13d-f6f3f1bc8fdd", "value": "1536:a7g8g+rGj4VneHmmCkc5i6YHsA4rI4sP5Cf/LFo0zeBXJM7bYfRgn7CjGSWQaXQl:a7Lg+rGQP5i5IbjPe0l7Rk2CQ+yoaOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676220204, "uuid": "dce5eb44-10e7-42b0-b111-6c8940491926", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676220204, "uuid": "d39c5c68-f7d8-4545-b3c1-ec0885d4c6c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220204, "uuid": "5e25a396-c56d-4e60-9d6a-c77d0017bafb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f671e65-aa92-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676178035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178035, "uuid": "335fe1ff-c64f-477d-bbf3-9f9308d49280", "comment": "Malware payload (RedLineStealer)", "value": "21f7dda0107634f37cd4510981433581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178035, "uuid": "d1ddca74-cb56-4bf7-8085-dd550d09664b", "comment": "Malware payload (RedLineStealer)", "value": "a690344fe0121bfb64274b11b4e000ffd3e884e23e8188f8e7da2b8c92ec2c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178035, "uuid": "20c570c5-43eb-4546-bd06-2905d015a788", "comment": "Malware payload (RedLineStealer)", "value": "79d49edb7b2a6457228e566289a13f4310f89b9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178035, "uuid": "623e1688-5a8b-4cc4-936a-d33023417e7b", "comment": "Malware payload (RedLineStealer)", "value": "89acc80a1b51ad2d2f0dcf1e5219c9b7dfb628b9e3824a5c4a8e085dd28939a21ea0107586ef2bb3c0390589a9bc3a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178035, "uuid": "93e6b800-943b-4324-a669-8116a11f8651", "value": "T13D54011175A1E433D0674AB12962EAA07A2FBC325795C2DB331917BF0E312D25FBB352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178035, "uuid": "a9967645-405e-44de-b247-6ea8efad35d3", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178035, "uuid": "57204f0b-6fd7-4c5d-8fae-1c40ca36e4d6", "value": "6144:jGxRRGMR/sm44RTGTCYMC7ZM0VlcrSW83vzDLIe:jG3EMVsm4438M0Vlc+W2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178035, "uuid": "ded39a7d-bf8e-4ac3-82ce-e8f785fa13d2", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178035, "uuid": "6997dcdb-9c71-4ae7-989d-e2b4e707ff88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178035, "uuid": "5d41ea53-0ce8-488d-8294-69da3511800e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d239a-aaad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676189815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189815, "uuid": "28c765dc-2b9e-4251-b26f-a595ce2943cf", "comment": "Malware payload (RedLineStealer)", "value": "7f982036bed525afc35bd5921fea0fca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189815, "uuid": "01f991d4-b04f-4d32-87a7-a395c6b8f402", "comment": "Malware payload (RedLineStealer)", "value": "a7ce168453db6f94013ede36260ab757d09840719803d55f990bd9c22dc6e5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189815, "uuid": "e5ee6c56-c625-461b-900f-2e4dec9c22b2", "comment": "Malware payload (RedLineStealer)", "value": "677367cfc4a4924850a5fbc8a5c529144036efdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676189815, "uuid": "a9190dbb-5784-4c58-a31e-009f4065837f", "comment": "Malware payload (RedLineStealer)", "value": "9bff1cc8b429bb57086768b4a3e7963681cd71b97bdd7af45e6620a07f22aade449cb606516ad664c94b169a26f4dc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189815, "uuid": "e56a1b9c-c456-4c97-b09d-37550740d1e8", "value": "T156F41247B7E89026E8F10B7108F703D31A36BD616A38839F564F6C594D726B4A27873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189815, "uuid": "d5ce1eca-2b7d-4b20-bbd6-e7a152fd4ed5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189815, "uuid": "7e63d54e-8747-4295-b302-0b6a1421a4e9", "value": "12288:tMr5y90/T41/L0X8LAk/2ghMeZKNQY9DLFPkAHeJlMmUYPHRC6rSMnOcm76wPuCk:oyoozhLTevFQGLFMni8xHr1Dm76St2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676189815, "uuid": "684ea060-7410-4c73-8d3b-f8a8c4990ff1", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676189815, "uuid": "90ef3baf-c0ba-45c2-bfb4-184aa70d5440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676189815, "uuid": "214fad5e-bfc1-4d3d-833a-7d80afd620c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670d313e-aa7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676167821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167821, "uuid": "a5775db2-a7cb-4a2a-9397-f28ce7f67221", "comment": "Malware payload (njrat)", "value": "bcf704e58120363601413377e999fc5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167821, "uuid": "77853bee-c495-44c9-a7ba-4d7004ef925e", "comment": "Malware payload (njrat)", "value": "a805fff1cae74228ea65e1e4b8038384dbf25afbdac9dfde59c80d666042b9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167821, "uuid": "59351d5f-7d5f-4760-821b-8f3e44f5d8fa", "comment": "Malware payload (njrat)", "value": "beb0bd64f749e8e2759b7639e4ab3e5d6d6658cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167821, "uuid": "7e713a2c-1b1c-403c-a077-6cf9f224773e", "comment": "Malware payload (njrat)", "value": "531778ad86e59629777c87da3212d7fcbb24c346266c3ea6a819ec1cab7444748f65e990e42acbf9e53c47152789c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167821, "uuid": "2eb74bc8-8f65-4877-97f1-3e966abf5ba6", "value": "T1D113D74CB684E174D5FF8BF0B4A2B2890B71901BA902D30F99F254D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167821, "uuid": "04b4ff18-5b8a-4dca-acfd-5060ac80e8a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167821, "uuid": "84908ced-440c-452a-8c09-62e32662a485", "value": "384:NZy8R8EdsbhKIyK/zriIOEiLr2z8Iij+ZsNO3PlpJKkkjh/TzF7pWn0u/greT0pu:nThiwFKrrP8EuXQ/opu/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167821, "uuid": "6213995b-7c1f-4113-9d12-c28225ca8c62", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167821, "uuid": "cc76d67e-78ec-466f-adfb-404d390a8278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167821, "uuid": "b4313a2d-99d7-482c-a675-9efa3bb6046e", "value": "bcf704e58120363601413377e999fc5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1377ec-aad5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676207074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207074, "uuid": "9926e5a2-402e-43bd-bfb9-8d3d02d24b95", "comment": "Malware payload (RedLineStealer)", "value": "f4e4374d00ddf951a39c3df123fbe939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207074, "uuid": "52c53038-3677-4884-9f0b-233632ad7d94", "comment": "Malware payload (RedLineStealer)", "value": "a817a6437d99f8a96cf634b45f9dd141a9b1fe04f8a2d2335e92c45796b7b061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207074, "uuid": "17c9efdb-475d-410c-931e-20f17bc3c875", "comment": "Malware payload (RedLineStealer)", "value": "2de314e9c88a70b475d1b6375438b487976615b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207074, "uuid": "4039286f-9268-45ca-a275-c318df91f9f4", "comment": "Malware payload (RedLineStealer)", "value": "4063c7bb12749450ee223c7cebb20a7ff242ec20a628fe21effc2b8f6236ece3c0f4fba1dc390bb10fb6c05bcb9e4318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207074, "uuid": "6650ab40-a763-4d7b-bfbb-516231a9142f", "value": "T1C554F1223A92C073C71781B169319A94696BF8B1A366C6C7F3441D6F0E307D1AFFA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207074, "uuid": "3e8e6a1c-9061-4fa1-96d3-354186ea51c6", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207074, "uuid": "c16befa0-9229-44dc-8918-2ad80123e8b0", "value": "6144:64L4uWa+DC5ade9xx4nA64w2n4CHen6Hq+4qri:6cFXI6a4xuDYC3BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207074, "uuid": "200ed3da-7896-47e8-a0d9-d6fe6e245f6c", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207074, "uuid": "521d031d-fc3f-4bbf-89c8-24ae6dc6b6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207074, "uuid": "4d31fbff-84cf-4eed-a5c7-38c82b2efcc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7955cf-aa6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676163268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163268, "uuid": "be3526a2-4f37-44a9-b8f7-832982371a5a", "comment": "Malware payload (Smoke Loader)", "value": "b9c82d6f88eeeca3dffd3cf354a945fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163268, "uuid": "41a5d0a7-645c-48d5-805f-0689eeca0870", "comment": "Malware payload (Smoke Loader)", "value": "a81f478a99eaf2884fc897843f4b5910f9ae1faf65d01465218fdac4492fa432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163268, "uuid": "7c1a735a-ed9f-4b91-b129-a41a78758e68", "comment": "Malware payload (Smoke Loader)", "value": "b47f7d20e01676a13e7185d2b7b765111e5639b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163268, "uuid": "50166ad8-b603-4393-a900-952146b3ef1b", "comment": "Malware payload (Smoke Loader)", "value": "59e8a02cc4210d41ed0352a5bab99ec6b343e2d4c6f972b8652d4b88b9bf0de28a66521e1f3b27e16ed66f9dd79d441f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163268, "uuid": "93e95c97-d527-4a4d-bec4-97ae9938c636", "value": "T1B114E0117AB38073D5A346B52531DAA47A2F7CB1A791C0DB334826BF1E203D25EB7396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163268, "uuid": "353cea90-84db-4ad3-a3d7-b0a3e2b2c691", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163268, "uuid": "f5d35175-528c-43a5-9a63-dca05380234f", "value": "3072:2jqG7+0JuoZj5C1jdljr781+PvHrzNQv4rtG:2GiRc1Z5r7fPvHrzKv4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163268, "uuid": "01cd3a89-358b-4b4e-9e8f-ec4aa4f46787", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163268, "uuid": "cc59f703-f71b-45ed-a103-53ce28ebd6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163268, "uuid": "f4b00405-7c0d-4b7e-9e02-e1f000e57843", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09eb29c-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229442, "uuid": "1cceaa20-509f-4822-a35d-82a8ac97e784", "comment": "Malware payload", "value": "4ae40d65f34cfdf734f7fad2da39f460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229442, "uuid": "1efb8cbd-8ca3-4a43-bf05-e90a2f35fb7e", "comment": "Malware payload", "value": "a849d65faadcb034c41bfa162a86439dfe6e1f45bdd9c17e4cc8ec078f3beaf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229442, "uuid": "dd21968a-1db8-4f66-8b41-ae71d5243d3a", "comment": "Malware payload", "value": "0d88ac4030891b93d859d9b1a5ebaeee6e15c425", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229442, "uuid": "06d2a918-b560-4dde-bc9a-2f976cfcf96a", "comment": "Malware payload", "value": "434788de63dd85b9007c8b76042fae60c14bfa2bb4413bc081f8d89f11d425c0324d8bfd943a8c7fa481e962b53441ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229442, "uuid": "b22b42d9-5501-4f73-86bf-d37651b57f5f", "value": "T105F4124BABE98032E9B413B05DFB02C317357E616738439F678A6D5948336F0613A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229442, "uuid": "b83fba08-9f52-49df-b941-b6e62a035a7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229442, "uuid": "81098506-0a3a-4357-b6b5-c3dcdc99ea87", "value": "12288:SMrfy90138Lp1Wvk1vfd+pMK8p2kgreJ2B2S5O0a5obifVqdXw69:lyCsPWIgph8p2Q2DKobmqFwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229442, "uuid": "101267a3-1e7f-45a0-9811-f02c62cf9ac8", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229442, "uuid": "f152fdac-bd8b-4e8d-a61c-f92de88e73c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229442, "uuid": "9835df77-8f52-46a4-8121-8977f6cbfe45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd12c30f-aae9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676215639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215639, "uuid": "b6031195-3cf6-4c5e-9c42-d329413781b5", "comment": "Malware payload", "value": "76142ae6bc689eb649429cdac475a0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215639, "uuid": "67e8a7e8-dec5-40ff-9a7d-6fd41f2dff8a", "comment": "Malware payload", "value": "a9362abacf731d794e89fd78a5a0c47e68713c180319cbb9d8a6042bbaa95100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215639, "uuid": "cf30cfdd-ef06-412a-a01a-c30556332cb9", "comment": "Malware payload", "value": "d8cdfdcc92477b552ebd53675df5b8c9261028fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676215639, "uuid": "e4697686-637a-499b-8630-115a50ac79a2", "comment": "Malware payload", "value": "8f3e769c891cc8c2eb595a8183d039066a00540aa721a7179d633211236e2dc161e59073ed80c486342d47e9f03b6b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215639, "uuid": "cb18c729-5ebf-48e5-b586-b6a312497926", "value": "T15C067C22B240583FC05B3739556B6FB68E3AFB6536178A66A3F04C5C8F36680752D34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215639, "uuid": "86bb3481-7f89-404a-8b32-c84194750d6d", "value": "21c129224207fe41e54fd74bf52cdb21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215639, "uuid": "7c945bd8-4df3-467c-8d37-f45ee73a2a26", "value": "49152:Wx211wH2PLA5SSRLRG/nMPEZEHyTM7wdOYv:e2EH2Db67wAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676215639, "uuid": "621df39c-eaec-48bf-b034-389884817f09", "value": 3953678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676215639, "uuid": "f34c8f18-e9ac-4441-b6eb-5f439a3fc556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676215639, "uuid": "5c31e95f-e161-4d01-9c23-6dd217c30ab8", "value": "d8cdfdcc92477b552ebd53675df5b8c9261028fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8e328d-aad0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676204954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204954, "uuid": "016ab1fc-aefc-4ecd-ad76-cb1d77415f91", "comment": "Malware payload (RedLineStealer)", "value": "4e105c7e153f284e0f31c2642a2bc869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204954, "uuid": "20f75a5d-6ebd-4495-b3ab-03afef6ba4d2", "comment": "Malware payload (RedLineStealer)", "value": "a9b05d1ff254ece60ac1e6c44458ce417b07f8fead6bbf7662f49561c5a865bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204954, "uuid": "485d21eb-09ac-4227-995a-2ffcbc68fca4", "comment": "Malware payload (RedLineStealer)", "value": "838dfa12967075182d9a935c9ed5470bdac65c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204954, "uuid": "ed435c9b-7899-4019-978b-73a54a71b3b0", "comment": "Malware payload (RedLineStealer)", "value": "559554f81e01be8b252ca0034034b9d7693f35f25c03bb6dbda5a1b681ffc1f14dddf41e317e108f9f82d25ba9b8b0ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204954, "uuid": "12a40cd0-353b-441d-bfbd-e084935c4c57", "value": "T13FF4120BE7EDD022E8B41BB11CF703D31535B9600A3843AB778E7D0E1A716E0A5757AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204954, "uuid": "0ed784e0-c2eb-4b6c-ab3b-721cac3615db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204954, "uuid": "a1f029cc-3062-4374-8e90-ad27d9435a57", "value": "12288:kMrdy90IBxiVrWwDgtIpqp9YFM+gJktnvReJMXO9P1bHM1oVJyB6cvs1MrA:hyIVr9D7pqp2FZgJ2K8O9P1LMn6xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676204954, "uuid": "453a4477-ad71-40f2-b00d-e3b2d4e74a02", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676204954, "uuid": "8a0fbcc2-4d0b-48ca-addc-8337756e4791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204954, "uuid": "0adb4348-8a43-4bd8-9f52-0176ae6c6a23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47afb184-aadd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676210288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210288, "uuid": "0091b033-128f-42c5-b845-3e729f64fc8c", "comment": "Malware payload (Smoke Loader)", "value": "36cad8727389bafe40fff25b3cd9fde4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210288, "uuid": "e2bded20-2e0c-4c81-9f6e-67f4813ed592", "comment": "Malware payload (Smoke Loader)", "value": "a9dd9faec6be966254f4972b750bcaf520d608c79bf5d0354dfaa6069f03544f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210288, "uuid": "8eda63b7-8885-4003-8d34-5781fad9d5c9", "comment": "Malware payload (Smoke Loader)", "value": "040c2dca9b5528cfee6922cc2577362360193da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210288, "uuid": "2892eda7-3260-4be6-a429-31ebd0a6d1a2", "comment": "Malware payload (Smoke Loader)", "value": "08c36b409544ddc86c92cf925f40a42349027ba801343b9061ebe93afa66e07c5e9bf9d3c00f22072e696dde443d1824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210288, "uuid": "497795ee-296e-4f26-9e52-b9b298c1e2f8", "value": "T19B14CFD17AA1D03BD10746B42422F694AA7FB8B0ABD1C5C723481B2F2E213D15AFD397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210288, "uuid": "cca7f66a-b712-451b-a1c1-58d0c84ca41e", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210288, "uuid": "69c55a4e-897d-41d6-ae6e-c4e093f6850c", "value": "3072:P7P3P+rGmn564TBDSqQKY5gH1LLP6iaEY+GiM9xFelgJGjeYVcVdkee:DnLNyhQKYM1LuiaV9v+3BcDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210288, "uuid": "f51e4280-591a-40ac-9df4-f91e9dab0b6d", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210288, "uuid": "f50d4bf2-5a93-4492-9932-8a45ddab0e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210288, "uuid": "6c45822d-7aac-4f73-8dee-c7b66fe44df8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ade3b5-aab8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676194526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194526, "uuid": "3bd5ad90-648a-415b-ba5e-22c129f5d380", "comment": "Malware payload (njrat)", "value": "06e03d71faee0beb5343e4926a096623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194526, "uuid": "5bd9a182-6a68-401e-8fa1-2bc18a758198", "comment": "Malware payload (njrat)", "value": "a9ee5faae70b77664c520b968ab734c717de76fec163170c02473276226c89b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194526, "uuid": "259d0877-6a61-4e03-a913-4bb26bf5c383", "comment": "Malware payload (njrat)", "value": "a5ae683d829bfd450e2cf8d857d6a3a0ad16e06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194526, "uuid": "ce97822b-7b7c-4bbc-b234-31d5e800afc7", "comment": "Malware payload (njrat)", "value": "45af6ebad10fa503ad278dbdaf1575896b27fe96033bb6e92e776beee6bd31f58701d9a1e831d913ac70b66af794d93f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194526, "uuid": "2b6be0e5-62af-4a14-b2b0-3d01875ef12a", "value": "T127032A4D7FE18168C5FD0A7B05B2D41207BBE04B6D23D90E8EF564AA37636C58B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194526, "uuid": "fdcc9170-ae07-4239-9bb4-25565fad5571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194526, "uuid": "c18f07f3-69b9-4b99-82aa-ecf782545306", "value": "384:t0OQilmhHeTnMGiyMTvivJAjHuGkrAF+rMRTyN/0L+EcoinblneHQM3epzXBNrnX:ahSMGxMTviuDubrM+rMRa8NurVRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194526, "uuid": "220a6f53-947b-4c48-9cab-f509417b1a33", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194526, "uuid": "a74ef39a-9b23-4739-bd09-16eeef687072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194526, "uuid": "b1ecd93e-5bfc-4863-93a4-6a4818f65e17", "value": "06e03d71faee0beb5343e4926a096623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54265c6d-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229636, "uuid": "ca77f7e9-985f-449e-a088-3233fab72437", "comment": "Malware payload", "value": "b179c77625c6e3d5bfb75d2b9669a17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229636, "uuid": "dbba4c08-4469-4f12-ad44-84a79ed51692", "comment": "Malware payload", "value": "aa3219f2a797fbc2ead16854c576c6434d7d0635a6c8c76940b20fb59c5e71d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229636, "uuid": "6ea3a6e8-f201-44c4-9390-2e72b2853520", "comment": "Malware payload", "value": "acb278e5ed22e22d843a142718e01e09dd96640d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229636, "uuid": "f1b00194-97db-461a-af28-458bea642c1f", "comment": "Malware payload", "value": "73dfda58a5202ce5a9e0c6657800a75f02b70e3d4b46920656b6df26c159e5d59f7d4caaf120d2febca3b31a46ef5470", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229636, "uuid": "25045ef4-1154-405f-9a55-1c93af2e38b3", "value": "T1FB652352FAC08670C6322D3446F7AB717A3CBC2067B5CCE797547B1E5A201E09A36767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229636, "uuid": "6cb60f90-887c-42f3-8e3d-12a833ed6a92", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229636, "uuid": "239e4307-2d8c-4b7a-871d-112165ddddb3", "value": "24576:VLeTtjJF5HrKFg8QENCX3UCIjBzMEryfzJMM0SF61rh1l3WQHiCXMl:VLYgORnUCIjBTrydMMe1r/lmQCG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229636, "uuid": "55bad84f-edc2-4f68-92bf-a88a904deeac", "value": 1489526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229636, "uuid": "3fe56348-4c2d-427d-ad23-cc8bd8377982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229636, "uuid": "62339e4c-380a-4381-9ebb-3f378cac3efe", "value": "b179c77625c6e3d5bfb75d2b9669a17f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d208bb-ab13-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676233610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233610, "uuid": "ef4fde91-b5c5-42ec-bca6-7ddbbe4c85e6", "comment": "Malware payload", "value": "144052515412de1f9a62d1797cd51f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233610, "uuid": "609bd947-26e7-466e-acf0-c62231d8ddf7", "comment": "Malware payload", "value": "abab5074962a00bfddec92ed2e533e0ef2cbb97788145fb98b4f057340989d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233610, "uuid": "ecae0483-7dc8-47b9-bfd9-d2acbb1ace3a", "comment": "Malware payload", "value": "7072881cf21db49b94d3e35c8a987db930786f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233610, "uuid": "4b06ffd1-1f3c-403d-ab42-186674b27c58", "comment": "Malware payload", "value": "7a6335c2e8bafd304ee2599f01c41a9360e3f3b80581b72fd17f013db0477c90142b76bb105fe132402adb0cade7a5c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233610, "uuid": "4c06df19-04e7-448d-8d96-f27af576064f", "value": "T142F4120BA7ED8462D971577048F603C71A327D119A38829F538F7C491DA27B4A23A7AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233610, "uuid": "a382d268-3bd8-473a-a9ad-bf21aa877d8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233610, "uuid": "ece25fe7-7a37-47aa-944b-1f1e00f63378", "value": "12288:UMrKy90XR82nVPVSgr9JbK0LpSeJDkEE7ADVl7B6w0izN0Vz:myUTVtSgxTN4D7MlN6wFzNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676233610, "uuid": "0c4e4384-4ae5-4d83-99d9-a978657ba0be", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676233610, "uuid": "98d7a21d-d8f6-4e04-b3a1-c36e1fcbfb78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233610, "uuid": "83e17a4d-5d30-4ea4-af1d-6edf05a01ac0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f815d2-aac9-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676201668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201668, "uuid": "d5a72368-b9a9-4f52-bb72-81c21ec8cff7", "comment": "Malware payload (TeamBot)", "value": "bf216a294f44d0e6ab8cf375867d0ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201668, "uuid": "7df4e523-bffe-4e41-8197-dbbcf7089d23", "comment": "Malware payload (TeamBot)", "value": "ac339b6402a135480e19d9da23b5e02e3af605b4d70104b6dbb7bdbbe5e86570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201668, "uuid": "be8d0ebe-32d3-4ad5-b126-12a67d7e7cc0", "comment": "Malware payload (TeamBot)", "value": "0f2c939a394bed4166500e37dfaf89c18211296a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201668, "uuid": "2e952fa9-1c8c-490e-878c-913501b7f3d1", "comment": "Malware payload (TeamBot)", "value": "996b242a3f9f89df905ac8f631d713a6dd025e14521c7b941c005434cad0b731bb619b594a2be6de5bd416c30d5b841f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201668, "uuid": "2fa61a7d-8815-4a06-b23d-a676f3d73231", "value": "T13514CF9176A184BED1A78BB41831DAA4A93BBC725BE1C0CB3318165F1E313D15EFE352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201668, "uuid": "996ff0e2-2894-4fa5-b924-ebaa38e41498", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201668, "uuid": "87ffb81c-9ebf-412a-a268-9ecda674243a", "value": "3072:Qbzk+FsRRseujxuEn0ej55qLI6Cj0iDcaQjGFr4pSEXi:yAgew6eV5qLJs06ca2GFudX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201668, "uuid": "9444ef75-665d-4838-8b5b-4f9d9b60c069", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201668, "uuid": "e44dbcdf-d9ee-494d-af66-91c7de899780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201668, "uuid": "8b2fe69d-c238-43fe-9d10-2696b48331fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a9ed48-aac0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676197777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197777, "uuid": "d47395f8-2b68-45a3-9b90-7126c6c1e9bf", "comment": "Malware payload", "value": "102df7d4425f0ef18ff1648eecd9bfcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197777, "uuid": "939c8d13-56fe-4514-ac21-67f3f7173078", "comment": "Malware payload", "value": "acf656ee73ce848a33cc46562773a6b9c4db9c3d4e8250fda5ac3e8ac3c203fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197777, "uuid": "48a556ba-84d2-47d4-a897-d334e6668f6b", "comment": "Malware payload", "value": "a9e86333361da881baf796fde69fb8e3ef8a22eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197777, "uuid": "aa880443-36fd-4383-9812-08a8bf3e5d29", "comment": "Malware payload", "value": "0d9b7b7a691ee899b5f75629e3c5417f7f631376478d711e17f0240d4af913999f7cad02705b070e7e1626a4f9c39a4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197777, "uuid": "848ed1de-ef5e-4975-abab-aeea2e49522e", "value": "T1E3F41207B7EC9032E9F1577018F303D31A36BEA01A34D796638E6C991832675A63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197777, "uuid": "321ecb0f-5dbb-4b2d-84e8-601d41e049fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197777, "uuid": "523745e3-5eaa-4fa5-9d17-6b8c8b09f12b", "value": "12288:ZMr2y900INRVMaNSrJ3yedGutNYS3reJ4QTGlDIuzhss1l8EOqC:7yMVHUrJi8GSR84QTGlnWsTJ/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197777, "uuid": "68d46735-937d-4843-a962-6961247ea280", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197777, "uuid": "23c00809-9d47-4327-b729-e2b28f188c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197777, "uuid": "453338d4-2c38-41ab-ac01-c0b25db4ee7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23073ff6-aafd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676223970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223970, "uuid": "268c9411-0093-4b2f-9b92-308077d32f42", "comment": "Malware payload", "value": "94d6d55d5e41d5c3f4e839ac27c51e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223970, "uuid": "b5c56176-47aa-4ea9-939a-3c8d43a1982f", "comment": "Malware payload", "value": "ad436abe329dd8a5fb85d8ba2ff8893daa1857d78918d296b66f5e644bffb3e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223970, "uuid": "cb05c761-ebba-4657-83b4-562c5a55246f", "comment": "Malware payload", "value": "dfeea11c03ad71f7d2316da9177738f1280174c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223970, "uuid": "de1fa907-5a46-4651-a944-faf46eb4618c", "comment": "Malware payload", "value": "924f9b605aef73d13d92e47fd3a3505062d27f70a65ae84a02a489781b4d8571345a588bdc28266f335ecc3fbc8ff95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223970, "uuid": "35ab2328-29a9-4cdf-870a-9be18fa8cf91", "value": "T131F4120BB7EC8522E4F167705CF642E30A35BE414A74C29B678BED2A09716E4B631377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223970, "uuid": "168f9a89-6a11-455f-a983-e5768c2e7925", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223970, "uuid": "8c5aa0c7-b32c-4532-8790-89ead4ced76b", "value": "12288:gMrPy90vKCKXKT37rWcUaR9RClfeJd+F/9wPe6/UXB00QebpYfJ:fyzRXKnqfazRjy/9wPei4bbpYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223970, "uuid": "a2a1dfe3-eefe-455c-b6b2-6dbd56242def", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223970, "uuid": "9b561926-faed-4d70-a921-dbc8d16415b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223970, "uuid": "038e86ab-1d58-41ae-940b-5444678e4bb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec962e9-aa71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676164075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164075, "uuid": "e95d5693-4a63-4a28-8436-124abff82438", "comment": "Malware payload (Amadey)", "value": "721287554d2cd765db36a1ada315de6a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164075, "uuid": "362120a0-7540-4b36-8124-f77bcb09b53d", "comment": "Malware payload (Amadey)", "value": "addc2a118be8cc62e0e1af53931b3f29fe023ff6b6243b7f18bafa3438a95cd4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164075, "uuid": "682a3d52-fa4d-41ab-b347-fe42963ac8a6", "comment": "Malware payload (Amadey)", "value": "e5ee128c6654ec161bb4e929278f11201fb4c44c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676164075, "uuid": "32d24b7c-9009-4d0e-a46d-0fd1d29bb389", "comment": "Malware payload (Amadey)", "value": "3edd4fc785c65c9b1773f7a8c02931b155fc826639ee49645e4163db3dcda273c86b7367039f10416b3f82e6739322b1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164075, "uuid": "63275331-b935-4b2d-aba0-8937ebe7d89d", "value": "T173F4120BEBEA9031D9F4637019FA03D31A357D615B34925BA38E2C1A0C736F1A27576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164075, "uuid": "b9e9d105-594d-478d-a93a-45e23603ac42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164075, "uuid": "c5f8db23-970b-4d87-bba0-99d8b3e6ca3c", "value": "12288:9MrOy900/iw4NZoOlQ8gcQfGQe+AqVK275rJeJgDeePxvo4jimOM+NeVkVQEh4J:LyzZ4UOvgcQu1wKI5WgDBo4jimOxeVk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676164075, "uuid": "a7f9b170-2c00-4d5a-b658-f9ff2940287f", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676164075, "uuid": "42741438-9560-4780-9a7c-49a6f9090d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676164075, "uuid": "152289f1-70c7-48b6-9799-869315eb793c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339ca890-ab30-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676245903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245903, "uuid": "2606df40-1007-41e5-bcec-4fd99d430ab5", "comment": "Malware payload", "value": "88d8654b6a5fa2c8759ea6874c365dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245903, "uuid": "daa75a37-1cdc-48ea-93ff-6c834b61df76", "comment": "Malware payload", "value": "ae0648410a1953f61e0b88de9c59abff858bea053bd8a2340d25334b10766d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245903, "uuid": "1969c1d3-708f-451e-9494-6e0839db3c43", "comment": "Malware payload", "value": "fd08eee251a34a5c12ebe4dbae7e5bbdc9a1a747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245903, "uuid": "09dc4f30-bb1e-4103-93e9-62ffd9cf59a2", "comment": "Malware payload", "value": "91b7324ce950f260e61cbf2c35db1989e45c85f18ee3dd6fab4da519d591983d2311fda5bacdac7ec26437f2044c9685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245903, "uuid": "4960158b-d6db-4898-b428-0ba529c36f0a", "value": "T1ABF4121BA7EC5032EAB557701AF703C3163A7C915A38839B660D7E9A5C326B0B03577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245903, "uuid": "2d985884-57cf-4a1e-b116-d6db71702958", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245903, "uuid": "41425753-169f-48e0-9b22-db2ead289999", "value": "12288:yMrZy90OEjujz9jYnjQJRuLDimtSkTjeJciABip8ehBjBaFCTjgR0rDkIqbIbw:TysK9Ynj+RuimtSkoDae/2/S3YI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676245903, "uuid": "2123178c-6d3e-4b6b-931f-1e1b5ddd1ebc", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676245903, "uuid": "59e01192-972c-4b96-9356-3c59d447c8a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245903, "uuid": "574d1551-4b71-4cbd-ac89-d0a64299e384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e32be2-aabf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676197586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197586, "uuid": "d959cf1d-0c9e-477d-be3b-d1fc62355e9b", "comment": "Malware payload", "value": "cf5762eea336cf74a0323d715f72b8b9", "object_relation": "md5", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "esxiargs", "colour": "#E8D038", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197586, "uuid": "11c17a9b-7e21-4ef3-bed6-548fdcdc9b9f", "comment": "Malware payload", "value": "ae4b7284a9538c66432f02097c3de14e2253d16b6602c4694753468bc14d7d28", "object_relation": "sha256", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "esxiargs", "colour": "#E8D038", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197586, "uuid": "be76a9f3-e61a-419a-aef9-99e2972ff6e3", "comment": "Malware payload", "value": "b40e39adadc5ae4d98fd3900837414797562b1bc", "object_relation": "sha1", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "esxiargs", "colour": "#E8D038", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197586, "uuid": "55bd0a91-f3a1-4f29-ad6f-32091c211ba2", "comment": "Malware payload", "value": "1fa5d901366b4d38e1f4acf6260557bcf6095110d63f33c9f1b62ac85348770ea0ffa37e19f44ef06efb3d54e692c2ac", "object_relation": "sha3-384", "Tag": [ { "name": "ESXi", "colour": "#F3CB71", "exportable": true, "hide_tag": false }, { "name": "esxiargs", "colour": "#E8D038", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197586, "uuid": "67fe7d14-e705-408d-8a9d-21bdc4a242e3", "value": "T19371F0C7F141EDB05C8C94B6AFA6BC5CE44661881C097B04758FB129F7CCB87369A11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197586, "uuid": "e94ebba9-eca7-41f5-950b-e1c8faa3a9d5", "value": "48:B81BTsQYguuB+o64T7q/A8IFozKLT0CYz1L1a1/d1j1J1E1/n1Q1TL1G1l1AoW7y:BsBwsuuB+o6Kq/1IFozRu92EFqGaX1u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197586, "uuid": "aaba0139-f6e9-44b9-a0f5-2fc2a4a3917a", "value": 3577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197586, "uuid": "dcbb94ba-1e54-474f-ab32-57a3b2f88c66", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197586, "uuid": "f0446b54-f0e4-4038-af13-9a5cf1a9577e", "value": "encrypt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8071be0c-aab6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676193633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193633, "uuid": "a9df9898-db20-4113-b328-ea4a1e8c2295", "comment": "Malware payload (Amadey)", "value": "b22252831b0c3abf2774c859f95a6d6b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193633, "uuid": "621ed9fa-3ae8-4fc0-af33-66175e3eda77", "comment": "Malware payload (Amadey)", "value": "b0e76609fb8e8c77570bcbaa4dc547bf6ef3c9807c2f3d439d522b260e3d4954", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193633, "uuid": "58fdb61f-3231-4882-9bee-0bfee70949be", "comment": "Malware payload (Amadey)", "value": "606779bc340baaa4e7fc67a3081995051347b6f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193633, "uuid": "dc88b171-fefa-4c2f-8c21-b5987a77bf16", "comment": "Malware payload (Amadey)", "value": "72a1ef6df15d92e3a9e4754e6409edb93941949f6c7c76f9ff82ca71937c616ebaec41177999ddff78e77038d4c2b9e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193633, "uuid": "70a9ad4d-8926-4341-9de5-ce723138607b", "value": "T1D4F4124BB7EC9021E8F1A3701DF203D32B3579A11734827A678E6C592CB16E4A67176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193633, "uuid": "e690565b-bc24-4f92-bd25-d8c9ef64ea6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193633, "uuid": "75d28740-efd1-4de6-af82-04431be777cd", "value": "12288:pMrgy90oXkli2UpAPYPeJ/RWIQ/VWRnGtNINzhGF1l8/m:Nyvk82UmfZWZYnGvoAFTcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676193633, "uuid": "d996ab62-1394-4a8e-b7d1-b6f757929893", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676193633, "uuid": "eeb3d459-075c-43d6-bf19-2e10b01a45c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193633, "uuid": "247eb8e7-5d31-49c2-ad20-8ea02ea5d519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93a9c9b-aa6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676162053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162053, "uuid": "8c9035a2-ed1b-4f49-889f-8bffe2152eb7", "comment": "Malware payload (RedLineStealer)", "value": "d69b2d5f3bad5e53ffb295caa5702658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162053, "uuid": "2e37952a-142f-4c07-a629-b902e0addfdd", "comment": "Malware payload (RedLineStealer)", "value": "b1f43992487a08208afd5bd0c54d71a312b320df65ce02ba6b0ef59e8506e469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162053, "uuid": "530dfd76-f371-4dd1-85b9-6634e094c391", "comment": "Malware payload (RedLineStealer)", "value": "619f9fb3d1f02d6741843258a51039d075ba3506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676162053, "uuid": "863084a7-a709-45b2-b7fd-9c89c6b36a61", "comment": "Malware payload (RedLineStealer)", "value": "deb41b77610a6865883faff7882133fdf4f45c98c427176599b7686ad40359ed9fe6d6711a8d6269e994216b4f7cf31f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162053, "uuid": "f3f35185-3bd2-4f34-85b1-90b0bf67b41d", "value": "T1EAF4120BEBED9572E8B8237048F606E316357E724738925B678F6C1A1C711A0B27476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162053, "uuid": "80b59ab0-8b2c-45e1-9e0d-7471b706eecd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162053, "uuid": "dda1fad2-15c6-414a-8f07-160f06f56945", "value": "12288:2Mrly90pGcsVxjYTCEViyxgoqqYWleJj8Ca+dOBCjgmsAZNJVkBQFY:jy6aVx8vV3dYxjhaKRjgms2JVkcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676162053, "uuid": "25664063-c1fa-495a-bf58-21e9f9be682d", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676162053, "uuid": "0c044a7e-536d-4d5f-80e8-747514687234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676162053, "uuid": "91e3520e-049e-463f-b001-c0528a354ee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8435e34-aadb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676209618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209618, "uuid": "663cd51a-a2ab-4356-8710-dcc8bc84505c", "comment": "Malware payload (GCleaner)", "value": "3ccfc1824ca4cca7b7c8c7a4e92ae81d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209618, "uuid": "959a714b-29ee-410e-aef5-ac123e3d827b", "comment": "Malware payload (GCleaner)", "value": "b3945869446c1a37d637d4e81cc0092ca57a2cc56bf0f8e9880e72849b5c8963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209618, "uuid": "756a40e8-1fd6-4dfe-94b6-5820150805d8", "comment": "Malware payload (GCleaner)", "value": "a4023be8691a2030ac3ff2bd9ebe35d04d8e96f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676209618, "uuid": "46242eab-1765-444d-98c4-d85df5707787", "comment": "Malware payload (GCleaner)", "value": "020234f2d688793e8f3378b5d5a6b76334ec1f241bf769334595146bf42761a26f2d435b885496ddc64527170761bace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209618, "uuid": "381bf1e8-e08e-47cd-a93d-14dbe1e09a62", "value": "T123F5123C7006C9ADD6C0BEB48D3AA8E75CEB6DE7A894A41270DC7F3F92781859709117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209618, "uuid": "087e1790-783c-4867-ba89-0b09e97a7ce9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209618, "uuid": "f41201fe-3d08-4570-96fe-1cbb3fbd75a2", "value": "98304:JHuaRW5E0nC8kJBF832ItdGAl5vWwQstFlvd0U0v2MR:duak5ERBF832IqAlVfFfp0vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676209618, "uuid": "58bfd532-be40-40f6-9e0b-7007d35ea9d7", "value": 3594453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676209618, "uuid": "355103ff-2f6b-43b2-8fe5-9e57dc17b78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676209618, "uuid": "108e1ce3-4db5-40d8-a9c9-5c6ad685cc36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f696d-aaa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676186125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186125, "uuid": "40fbf7df-818c-4165-b01f-17267d66d267", "comment": "Malware payload (njrat)", "value": "c9928dd95914bf1391d574f8eb1d8449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186125, "uuid": "4bd02d75-75cc-4a8f-9879-746325d6cb61", "comment": "Malware payload (njrat)", "value": "b3b5c97c2be28a8e98e9da6a28d6bef3e2b4d0fa261209cc394053da0087fe98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186125, "uuid": "4e538611-eeee-4e84-81bf-d09c2f05bacf", "comment": "Malware payload (njrat)", "value": "1154af528f5710f15c6b52ba1c021f1c0fe96472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186125, "uuid": "c2e1d58e-ab7c-418c-a4db-516f06a3dea5", "comment": "Malware payload (njrat)", "value": "285687471f8a4f0027a46a43b18d24e3732e14a20896ed70bf647ea8900d477de65bc5e55b2c9b362c53754b0e56aee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186125, "uuid": "01a655d2-85cd-4402-8260-1a3d0d416af8", "value": "T14DB39E02378BCB62D55C253284EB152503F19B962673FB7B7E58325D8F03BE35E81A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186125, "uuid": "3df0585e-92bb-490d-a6a9-fcb0d70bbb19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186125, "uuid": "d86c1c08-801e-4623-b4ca-c5c04916d5f6", "value": "1536:M3GJdeHUoR/9eHHH/98YetOvqhLff0Amgosaz6CC/UAa0IgnsnR37VY:kHUo1YrSxffggos7s0IgnsnRLVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186125, "uuid": "c8b44c63-862e-4bf4-aae3-a59c2c2350cb", "value": 112182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186125, "uuid": "08ba0503-634f-4b84-a0fd-1ae137d401b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186125, "uuid": "8adc36d8-d547-4845-80de-a3f41d322984", "value": "B3B5C97C2BE28A8E98E9DA6A28D6BEF3E2B4D0FA26120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e80440e-aafb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676223131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223131, "uuid": "3c4bbd80-9e29-4e7a-aa7d-55ce7f3bf98d", "comment": "Malware payload (GCleaner)", "value": "9acb7ee41b4773768f3b2c8760933c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223131, "uuid": "0314bf11-1418-432f-b694-63092879ad1d", "comment": "Malware payload (GCleaner)", "value": "b3de252d58fa3c1ea38c16e12e8b2d9be34d242f6dc47c518799474a7436e138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223131, "uuid": "2449b587-a47f-44ac-be12-74d36fdbe19a", "comment": "Malware payload (GCleaner)", "value": "94430613f88ddf97b94b73dcaa36c2d6e3ced6ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223131, "uuid": "7f046566-4847-4239-84f2-59f2ff4d004f", "comment": "Malware payload (GCleaner)", "value": "5bdcc0d841cf876e6d03270f6b00fe199cba739f9515df1ae666bbc03eedfc46eaf763234663a9b32c7add30254257b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223131, "uuid": "6265a199-c650-4863-9fff-238e33b90b1f", "value": "T174F5127C7104C46DC280FEB08D3AA8E75CEA6EE3EAD4905270C97F3F557A6858A1E117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223131, "uuid": "1de00ba3-ee42-4cc0-85fb-b91a0a2687c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223131, "uuid": "70a29f8d-7b42-4b0e-834b-16535e29cfdb", "value": "49152:rdH7meZPFvsl0asC9HClKlK+/AzZ5pRMRjCibMh5gx2QgJStL4U7vxErBLCgv2MR:JH7Z9kOmilKhwoLx+JSt9lsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223131, "uuid": "db15f4cb-f558-4ccd-adbf-b31cc2f6f492", "value": 3601673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223131, "uuid": "ddaf43bf-49e5-4e7e-ad38-a0fd2dec4779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223131, "uuid": "e8a4086e-7329-4716-9b96-73d40a3a5432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92edf37f-ab2d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244774, "uuid": "fd35454a-1cb2-4ae3-88d9-5c7345ec1858", "comment": "Malware payload", "value": "2f07fff4c44a4cb27d45b87a9a26c0e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244774, "uuid": "1e8ab9ce-ab56-47f5-8634-63d902683b32", "comment": "Malware payload", "value": "b445a7d686ca24dddecb28c7f314c7d50647bc61de9f8de2fea2fe968b16bbbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244774, "uuid": "438d4169-5ce0-4833-ac18-1f3356b51680", "comment": "Malware payload", "value": "8fdc5b8a4fb27f2823d8bfab2c38eb7fe888c212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244774, "uuid": "b2034d4f-06ad-4dba-81ff-9dbd5d0d06b6", "comment": "Malware payload", "value": "f7c9df62e89c444f357a09cb0ee1eb55f4dd94c90404905810f3b7904931448ad903d54f5782018fab4ede7d83b1f3f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244774, "uuid": "2f8511a4-7448-4658-a93e-637e52aab529", "value": "T133F5127C7145D89DC680FEB88837A4E71CD66DE3E9A4A56374CDBF3F6178248960A203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244774, "uuid": "23bce48a-025b-49d1-914f-f52521f1ec2c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244774, "uuid": "26a173f4-fe9e-4426-8782-2a374f5ee4d8", "value": "98304:JH321pL3OSpbEyn9gGVk+fGh1LhRsav2MR:dkpL3OSqM9xBSjmavjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244774, "uuid": "32a02fd2-0037-479c-900b-de613947b996", "value": 3422623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244774, "uuid": "c7cde0d4-cf09-4c1c-aa92-3ca157294e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244774, "uuid": "529cd0a5-e203-4557-a1cd-06e3f316e541", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73511b0d-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676212079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212079, "uuid": "2a5ed7c8-d124-460e-b447-ff9ef025d033", "comment": "Malware payload (RemcosRAT)", "value": "0f560b90721e1a3b4b5faef80c17bbfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212079, "uuid": "bb78350e-dad3-41f8-b1be-ad2e0fc9dd10", "comment": "Malware payload (RemcosRAT)", "value": "b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212079, "uuid": "313a2477-d647-44cd-8ae9-b3bf47392528", "comment": "Malware payload (RemcosRAT)", "value": "5e798d2e1cef9a9399a9e149b0de97af6cc37763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212079, "uuid": "8b2b3dad-8f1a-4d72-b614-fe9fb109817d", "comment": "Malware payload (RemcosRAT)", "value": "79892bd3b27e809dd24a199473234c6eb898a3c384f249568480cf174e55ab812da2064e94034eece374fbcf92012314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212079, "uuid": "d3dd8720-8ea2-4c5b-b1ea-cb0619daca1c", "value": "T153A4F1957A909503C49AAF7959B7F33D9136AB247E87470BB7343B692F32B907D002C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212079, "uuid": "98c3c5fb-807a-4f0c-8934-84fc51dab803", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212079, "uuid": "afb7d904-4efd-41a7-b488-972581b39878", "value": "12288:p/ROa5165KMPDIAY8VQMZGxCgLNPvlvkENW:X5MVrIAXQMZnQPvV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212079, "uuid": "398d0e8b-4768-4ee8-965e-234c7eaf34fa", "value": 448984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212079, "uuid": "d03f9bac-0ec9-4e71-8b1c-afd3a2f8153f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212079, "uuid": "ced0be2f-e7e9-415c-889a-d6b5cd6a1d16", "value": "0f560b90721e1a3b4b5faef80c17bbfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b17eb9-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212113, "uuid": "81688046-ee99-41c0-8b03-5eed61cf5fc6", "comment": "Malware payload (SnakeKeylogger)", "value": "fb9df479ec10e856c179b30eb92313fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212113, "uuid": "d143dc51-6b1e-4ee4-b3fd-07061c1e2671", "comment": "Malware payload (SnakeKeylogger)", "value": "b761499c3ca5fa4dd96160023c0a7226f4db77e1f826f2b53fa99eddbfab38c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212113, "uuid": "b1b10d4e-5fff-4644-8d9d-13dcb3700922", "comment": "Malware payload (SnakeKeylogger)", "value": "7c09cc58e2c4ce785a7e3dc888e1e1913e5a13d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212113, "uuid": "78b4ab37-7d45-4600-a081-abd168d0bf35", "comment": "Malware payload (SnakeKeylogger)", "value": "2b9bf9ec27eee922a32f16b632854846c583d5f769d029feb22de4a466aaffbadf377c81775e984706a947e01366d911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212113, "uuid": "c16da6c5-0cc8-48d3-9e91-716504943f5d", "value": "T1AB0512509DADC276CCC96EBDC4711D76A2B1BEB280C1E7ACDCC170B66DA73116A0D13A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212113, "uuid": "28194582-737b-477e-adb5-f44a36b9492b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212113, "uuid": "66a5c26e-adec-499b-9cf3-94c1562177f6", "value": "24576:5MRYTynuUNAllMdadseKE6cVctotPevZ5FozOO/MtknueD:lcaEH0+jlrO4+ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212113, "uuid": "43c8ed64-f27b-4bc3-88ad-18e4d519cc9a", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212113, "uuid": "3e0085bc-9195-472e-a72e-dab2c0bc0ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212113, "uuid": "494ded32-6b98-4d3a-ac44-86172f1f5e9a", "value": "JsYdjWr6dLhzwd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeec1339-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676212179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212179, "uuid": "0a60a951-24ce-440b-8cb9-ab5ee2ed8c3e", "comment": "Malware payload (Amadey)", "value": "55b1e83727eb3e8d0e81416df28e463d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212179, "uuid": "4cc967df-8be2-477d-8e17-f3dd38dbc35a", "comment": "Malware payload (Amadey)", "value": "b8057a405a626ca25d5d5820e6795588436f810714941d3560900352410a8b8d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212179, "uuid": "d6d429d8-26c5-4407-9952-b47941bbb07a", "comment": "Malware payload (Amadey)", "value": "2f4e8147b8c85ec85935ca3e51b1f11d7058702c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212179, "uuid": "c53fc514-5005-49c4-a486-c06cb469aa26", "comment": "Malware payload (Amadey)", "value": "16461ba384e8387d9b30c533d1fd7fc6c2ab744756019aee1b703dc66eb1c54d72d10e8054797b022f8e25fd6334ed65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212179, "uuid": "f50268bb-a8e1-462d-a8bf-8f4988acd44a", "value": "T12405120BABF885A7D471437109F643C31A377D715AB8569F274F6D2D08722B4AA3232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212179, "uuid": "dd5b2b42-4ec2-449b-960a-a4dd9bff44fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212179, "uuid": "5d29127e-d8d2-4fef-8239-4d5da04861e5", "value": "12288:PMrdy90NmQapxJcqm4uzay880CkIP1JYC7TjcPnMOJaCwB57taEjj:KyimQamqu7880CkI7hUvdfwB57oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212179, "uuid": "34c5227f-6756-49a9-9c6f-e9a79ddbdf8b", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212179, "uuid": "cd81a6c5-9e67-4516-a86c-013237d2f8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212179, "uuid": "819f53f1-a3df-4b2f-87eb-07d3fa54ad9e", "value": "55b1e83727eb3e8d0e81416df28e463d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba757cfb-aaf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676221218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221218, "uuid": "d4dd5136-d442-492f-9318-33375780ac1a", "comment": "Malware payload (RedLineStealer)", "value": "e21cc875c952022f63187f244021ffd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221218, "uuid": "d7907ddc-146a-4fb3-8ffa-d48417800fe7", "comment": "Malware payload (RedLineStealer)", "value": "b83861c2a25188c0f18e7876c702bdf27a016b96b8d39313a3228c42e335a9b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221218, "uuid": "f49be4a2-a7b5-4dc8-a8b6-f9641abe2e51", "comment": "Malware payload (RedLineStealer)", "value": "0f4a15e11df5cb76164fcf5fa747e0775d1e1cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221218, "uuid": "e2c2dd5c-5c0c-46cb-bcbc-a1210c7dd38c", "comment": "Malware payload (RedLineStealer)", "value": "a79ceab8fc3f9210ba03f03cbbf35a203b16fb50669456823c21e71e24fb6b8903dd6526c487362b08cb7948c3c430b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221218, "uuid": "720b2b6b-2b05-4f34-8cbd-9c6167798f0d", "value": "T13454F1D13EA2D073D15245351D36CBA47A2FB8729BA1C0C73324962F1E703E29E7A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221218, "uuid": "5675e6fb-7c93-473c-a271-c22b704cf48b", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221218, "uuid": "2fc5aa3f-40cd-4df0-8e1e-0008a21eef59", "value": "6144:OZLpDNdXeAAzAd9fJ30qD3z2srVd5impgv2ySP3WbPi:OB9vyo9h0OxrbQ2ySubP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221218, "uuid": "e14e28b1-f443-4e38-b3e1-e8a62ceaa573", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221218, "uuid": "6bb89806-3307-4656-b5f2-f80dcbde0048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221218, "uuid": "fcf2487a-db9c-4df0-8e07-fd77f4d2673e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9763ac-aada-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676208900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208900, "uuid": "0bd2869d-f4cc-4f90-9aab-4c41a594e106", "comment": "Malware payload (Smoke Loader)", "value": "06bd8cf8712eca35910517d67259ede8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208900, "uuid": "05e30cea-d8e3-4661-9429-253d8c33e4ea", "comment": "Malware payload (Smoke Loader)", "value": "baf1f6da87435db3c566e844aef26d4fe01c02d149c0021fadf777b2c7f03ea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208900, "uuid": "7e3e6ccd-cc16-4ac1-8a69-1ec4c930e522", "comment": "Malware payload (Smoke Loader)", "value": "a56f466faf411e8e579841f68a0c43cb2e1b82a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208900, "uuid": "36b819cb-4976-48c2-877b-322859d5579c", "comment": "Malware payload (Smoke Loader)", "value": "f1407ee59be1439b30759f8ad478a6e511b695e081b82dd849b626f2bcb60b2ba558e237518e8c097486090f309c84dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208900, "uuid": "b9bebc70-8324-4d0e-8f0d-5aeaa93a8a26", "value": "T1DF14DF127AA2C032E557817C6531FAA06A6FB8F2E7E5C1DB3348165F1E307D18E7A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208900, "uuid": "994c1ecf-5973-45bf-b141-bc6f0729a79e", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208900, "uuid": "000f51ef-d121-422c-a848-9007359747e7", "value": "3072:y74O+rGbn56Yidz/7L2jy+7JyGLSWnpComiArmnVq:MDLwYidyb1ppCJnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676208900, "uuid": "e647c322-c5bd-465a-a146-f799abd15589", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676208900, "uuid": "cd3e58c9-b974-41d8-b461-28378d52d2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208900, "uuid": "6e8771d8-6247-40ad-a256-e1a5ef3ee04b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402205b2-aaf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676219724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219724, "uuid": "bd6d6391-c75b-46b5-bd59-46b9430322bd", "comment": "Malware payload", "value": "a383ddd363a2b0d165778d320727b20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219724, "uuid": "1d51f28e-7b2d-46dc-9103-8e9d74162eba", "comment": "Malware payload", "value": "bbe93bc1544d09871d21eceaea21afa77e131d752720c6ea8933c8a6ea03afdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219724, "uuid": "c7a2682b-d14a-4df8-9afd-a029bb17ba76", "comment": "Malware payload", "value": "317cca54af8db90e5646056e4038937031489ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219724, "uuid": "e9cb40d7-2d3d-49de-9298-e6c49b556274", "comment": "Malware payload", "value": "5e64d10689eaae7ccfd976a8480cf7522d39b8be97952b4459bfe0305a29d0f9927b6e1da84574beda4c511d003bad23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219724, "uuid": "a53833f6-4580-4f40-b482-2480b92b6109", "value": "T15EF4120BF6ECC132E9B597705DF203D31A317D614A348647268FAE6A1C326B1A239777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219724, "uuid": "d9d7554c-5d83-406f-b7c0-c8dc6db6e71d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219724, "uuid": "3a37f53f-8dce-40bc-aef0-033b65aa62d4", "value": "12288:/MrUy90v4ZMpS+awSQlDdb0r2mGkvJ0D8qeJAaPY4N99OGRSAoWlcTk:3yXoNxBb0ZpJjbhcO284k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676219724, "uuid": "fd744505-2f5d-4895-81a2-56bb6506f273", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676219724, "uuid": "ac874b78-4b13-4149-8742-0e755c37b8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219724, "uuid": "0a369542-bca2-4507-8291-74ba8b34830c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa531ff-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676231983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231983, "uuid": "101f5c14-b16c-4e0c-bc13-9593ca45a20f", "comment": "Malware payload", "value": "bf27561ee98d3cbfef77a043f649eb7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231983, "uuid": "7027287f-59c8-4285-be4b-caf05b1f2f1f", "comment": "Malware payload", "value": "bbfde478772ea395c84210544e2d472e924cc74970778a3fee527f5da3908074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231983, "uuid": "73fa851c-0054-42f9-9718-c02e39e5f3c5", "comment": "Malware payload", "value": "40f2c74002860cc5313e245dc80fa7c0ba136166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231983, "uuid": "8e4b4785-0021-4bbe-854d-31a316a56d0f", "comment": "Malware payload", "value": "b57e89cf1dc0b0531a01973b53ef040cdc09daf0f660a6fcdf8bd9156fe5b25028b00b4b6aacddb1e5b74f0e868c5b7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231983, "uuid": "c4256d34-aa02-4dbf-ba05-862f6b1747e3", "value": "T1B114E02276A180B3D35785B45431DEA4653FB4B06B62C4DB2340DB6F1EB13C2DE7A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231983, "uuid": "75512cc1-04e7-4267-a8e3-0a17295a5272", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231983, "uuid": "d10e48a0-5460-485f-9ccb-13900619a39f", "value": "3072:s7Fia+HuC1567VPbOnKvpLbNcUqiQPwkeVwjgTC2PvwP:27C0hPEQXmYkjjBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231983, "uuid": "f8e75ba5-f504-42db-afd2-f1fad576267b", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231983, "uuid": "30570f57-28f2-483b-bc0e-f7b7fc1d8305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231983, "uuid": "6b917f23-c1df-4d07-8f67-b31bf9bc93ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995e7e7b-ab18-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676235765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235765, "uuid": "80609abb-878c-4500-8250-02d8d5776a46", "comment": "Malware payload", "value": "4571ad86194c79776b4d9ec9beee3b6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235765, "uuid": "f46bf662-6454-4ec5-bb8f-9f7e3f399463", "comment": "Malware payload", "value": "bc7d784be1b39ceffbd87d02cdf56e3f4cb440582721fcff872dd8152d8382d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235765, "uuid": "8cc8c2b7-60be-4127-ab24-f342141951c6", "comment": "Malware payload", "value": "3eceff153cb8868b9c8aae8863602dba0a2afbd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676235765, "uuid": "914c1482-58d1-4fed-bc1d-062fe8c279b8", "comment": "Malware payload", "value": "5ad49c8e1d2b44772a5518cd3cdda9fe6077b7af65803cd852bbb7813c9156b85ed068e433bb1b5f0df41a9b92226230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235765, "uuid": "0f11274b-bfea-4bfb-9f9e-fefb1a48f73d", "value": "T1A404D0317691D073C07381BA1B21DBA0AA6FBCB59B61C0C737441B6E5E313D29E7A786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235765, "uuid": "921c375a-57b3-4178-a78c-0c84a7be038f", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235765, "uuid": "759321e9-62cf-4671-8fef-abd80b078c8a", "value": "3072:W7lkS+Hiks8x56DrTkR2pvzmYqmRUHfVm0Ag82wM:YxCgDrTvu9m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676235765, "uuid": "6565cd50-4f5b-4269-9a30-14122278b23b", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676235765, "uuid": "cd0e383a-2df3-4408-875b-6c816a46fa46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676235765, "uuid": "abaabcaf-73b1-4bcc-a89c-30a922bdc8e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f304506-aac4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676199590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199590, "uuid": "5d9789a4-c7b7-4333-abe9-b693c37839d1", "comment": "Malware payload (RedLineStealer)", "value": "0f7a276a6a7d8eada005ea262c9a19de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199590, "uuid": "2660f83c-4764-484c-ba6d-4461215f56b5", "comment": "Malware payload (RedLineStealer)", "value": "be4bdb935d4a4de3ea6109ab8dd72c548c4685c321e2da5f5b2d2d52dea47967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199590, "uuid": "d6164ebc-2e10-41d6-9308-819451e1bab7", "comment": "Malware payload (RedLineStealer)", "value": "2548145ab274357c3444c6d8a2bc2d44cfff2aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676199590, "uuid": "9f8328cc-15b4-484e-9712-5c98f4ceadd2", "comment": "Malware payload (RedLineStealer)", "value": "4d62c65b9d8c437ad049a68ad30eb6a490a1d17cd25a40df2fc352f2ebecb34e89c2fd513d8c6860dce04f0f1d4fea69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199590, "uuid": "77d7c12e-6134-4111-87be-78fa4535faf6", "value": "T15DF4124BEAE89032E4F153B01DF343D31932BD914B35C36B638FA94A58326A1693577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199590, "uuid": "8cd4dfdc-2243-4972-b446-dcb910a679e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199590, "uuid": "905ba97e-2b03-4ec0-b06c-3232d204d2b6", "value": "12288:rMrNy90sJuXVMgxC3Mc31FB7Off/beJOAa1sPcpiYFhplGDAIazhelbl8hVGP:CyHYV70Mc3jBQcCCYvplGUDclRDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676199590, "uuid": "a4773275-af0a-4b0f-a5b3-0ebecad57e41", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676199590, "uuid": "c68f8a2c-d308-4f37-807d-adf5ca0f86eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676199590, "uuid": "e37513d6-1d37-4801-be54-d11e46526da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9fadb4-aaba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676195398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195398, "uuid": "22bc56d9-7c20-42f3-8934-10b312c03db4", "comment": "Malware payload (RedLineStealer)", "value": "3ffadf12e43c3e018bd4e0a3aa072152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195398, "uuid": "f06c1dd5-f8c8-412e-8bf9-596b777c7b8b", "comment": "Malware payload (RedLineStealer)", "value": "bf1f5da3981568cde1f69e22b256eb3f5097c0cad17500a33338c974f1f73765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195398, "uuid": "5a60bcf2-229a-4f51-a731-824645f69e23", "comment": "Malware payload (RedLineStealer)", "value": "49d6a02f292ef91ec5739fd8cf066d0c4d95140e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676195398, "uuid": "7db7b024-e499-44f5-8689-3cb1fa4d8e70", "comment": "Malware payload (RedLineStealer)", "value": "70d69d5995e262f61783cbeff0aae087b4b038a93188756bcfe290e4220c92d0906d05b6eb64e368159d1523ce82d617", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195398, "uuid": "e2f14d7b-e801-42c3-ac48-64c42e074167", "value": "T14DF4120BEBE85022E9F567304DF313C31A3ABD605339C36A626D794918726E4B279377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195398, "uuid": "c290f750-aced-4502-9c53-6511f88b0e30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195398, "uuid": "8b1f9218-9cc5-4c10-be3f-956575137b19", "value": "12288:5MrQy90vQpsGz66a1qwqcARDLDZqPXmSKZt14eJ5kb+R3FftJ4GZo/SuDrlk:Fyussw6fqwqcA9LFqPXK51D4GZo/SsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676195398, "uuid": "1ab34699-f7b0-4989-a5ec-4e8d2af8cec7", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676195398, "uuid": "e7a54b80-0739-4330-9304-8b1a6d815750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676195398, "uuid": "cf18c2a4-93c6-4370-a984-1c66f5823bda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e782d40-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244310, "uuid": "2e7a63d3-8635-4eb0-8f11-17a599bb8a4c", "comment": "Malware payload (Mirai)", "value": "701b0d3bf05c234cb033d569993ab59f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244310, "uuid": "f9cb90ef-d20d-4e25-bfb9-851253e7fe23", "comment": "Malware payload (Mirai)", "value": "bf4d65718edd3a233d55bb7b4ef385f41b3647bee5d97968dc1541e0dd8eee3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244310, "uuid": "b4fa7c91-4a72-4656-879c-8b0171a3300f", "comment": "Malware payload (Mirai)", "value": "5fe04a658a83503f512ed37d37c75d591bceba6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244310, "uuid": "7336bda4-72fc-480b-845e-d338c7519abc", "comment": "Malware payload (Mirai)", "value": "a05c450d331320bef5280ac0640c7a6e76eda2254046b341175b39c322c6726ced9e13a87270458c955510e37dce7d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244310, "uuid": "c3f2f765-c027-4b76-b594-4bc6731fa11b", "value": "T1D053B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244310, "uuid": "9b777332-29d3-4703-b3d8-25e906c77df8", "value": "768:iAVWeSUxEYGMm8sew5BheiTebiQ2ZFVyXiSA7mWzkCwE:iAVWxsztwxjTIitZFVbmaoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244310, "uuid": "4349aff5-49d3-4d0a-9da6-da319e5d3e76", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244310, "uuid": "0ff71876-0a18-4e4b-b3ef-84c0ec3988a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244310, "uuid": "421b07f9-ec79-4fcc-b817-ec82bf0b1fca", "value": "701b0d3bf05c234cb033d569993ab59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552b87c4-aacb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676202580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202580, "uuid": "1357e039-9243-4f77-9fd1-aa721354caac", "comment": "Malware payload (RedLineStealer)", "value": "42c3168199ab2d26338f1516f9a8279c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202580, "uuid": "0cddbcc1-2157-4bee-9aa6-cd117c80dab3", "comment": "Malware payload (RedLineStealer)", "value": "bfa5218b8a028297af0113cd2620d0c7b94689631b057b89259e02fef60dd168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202580, "uuid": "268406ea-e77c-49b5-b30c-47643a208a5f", "comment": "Malware payload (RedLineStealer)", "value": "f0abf014bd39e2b983f0d73926a305193896a0c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676202580, "uuid": "bd235004-9552-44f2-aa1f-c4239bd18f6f", "comment": "Malware payload (RedLineStealer)", "value": "2492c8d1e43c31d56eb6db0fbd769d3589624496984e01f7f9fe6c6977e40ae212248013db1cb46d0f2d6ec3a4fb11e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202580, "uuid": "dd4c6a1e-4663-46ee-9c21-831c71b9417a", "value": "T15BF4121BB7ED8022D8F4177019F603C31A327D625A35839F374A6E191C72AA4E63977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202580, "uuid": "ac81700d-525b-4bea-9ef0-4ab99eb463bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202580, "uuid": "f0201c76-6d27-487c-8b26-bd13ab2416db", "value": "12288:/Mrjy902hTNBGrxVdpgJ5sF97eSLOOeJBfa8LSXdiam4ZADIBZipSB6+V:UyZheS5sjvLmRa8Lodiz4O4Zg4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676202580, "uuid": "3563a389-585b-44a4-b0c1-02162e4023dc", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676202580, "uuid": "b9904924-f4f9-452f-902e-5fcf2682308d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676202580, "uuid": "f6f6ab9b-3fe0-4892-8eea-7d77ca1be8e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5823ef1a-aa97-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676180251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180251, "uuid": "f712ffb7-d203-4b6c-9ef5-e4a12d30e131", "comment": "Malware payload (RedLineStealer)", "value": "5ad24fa04ff1c5438878dc833613d439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180251, "uuid": "cbd3254b-d9e7-47a4-bd9c-5f0f472e73d3", "comment": "Malware payload (RedLineStealer)", "value": "c1051e5a18f0c7456ce1928e0c122e53f955f40c5a017139661c6a00ac12fdfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180251, "uuid": "dc8dace6-c960-40bb-92ec-a3b681d61d4f", "comment": "Malware payload (RedLineStealer)", "value": "678fa63ebe59ac034becb1d036f47fa81b5a9509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676180251, "uuid": "53d47f14-6b18-4a25-8eda-dd0679de0cf2", "comment": "Malware payload (RedLineStealer)", "value": "fb97a712152858468af680c297e35fdc3eb87accbc06dd82cc75e2b07e08699956bd6be401314fffa795ca0c2d948cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180251, "uuid": "979b9470-d0ee-4173-ae3f-08ae52bfc475", "value": "T178F41207E7E88422E9F527B01DF643C31A357DA05B3482AF678B6D990CB2BE0A574717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180251, "uuid": "caac3753-0729-47dd-99e7-50a4cb60b830", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180251, "uuid": "6e102e65-31fa-4a8b-a6c3-bcb2bdb56f08", "value": "12288:rMr4y90yLgxDaBqA3sF+g+ils7WNfr/m7FT7feJjofhV5mz27helHham:jyL8w4FFaqf7m7SMhWa7hMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676180251, "uuid": "c056a19a-7427-4445-a663-c960bcbc404c", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676180251, "uuid": "0c67906b-4b1f-4ad3-b023-fb28b9ee3380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676180251, "uuid": "25bbac46-fa1a-4232-82c7-e39eb9fa8b50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a392a8f-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1676212118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212118, "uuid": "0e982aeb-513d-497e-b6d4-cafe673cfcec", "comment": "Malware payload (Matiex)", "value": "be5b21387901bb069615fd1b4ed206c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212118, "uuid": "d141d906-899f-4b5c-845c-36cb95bf6a20", "comment": "Malware payload (Matiex)", "value": "c1f48df6bc08fbcc1d87a604d3b71d8db009e1d86d845a86363942b48f51880a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212118, "uuid": "a2d0480b-4757-43a3-a4d2-d5d7f6f050fc", "comment": "Malware payload (Matiex)", "value": "1b165159320a2383b3660897f8d22f69d38ff445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212118, "uuid": "e8b551c7-9958-4195-9863-33520d8bfb59", "comment": "Malware payload (Matiex)", "value": "eb8966c00a2182d85b9cbd3a92def1374ccb8506cd1a97719e9dfe2418439ef52866c49e038c2746bd746a10cdbcd857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212118, "uuid": "1457733f-2c0b-4cfc-8af6-b0813e2390c0", "value": "T1E2D40191A32480ECC46BD1B4CA046627DAB3746817783EEF4BA5CE614F23BD5F43EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212118, "uuid": "7e98b748-97cd-45d4-9c37-6d2e8ed9d1d7", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212118, "uuid": "7c3586c4-9f06-4e4f-8cbd-5909bd1ae3e6", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212118, "uuid": "5f677200-716b-47a1-967f-f23692d67d7a", "value": 655500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212118, "uuid": "fa13b7c3-212c-4834-ba6a-9e5fec576bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212118, "uuid": "9db7bf42-d1ea-4c2e-a3b6-39b021a233b9", "value": "be5b21387901bb069615fd1b4ed206c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0698268-aaa4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676186090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186090, "uuid": "ec4b1a98-a199-47f7-a7be-2bcf431cf3fc", "comment": "Malware payload (Amadey)", "value": "32526dabb664b340d96edff7782cd185", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186090, "uuid": "79b70cec-1431-4b4b-88fa-09a01a159ad7", "comment": "Malware payload (Amadey)", "value": "c2737b026ba2941fd9f5d3e0785a92f56f2c8bfcc87340f5ee6f05835ecc042e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186090, "uuid": "cd273533-06a3-428c-b51e-01007f3f0855", "comment": "Malware payload (Amadey)", "value": "e565202652c92989eba7607a14363ccde4a0cbca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186090, "uuid": "5f805b5f-e2da-482f-af7b-c99db56203da", "comment": "Malware payload (Amadey)", "value": "a04e6929c2642cd40d90cfdda2c0903af508c8152fdae2fcdb9f02f602263e3f7b52430d9c345d1f5b9e183548d95292", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186090, "uuid": "7f673922-dbaa-479a-887b-eeecac1c7d80", "value": "T1F3F41247E7E98022F8B197701DF303D32A36BDA11A34575F264EAD591CB36A0A336367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186090, "uuid": "fb0723c6-bb8e-4211-b3f2-2180e88f0b40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186090, "uuid": "c7bb1a04-2975-437f-a6e4-d6b6cf12b45d", "value": "12288:tMrxy907aUhGwghlX32MN+wq1Af5FyS97eJYqQ82gkndXZxpim73wP5sD3DArV:QyUaXh93Pa6f5f2G8BUpPpim73te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186090, "uuid": "37acbe44-82d9-40a2-ae01-108407d913d7", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186090, "uuid": "40ab4806-2075-488e-809b-b03836ee6505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186090, "uuid": "77877b62-8495-4ab4-9e26-4cf76dca4c6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabb721b-aab7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676194214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194214, "uuid": "11aa5f6e-f73e-4061-8995-bf6d3e4e67e4", "comment": "Malware payload (RedLineStealer)", "value": "30c8abbc7beceae58e51c5e8bdde1e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194214, "uuid": "ea29e003-14cb-4594-bd3e-1a85b284b322", "comment": "Malware payload (RedLineStealer)", "value": "c2b525e18a10330b3782a88fd5ec8519e4e25153e7b0acc868a56edcccde4661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194214, "uuid": "e84cde51-5f69-47a4-a8e4-b42f8b840a68", "comment": "Malware payload (RedLineStealer)", "value": "5917f8083aa7b6ead9b98073a78f5fc6f1317f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194214, "uuid": "d1dcd208-fd35-4d03-adee-9e4dc91e682b", "comment": "Malware payload (RedLineStealer)", "value": "085eef9b7e2b5566b367254237739adebc9e8dc056f656b48764267dadb1bf169e511c248d78127275d26bf2ba62b5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194214, "uuid": "138c3073-fee6-4ef8-86a7-54dbe3d9c875", "value": "T11754F1217AAC8073E19B46716471FBA1AB6FBC736766C5CB3309162F2E303D14AB6315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194214, "uuid": "437e10a8-644e-49e8-ab24-301a16db352c", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194214, "uuid": "a7d180f3-fa1e-4677-b23c-1f0c53bd6e72", "value": "3072:Hbp4+F4SRsJqnR2iMA97HIcAwiG7kWUsrfqvNtD9I700WXP3SEs/2g0ZaGsdoNQi:7a/uOMbSnWUmqvnJI+P3ShV3doNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194214, "uuid": "386c7207-8a5a-4374-9c2e-bac91a9d28b1", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194214, "uuid": "9548fd38-27ba-4e34-b782-c37959b3f3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194214, "uuid": "b548af68-2a80-4309-90a9-dd29ba26663b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e0dd5f-aa92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676178041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178041, "uuid": "4f0a63d6-96a1-40ca-9e6a-5173800b2b90", "comment": "Malware payload (Smoke Loader)", "value": "8021460702777318a468e62cb10be252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178041, "uuid": "6d6f61e1-684c-4ec5-ba38-d31994606886", "comment": "Malware payload (Smoke Loader)", "value": "c32e08dd9502c6f42d7c553f1115984d1958c859f428381cff4cc17fbf5b2498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178041, "uuid": "e022326b-6bc5-4357-8b35-7f4a345e0250", "comment": "Malware payload (Smoke Loader)", "value": "fc90f57d99a60a507d1ac9b40a851c7c9c744f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676178041, "uuid": "80b9fd44-5dbe-4011-8e0e-66b7f84682a3", "comment": "Malware payload (Smoke Loader)", "value": "b4425aed60dc33cc526bee1263c99cdd4ceb4b1d2b061dbcca831e59fa1e262c5b5a4c324e0b91a1273ae268359bb097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178041, "uuid": "b0f3425c-5da2-4de4-8722-7fb04014a72c", "value": "T18F14CF2176A2BC72F56776B42831DA932A2FFC729765C1CB2749069E1D303C28F76352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178041, "uuid": "bab9a0eb-3ae9-448c-9340-73bca41f2570", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178041, "uuid": "8482fa7f-e836-47f6-8f6e-5e7097e26042", "value": "3072:hjqwA+0Jy7G5C+Ve7T6T1DBBvKqlRLS/urH4+tAVOxtG:hGDRq+wHW19BvDLS/uL4+yox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676178041, "uuid": "5c3b771e-cfd6-40c3-90b4-0e5da3a4bf25", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676178041, "uuid": "06d975e7-462b-4b6c-ab6e-82f5d58d7833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676178041, "uuid": "319f72e5-474d-40f6-a2a6-5ac7339a4f84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8149f26e-aa78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676167006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167006, "uuid": "688240ec-873d-480e-b88d-00284dfe67c8", "comment": "Malware payload (Smoke Loader)", "value": "540d8f4b3dd490ab9910ac8591ece446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167006, "uuid": "aa3c4a6f-1cfb-454b-a2b1-b4c74e5d2191", "comment": "Malware payload (Smoke Loader)", "value": "c3c0a3be35f6d6b9a28b8577bd2d78628c0a297ac3038aa32eeeddcd491ff221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167006, "uuid": "4d61e342-fcf0-4773-97c6-e8bc9b1b7779", "comment": "Malware payload (Smoke Loader)", "value": "fb282e9e35daf43f33609d4cd4c3949f20e9b2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167006, "uuid": "b8448323-f2f8-42b0-b5c1-98791df820f2", "comment": "Malware payload (Smoke Loader)", "value": "a28f81b455fa535a0e5498b9b8541d65df5256e18846685ed40c01b1f3e638cae0cc9ad209c54d5f16947640c63ce8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167006, "uuid": "d4de5f0b-4745-4ea2-b3f5-ca932269f1a8", "value": "T1D914D021F9A18072D56345F52831DA952A7EB862D7A2C1CF33081E6F5D333D24E7A3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167006, "uuid": "708d86c9-ca7c-4cc5-8202-fb920406f836", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167006, "uuid": "a817a49d-21d9-4902-81df-734daf2dba65", "value": "3072:kjqeu+0Jjd25CfETR0aKjC5Ht8OmA93cetmPvcYtG:kGXRbfXa1HWA93yPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167006, "uuid": "1a4ff576-2c71-4774-a745-1d146ee31988", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167006, "uuid": "143f8bea-61c6-4e13-a268-27e739641760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167006, "uuid": "924d875e-2f45-4ce9-a11f-e358cb2f569b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677cb956-aa7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676169969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169969, "uuid": "0b9b775d-529b-4671-b6f8-daad4ab6ad0a", "comment": "Malware payload (Amadey)", "value": "6f537e7a2ec25503572cc9366781ef47", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169969, "uuid": "2a9ec894-6b32-4216-9f4e-139511f39305", "comment": "Malware payload (Amadey)", "value": "c4c002604f15c42292e6c83cceef3493c20b92cb8465a4b196554237d09e266d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169969, "uuid": "4c61de91-02b9-446e-bcc7-53f337cce4bb", "comment": "Malware payload (Amadey)", "value": "b4ec40c83bbb72c0b26e3f8b2a816adfb1b048d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169969, "uuid": "5acb8b90-e83a-45c5-82a5-c287fddceb7c", "comment": "Malware payload (Amadey)", "value": "a04883f10e42b15633bfdac4c9a73f710d3c05d4ff4dc94f5d9b82d1df5369127bfc6ddec419df199e5508c9ea9ee036", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169969, "uuid": "91d03615-91f6-4af1-8e4d-5803b45b2877", "value": "T1F0F41207B7ECA027D8B067705CF603E31639BD612B38429B5B4F5D590872AB0A63DB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169969, "uuid": "f91b3c5d-d92f-419f-ae8e-c6823e47d7bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169969, "uuid": "1d56b0ef-2e0a-4cfd-83f6-33bc4e222292", "value": "12288:JMrVy90V/3h/lPMskMOpYRllOFCeJ0JYXKTONW/pK3s/Ue:gySpNPMKOpilOBXVWMFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169969, "uuid": "cf5b3357-76aa-460c-a967-317a66cb3074", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169969, "uuid": "d6a84720-9183-4d01-87eb-ee4f735586e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169969, "uuid": "f6d4b497-91e7-4a70-8bbb-df2ef146870e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15c56f4-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676229336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229336, "uuid": "8fec664b-d1ad-4dfe-9a76-5d744dfc4701", "comment": "Malware payload (GCleaner)", "value": "29087aab4dff422795f81cd9122bc4d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229336, "uuid": "05f0fb6a-6413-457d-bd27-7783ef9ee924", "comment": "Malware payload (GCleaner)", "value": "c512928ddb1233b5da918e61aa7faf46058a3c3e1e321eea1d03f7047935d828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229336, "uuid": "1f0324cb-e540-49b0-b07c-939d147d394e", "comment": "Malware payload (GCleaner)", "value": "233eb6193d8db6a6c58d3ebd90e1e478fe91c92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229336, "uuid": "40f8bff7-f28e-4b54-ba5d-750b870221e9", "comment": "Malware payload (GCleaner)", "value": "ac4e799ab6f0950ed065f959d9ef2fd4fb5c7937ca82405ef0383997e2cdaf548b6c938f65fa59f8501cf97fd9df81a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229336, "uuid": "0c9370e2-e010-4ff0-b016-fae5d28a8716", "value": "T18544F12779908532F9AA61B56533EF4526BFB8611724C1C777B8265E1E327C10E313CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229336, "uuid": "b98aff62-0f42-46df-adce-3330311ff52b", "value": "df780c2deeaea66277dc7a0d5a0f821c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229336, "uuid": "ef6bdac2-f48b-4c93-9c7a-5e8fa5853f1a", "value": "6144:4zlQJZr+KMrCYWHZqKYMZ4svGjR0So4EO+s:4zDBrfOZoMZLC0St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229336, "uuid": "7641c4a0-abf6-47b3-a323-46e7dafa54d5", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229336, "uuid": "31cd829c-b6c0-4614-b02f-9ea495b20a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229336, "uuid": "f21b534e-dbfa-4952-b532-805f8a5b7cad", "value": "29087aab4dff422795f81cd9122bc4d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b34589d-aa7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676169626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169626, "uuid": "1d38685f-fba0-4172-811f-d633349f0304", "comment": "Malware payload (Amadey)", "value": "63e1ad8f3720d7299a3c9d9f2b2723cd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169626, "uuid": "959cbcf4-ae78-41d3-815c-7bf50d2aca81", "comment": "Malware payload (Amadey)", "value": "c5984979a9076217c441e465942f0821dcb96fac6acfaed14e38e89da34fba7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169626, "uuid": "8f0ee4cf-755e-4b3b-b5f6-78638a121c16", "comment": "Malware payload (Amadey)", "value": "c9147df5e1268b00dde4166058623de7a18cf3f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169626, "uuid": "b4aa3cb3-faba-4696-8ffd-ad0817bace05", "comment": "Malware payload (Amadey)", "value": "a76ddb5ac333f95b3dce9ebc511a53ac74ff3cc19854379d95818c6e3bd46d431d0baeb1a7ea44a6abb8d829422ca0d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169626, "uuid": "1f78c4a4-5e30-4a96-bcc7-3d84a8826cf9", "value": "T175F4120BAAED6022E8B117B05DF603C307357DB16B7883AF574E6D890C712B4917A79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169626, "uuid": "f73361a8-e0c1-4974-a088-85b67d2d69f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169626, "uuid": "ca3a43f7-8d49-493a-98ba-1690ba1843dc", "value": "12288:BMrTy90df/Jepm3mhydJ4bWUi0t3/KTneJkNbFPd0qmxiNiFxwW:uycf4ymEGb3iILQPdWxUizn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169626, "uuid": "d83d964b-caab-48ba-b040-6c1a937965f9", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169626, "uuid": "62404b7a-4c2a-4d2b-b9f3-bbc5e808559d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169626, "uuid": "3a3f48ba-9bef-4ae6-9ba1-0b9bac220143", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e9cf6a-aaf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676221959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221959, "uuid": "c1bed8a9-5bcc-41c5-a307-384b0bf83f02", "comment": "Malware payload (Smoke Loader)", "value": "5a140d2ed4b1e941e728ce70cae5caa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221959, "uuid": "ab56098b-9646-4aa7-983d-1205ef3d5aed", "comment": "Malware payload (Smoke Loader)", "value": "c5a34f1199c301a8dc06082dc88f68fe474d4d7be6fec55aee4c313499cd86f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221959, "uuid": "240015f5-cc75-42f0-83ad-4b1b575a1313", "comment": "Malware payload (Smoke Loader)", "value": "81e5f0bc4ab325dcdf1f5fd69b5b3d0c70dc2267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221959, "uuid": "4cdffb6a-a12e-44ad-9001-6822e7462c03", "comment": "Malware payload (Smoke Loader)", "value": "00fcfe0c2b0426a4f83ba7b919e2ceb16928c06bd62e4c28b030ff2b2b4611a610c3a0521f1932b92b05375daba5d0bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221959, "uuid": "43f54df7-ca75-496f-a80d-2c5f4a72466b", "value": "T1E114D02175A38073D85B49B05531DAA07A7BB8719B75C2CB33681E3F1E203E19E7B399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221959, "uuid": "d35b4187-913a-4733-bd41-a9a2b088fef2", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221959, "uuid": "e2c4858e-5df5-4dd8-8ac1-2bc7b0b0400e", "value": "3072:S7rv+rGc5idt2pAQJYGvy4lwQ51wS6GobDTRzA4m:sjLbdpQqApN51VNoHhA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221959, "uuid": "20ba85da-5497-4b9e-8a23-36e128b1e55b", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221959, "uuid": "19def682-4e1c-41dd-a3e3-40f33a4783cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221959, "uuid": "dbaeebb6-1309-492b-8621-b75bb8693c8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974a21c1-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229749, "uuid": "b1e7b79c-f0a1-4d26-975d-b5df0fe553e4", "comment": "Malware payload", "value": "3a6d9a36077db41a185f1b19693fc829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229749, "uuid": "749eea38-02a5-4dff-8294-15ca830d8695", "comment": "Malware payload", "value": "c608373e76a5e94b20f41dcce28c0c29d34b3b5a334b2142f533e1b3d3b555e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229749, "uuid": "84e99d55-f9a2-43ef-8114-91a9c118c287", "comment": "Malware payload", "value": "79de3e4ed93b46072b47bbd9a6bea495c0316b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229749, "uuid": "9ffc3883-491e-4e1d-b162-9056a453a894", "comment": "Malware payload", "value": "36134a6f250d4f9ee0f6eb844184420592e88b264a6e02411dd51d63b9a6bc9c2b33ed6cb7bdf2cd4f028eaabf1dfdf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229749, "uuid": "06c3bbf6-5d0e-4dd6-a1dd-32daca980e23", "value": "T1CC16EF639B4B041D426593EF4825988BC0473E1F599BA7AF4DAB90A33E0778DED24C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229749, "uuid": "464e9d3d-4dbb-4ff8-b00d-49d117cbed93", "value": "98304:e3n11HrsbIiN0g3lNvuq5LaaQJ4phPuyocSf2:m00aNv+BqhPJVe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229749, "uuid": "3156d2b6-c6fe-4819-9087-932cd1fcc925", "value": 4145419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229749, "uuid": "b630c771-9583-4221-a394-7096c2cd4f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229749, "uuid": "10f062a1-d7a7-41ff-9422-c6ef5bf76531", "value": "3a6d9a36077db41a185f1b19693fc829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bf4610-ab0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676230424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230424, "uuid": "94185549-0276-416a-8d23-9466e5e313ca", "comment": "Malware payload", "value": "7768da602139e146afff1d63a47dd5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230424, "uuid": "0ca51f2e-be37-4f99-ab6c-da8d49c13d07", "comment": "Malware payload", "value": "c7726984511cea0dc4b967f16ff7fea8d55a2d6264a52e6df9dab977cf3e4d7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230424, "uuid": "1ca821c7-e038-4b31-96ce-e8a5a4153090", "comment": "Malware payload", "value": "a44de51c8de4aba3e69d4ea14051ff57658bd29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230424, "uuid": "5ac4e53e-6aaa-4846-9fb7-24ff995dd14f", "comment": "Malware payload", "value": "cb1c00c310bbe0e4be8057d4f25c9060bab13bc6024c71c11ce7021e6176df72d6caa975f766119b467a8824f955f5cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230424, "uuid": "a37812c7-aa14-414b-9840-f76daf455daf", "value": "T1B6F41247FAE99431D8F467B00EFA07C30A3A7D912B38475B738FAD1908726A4A135767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230424, "uuid": "b06d2961-3460-498a-bc48-826197b99903", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230424, "uuid": "a62fddca-34df-47f6-ab34-900b84b997ac", "value": "12288:ZMrAy90z2HZgckDVd2By1ldfXVopB4Hv+beJV5VfKyf5kocfVqvX8:Fyl5gf2G5VSB4PLLVXkoEqf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676230424, "uuid": "6a93190b-5586-4bc0-955d-9b5a6939f3d4", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676230424, "uuid": "63775da9-7b30-4eac-8be2-96f982a6ec44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230424, "uuid": "f129dc9e-c922-4663-b1a8-4127c80b5929", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e0883f-aa75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676165745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165745, "uuid": "e86fc350-4ebe-4cf6-9230-3d5ca9cb636d", "comment": "Malware payload (Smoke Loader)", "value": "c0aa6d8754ef64e7e36d9080e7f2626d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165745, "uuid": "c3b66a14-1fc2-4495-abb7-78c62be045b6", "comment": "Malware payload (Smoke Loader)", "value": "c786dca5da886854c4fe132c8fb3651693fbed70c273b7ed8b423c274eee370e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165745, "uuid": "b0a31f1c-c545-435a-b038-224ed5108764", "comment": "Malware payload (Smoke Loader)", "value": "1fadf9a40604bb6638d3c0821d016ba77e495c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676165745, "uuid": "74ff3fbd-6c22-435f-8126-d1df595a380a", "comment": "Malware payload (Smoke Loader)", "value": "700d75095cf60003197f3150c2618e53e3e6c574dc51e8c41dc21bab7b4bc5e1cd0cce0ed0c5515804b2a332c1c4af33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165745, "uuid": "c385d26c-9960-4795-9156-1acc3b965f77", "value": "T1C914DF013AA2C077D59786B01931DA946E2FB8B2576581EB334B379FDE303D24E76392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165745, "uuid": "435b1533-0423-4339-9efc-1172cc5a13f7", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165745, "uuid": "ad508ffd-3669-4eb3-92e0-f3c64e3eb252", "value": "3072:wjqcR+0Jecx5CvVU8tLKzl12nHTaxc/UylhKZztG:wGmRevVUYqLyOxs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676165745, "uuid": "53254043-adb4-409c-a297-b67daa71728d", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676165745, "uuid": "8aea556e-65a9-46c9-b1c4-d5bc2943b9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676165745, "uuid": "d14acbe4-0ce0-4ea9-a412-7dafa7e84c6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea5fcb9-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1676179510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179510, "uuid": "8b2c4d4b-1fc7-4c4b-9b1c-80ae5f99a4b7", "comment": "Malware payload (Chaos)", "value": "6f604aeb2e1692200e0079e2c66e3142", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179510, "uuid": "f23ece53-dd05-4f1c-8070-6c5e97eb871b", "comment": "Malware payload (Chaos)", "value": "c797991107d261423bebab5f3cd3b44b5a63e3925baaf53ed8b0ba77f5c7fb7b", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179510, "uuid": "7b657501-49e7-484b-ac4e-80b510dc7e01", "comment": "Malware payload (Chaos)", "value": "abb3c0372f463b2e6e33a2465ca52c93e43f69a7", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179510, "uuid": "45d86d84-d7e5-4a1e-bfc7-9c66ac2821fa", "comment": "Malware payload (Chaos)", "value": "9d7d7bac0adfb67b0b4788f812de44a1ce39b6f9636189111ffc525de682e7efc2f3239573ba49d5f3f1af83b920747f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179510, "uuid": "ae01bcbf-ed03-467b-9749-01cf071bb09b", "value": "T1A5A2F808A7FA5A38F6FE1FBC6DB2504157B5B903DD1ED7491CCE015D0823BCC8A91AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179510, "uuid": "7f453f1b-d3dc-4b8b-9a92-a75f42c93129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179510, "uuid": "b22b4321-3927-41c8-8538-6af925322d77", "value": "384:F3Mg/bqo25+Iped0T9AJvr91CtpEMG43FeZ:/qo2EIplT9ovr92pvGCeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179510, "uuid": "7385f2c5-4399-40c6-982b-a958c978a916", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179510, "uuid": "7849dd14-4025-46b7-b084-ac938f7818e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179510, "uuid": "5947a9e9-0ce0-4a93-ba38-5de0c43aab16", "value": "2023-02-11_6f604aeb2e1692200e0079e2c66e3142_destroyer_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04da375c-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231651, "uuid": "044dec8d-3c98-42db-93d6-c94defd7029a", "comment": "Malware payload (Mirai)", "value": "954b74dc17cf66fa806550ea0bbe76cb", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231651, "uuid": "80fe814e-168f-4620-b68b-88bc79625979", "comment": "Malware payload (Mirai)", "value": "c79e9402894c8995dabb4278ed99adc941fca2cd72820c10a111d3ad6a049210", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231651, "uuid": "4a263491-3860-42b3-a8c7-870896fff748", "comment": "Malware payload (Mirai)", "value": "bf8ece14706b3374375e1dfd2dd4ee0e9ae95599", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231651, "uuid": "b200970c-df19-49db-b074-058e3a9c68a1", "comment": "Malware payload (Mirai)", "value": "34d6e5754a6145de24acacb4accec2d263ff102dcacddea62ea90737e2b7c13b400f460e4daf0b7f58fec9e8e25b8ba5", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231651, "uuid": "3b876e8c-f85f-428a-a4e2-ac09ada6964a", "value": "T15CE3AEABBB8F0250C05702F40BCF5BAE6E6325509DAFC5E3AE79723B543A1C72516760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231651, "uuid": "82dc29db-5b21-490c-a91a-8c3b22d13434", "value": "3072:v5KmbuoiUFBKk9bnCkwgPdu987/K8vPuPLPZ4g6Udq:v5mozsBOTFgWUdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231651, "uuid": "ad5c4b7e-92d7-4359-b71e-21a359c0f758", "value": 148972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231651, "uuid": "ac367f57-86d3-4c58-8e28-d7c3d6086e5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231651, "uuid": "d4a3f523-e90d-4bc3-a1d0-0f4df909ffb2", "value": "log21.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b036840a-aab2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676191995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191995, "uuid": "e153dccc-ed30-4d5b-bac2-87a7d646d4e9", "comment": "Malware payload (RedLineStealer)", "value": "36a55c57c577297dfd7dfb3e3e936ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191995, "uuid": "a50db88f-9e6e-4400-bbea-ff87e65c6d5f", "comment": "Malware payload (RedLineStealer)", "value": "c7a17511c5e568d51c443c45611cc33cc31abde2c06cd6e95a27cb71df05b6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191995, "uuid": "8ddd8141-4e16-41d7-a400-490dc355373f", "comment": "Malware payload (RedLineStealer)", "value": "5f3413c0ed1a7d76ad65e23593b05511686ae36b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191995, "uuid": "f7b15346-51e2-4d08-92ef-297495e3c445", "comment": "Malware payload (RedLineStealer)", "value": "7ef99de03a701cf647c4d58ca3ab0a7ceea360708c01f80eb877976154016dbc25b9a2affc1f830e789c5e3fefeb6d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191995, "uuid": "2aae4d68-5640-4e74-98a1-ea64785eb7ed", "value": "T117F41207BBDC8022E9B553B058F607D30A3B7DB16734C2AB264F6D090C72574AA767A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191995, "uuid": "bfb69a6e-ac5f-4d0f-b3e7-c7bac3538aff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191995, "uuid": "14b520f0-2d98-48bc-b8ef-a9a50dea4a20", "value": "12288:pMrAy908VIFsHko/Ls6gLWeJP9wuq+/HyzoECNo6t4Q37i:RysFsH1s6kVwuq+/HyUPe6yQ37i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191995, "uuid": "3384144a-211d-44c9-95ea-4b8e9fb08614", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191995, "uuid": "41d7a307-4cc3-495e-baa6-0176b69e09a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191995, "uuid": "ba090d2b-9c80-43f8-b09a-6a5f530347e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e0b3e6-ab11-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676232543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232543, "uuid": "31b7d226-ee95-4e44-93fb-f877439abcbd", "comment": "Malware payload (RedLineStealer)", "value": "18504b7b92e78f73d90b9b05b957f626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232543, "uuid": "69a8d8ef-b49e-4fc6-96c3-7a5a25a82df2", "comment": "Malware payload (RedLineStealer)", "value": "c8d9f916484b34fd2139daa405fda225d73d263a948c6a7c3039c314c89e1a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232543, "uuid": "0ee96b86-57f5-407a-a55c-06a579da2d62", "comment": "Malware payload (RedLineStealer)", "value": "555b917e8e27764bfa384bec5e056e606733c7ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232543, "uuid": "9d8b66e1-5f71-48ba-b6ab-330f03e68eeb", "comment": "Malware payload (RedLineStealer)", "value": "cc1f2104ff5043a6f32191efce5fb39edee62d4d8c17f108af5f0e9b8e634b3e04006394ced76ef241738072696d0940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232543, "uuid": "b1541f00-2b49-4aa7-8e9e-c588e20bf951", "value": "T189F4125BEBE89032D9B45B700CF703C3163A7E509738829B534A5DA90CB3A70B57A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232543, "uuid": "f3534b28-765f-4e06-aebb-c52ac2afda13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232543, "uuid": "9509689c-1543-4f70-b022-c42b415eb905", "value": "12288:xMrMy90fCm1f81aJWi0fcniyl2yAkjCDOAr7FeJk1cFnDBdB6MAim6McvE0wKN:ByqC91cf0Ui1yjuSmcFnDh6MBFMRKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232543, "uuid": "49cf9f8f-577c-44d4-915b-b098c76c625c", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232543, "uuid": "3e8b66d4-ed98-4d2c-a22b-fe560323e34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232543, "uuid": "8ae7defc-9407-46d8-b796-65d2efa6ae36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5fd73e-aa96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676179802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179802, "uuid": "cad8aac3-e1bf-4f71-99c0-f064774c56c6", "comment": "Malware payload (RedLineStealer)", "value": "7962f278f1f8baeb3ca298910711cbcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179802, "uuid": "f081966a-7f70-48f6-93bb-31e7620fdb74", "comment": "Malware payload (RedLineStealer)", "value": "c91a98969848d34ab49539e23ecb5c09970f366576953be2614739d3ded6a598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179802, "uuid": "fd75e452-6871-4bc7-aa94-bf32052523c9", "comment": "Malware payload (RedLineStealer)", "value": "4024506649cd58a27bc278a534a6e29d31573ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179802, "uuid": "653f857e-5612-4704-aa69-1f73cd4b1812", "comment": "Malware payload (RedLineStealer)", "value": "c1ff1d3c4a4f46d2ac3da9b3149e7e93c4eef3cc9e3312b0b4abdf8c7218d7f640b2ba8ffca85442a108bad16033390e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179802, "uuid": "eb6b33d3-6924-46f4-a532-13eb0ba39c2a", "value": "T1D4F41207E7D8D473E8B1577019F706C32A36BF510738829E2BCE6D060C726A5A63976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179802, "uuid": "54d608fa-807b-498d-8dfe-087359d27a74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179802, "uuid": "ed292866-d475-4f33-bc7f-fc4da1170f26", "value": "12288:OMrYy908AvQYVo0SkHNDk2eDPDrqEO4eJUWOb0RNZIci7hWlSEGC:OytAvFVQ2O2UKRcb0ZIr7hi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179802, "uuid": "37ddbef7-45ff-4a80-98f4-78a630fbea8b", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179802, "uuid": "73592cf2-1b96-4cac-ac04-91b539a5c2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179802, "uuid": "02974631-9ced-4a11-96a9-d40f4b6277e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9cb3c3-aa8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676176906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176906, "uuid": "da347515-d80f-44ff-9175-f07f0b96e602", "comment": "Malware payload (Smoke Loader)", "value": "256b76d60dd1b8b6beb3ed9ac34aabbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176906, "uuid": "94824237-3971-412a-943c-01dcd38622ed", "comment": "Malware payload (Smoke Loader)", "value": "c926070e0daf649a551e540eaa57f16d4b44fc81c1800a9a22de6d415e63c10c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176906, "uuid": "6548e704-1fa7-448b-b599-da29e3bde298", "comment": "Malware payload (Smoke Loader)", "value": "e70b47cd569a1416a3cd1f9ce2eba4acea257014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176906, "uuid": "d3a82a42-5951-49c2-9105-2f7f3bb60ad8", "comment": "Malware payload (Smoke Loader)", "value": "7f560bc2351f8ad43f6271bae13e8357187c6c5bcee991a391af1870564be313ce8b42739327775a0a6222a7c1de0174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176906, "uuid": "9619307b-0253-4c40-b7de-43a6f22e6b3d", "value": "T13E14DF107BE18473D6674AB11935DAA07A7FBC715B60C1CB330906AF5E313E24EBA366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176906, "uuid": "30c8a72c-2ba8-41bc-a171-115238c2c7e5", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176906, "uuid": "a003af24-5ddc-43c2-a194-f05d9f76400b", "value": "3072:RjqK7+0JG8v5CQB3NJk5Tb6i8G4Iv+gpCFK8OitG:RGSR4UdJkELdI5pIKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176906, "uuid": "cc65f926-ad98-40a1-ad48-2dfcb34a1675", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176906, "uuid": "288ebbe0-fb9c-407d-afad-2d9e47e792b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176906, "uuid": "d65fba91-86bc-4b1d-9eda-1081b646870c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1215c83-aa81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676170951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170951, "uuid": "b1b49f8b-6aaf-4b10-94d0-d8d07f6dd12e", "comment": "Malware payload (Amadey)", "value": "17f4343cc2824c5bb9510f627431509c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170951, "uuid": "2a30ea15-4a84-4e90-9600-eb9b03faf3b4", "comment": "Malware payload (Amadey)", "value": "c9726b354bf44a08492f26f6d68bd61e49c8d87c31b7db0cf3b1f22104edccfb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170951, "uuid": "b04d92a2-42b9-4023-83a0-abf8792e36b2", "comment": "Malware payload (Amadey)", "value": "89fc7819c7d9cc092a824bc6a5524e2ec2caaa35", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170951, "uuid": "54a6b57b-b3a6-4100-9d1e-18cb2c12db6f", "comment": "Malware payload (Amadey)", "value": "fd39d19584f5c7e682c1f996f17cc46aaec046cd6f59c07fdad1f3249e839817f0282386ab1be7f1b35d1827266124cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170951, "uuid": "456b5a9f-6837-40b7-b12d-f7b9c6d28c51", "value": "T138F41207F7ED8036D9B5637059F603D71936BE611B3842EB230BAC4908726F6623676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170951, "uuid": "5a19f804-91db-48ca-b39b-63617e9ab4fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170951, "uuid": "ded80398-65f6-4ba8-8e8b-a980031dceaf", "value": "12288:dMr4y90pyWNZV88+oBVk1JAyTB4mXjeJYkPcbCYBN/7bO:Zy2rPV8B2VyK03UCCoHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676170951, "uuid": "fe128037-45e4-497b-a60e-c9506f904575", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676170951, "uuid": "1e4a8c9b-c789-4549-826c-f8d79c97730e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170951, "uuid": "8125751b-e48d-431f-ab86-d613d18793a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787ebba0-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244300, "uuid": "91affd76-a1fc-462e-83db-343fb3dccb75", "comment": "Malware payload (Mirai)", "value": "b214f9ab763e873a5464cd54a5da2062", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244300, "uuid": "10637250-1c00-4806-87f9-3d92ded12165", "comment": "Malware payload (Mirai)", "value": "cb9961eb2134c43e74c73170c0378e2fdcf229a27a7f4be9fa9322feb9576396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244300, "uuid": "29bb031b-b492-4f55-99b0-8ff4627c96e4", "comment": "Malware payload (Mirai)", "value": "5317ce92d97bf42cff5d2be7940d9087b719474f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244300, "uuid": "0d4e63e0-2cc0-48a5-99ab-4fe45b6ac707", "comment": "Malware payload (Mirai)", "value": "e15be6338d3e8562373251699663c6bd319f072027ccaac3427c51b4064519e15231412da6cd495991fa92e050f78276", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244300, "uuid": "dd833704-e30f-4e9d-a848-219858cf3e9a", "value": "T175F2D0DC9A78BE82C5CD6C7EC06A5766A99CF0D17328875C23578C54A798E07BCCCE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244300, "uuid": "fc598eaa-c9d6-468e-9fa0-6b1fc1f67116", "value": "768:dGg7rp35j4jkPqYrovgCnJJzwADrIqBzKbd5WMq:wgZxiko9nJJzrPv8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244300, "uuid": "72a98d82-0062-4804-8a82-ceff6d99989c", "value": 36292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244300, "uuid": "e9a58816-30e4-4a0a-8f3b-e041cc116895", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244300, "uuid": "53d654e2-88e0-484b-a2e2-25923db56e03", "value": "b214f9ab763e873a5464cd54a5da2062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb94ff-aaee-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676217619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217619, "uuid": "53ed0be0-215a-49d6-9896-70a78748877a", "comment": "Malware payload (GCleaner)", "value": "09be50f00fcee0b3b7c2eab38358ab81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217619, "uuid": "3e63c82e-8a1f-457b-84cc-477faef61596", "comment": "Malware payload (GCleaner)", "value": "cba0a7e08a5df35f25af335047b3c5034c127adba3c16137062ff8de1ed2ea02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217619, "uuid": "016ec750-96c9-4955-8a0f-008a534d0068", "comment": "Malware payload (GCleaner)", "value": "ae82277a93d9418903fca8968898be7654de6efc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217619, "uuid": "31267865-7c14-4408-8a48-b3ba981dbe31", "comment": "Malware payload (GCleaner)", "value": "50f288206cdca8b86d4ca8a619c8a4422de4ba411b907c5767e5209d6b6f8198cbaf2d34bc00da84682344fba6abe963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217619, "uuid": "929b3abf-6a72-4bff-a287-451977e0de0e", "value": "T117F5127C7445C9ADC680FDB4892B94E71CD62EE3E9A0A02370DE7F3F917D188961A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217619, "uuid": "ccc0294c-7dc8-4710-8cdf-b36d4b807570", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217619, "uuid": "1a6f2bf5-6824-481e-bba1-dd788f893713", "value": "98304:JH2mQ4r473BmAF/sZKkgr2Rb5I3ZogdVQv2MR:d2j4cTVOZxG2vIp7QvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217619, "uuid": "bfa32a2d-e900-4cc5-83a8-4357ba61ddf4", "value": 3423786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217619, "uuid": "fe56d110-6839-400d-8119-2104a101bbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217619, "uuid": "9b2164c2-9769-49f3-98f6-ddd44ce96cce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7cf211-aaa9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676188209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188209, "uuid": "b59b51ab-2572-4aba-99cd-75169f9c0280", "comment": "Malware payload (Amadey)", "value": "ba084f15b297c6a936992dc7d18e5509", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188209, "uuid": "0cb31e6d-70af-4988-a65d-cc61683ba99b", "comment": "Malware payload (Amadey)", "value": "cbef6454edd19ff57ade8a2368b13c1c5611eeaa3438e5f196f48280af5bd32b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188209, "uuid": "dc0b4210-fae1-4965-b44e-7036b323e581", "comment": "Malware payload (Amadey)", "value": "057cc8a9012754e93b9ac143ee5a25f26a94f4c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188209, "uuid": "386fcee3-8f47-40ad-8d53-54fd595e2de7", "comment": "Malware payload (Amadey)", "value": "2b9d17f714737e8bec133955d578964d022db7cbbdee77e8e7cb1cb147eadc3878ea58d195b5f24ef5744c8004d20a19", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188209, "uuid": "9c1d5a61-b64a-4224-b44c-0eb1801cf552", "value": "T1D2F41207A7E89423E8F01B310CF317832A39BD616734869A674B5C654E72AB4B3357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188209, "uuid": "bd9729cf-7513-42b9-b733-0b30ee6f48cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188209, "uuid": "411494c9-4147-4220-ba6e-bf105ce682d5", "value": "12288:9Mrby90zBfAadwlb1fxudB77A/QeJGk+WB63x9vJXWm7/wPt3DJqJ+iE:iyWBIad0M77WG1Ww3xx1Wm7/U/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188209, "uuid": "d937a420-d391-4660-b3e6-769b8f578669", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188209, "uuid": "00ceb5df-237d-4ed6-a5ab-7949772009de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188209, "uuid": "4b918a78-caa3-4862-83f5-c190c3e572bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae23dde-aaec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676216924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216924, "uuid": "a26e13d6-4545-4287-8a26-1e47540bbd91", "comment": "Malware payload", "value": "44654462a843410f5b935d02ffc456bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216924, "uuid": "521b304c-1204-4f79-a59e-a758af7ae3f3", "comment": "Malware payload", "value": "cd378e47967e09ed3ddf7a4f57e07df766d56f416246294b5f8c4e75ca7aa4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216924, "uuid": "04912c24-4f99-46aa-8f36-8a8dca271c34", "comment": "Malware payload", "value": "9552be77dab47e790edf688f8ac07c1cd4b3dbc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216924, "uuid": "36ea0aa9-ec69-48dd-957f-68941d39117d", "comment": "Malware payload", "value": "9dedd86bfe464b854107ff73455484c661d91ba8a064aeb75c6fbd93800a19e342df2815b5a112dfd6ee0363678c8429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216924, "uuid": "ad39c3ba-2195-40df-bf73-145d37f0bb27", "value": "T132F4125BB6E88422ECB567B12CF603D31A35BD606734925F278FAC5D18316F0A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216924, "uuid": "56a44733-24a1-4eff-a8b0-55d8c78296ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216924, "uuid": "1f78e0f2-3567-46ff-a87a-bade196583a4", "value": "12288:/Mrpy90f4DC+gufug2tLGmZmtcwO+DzkkTseJEXKPAOmqvdd4nSCLg0:qyk8C+ZfuBy2mtjOwkEEX4Anqvr1Ck0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216924, "uuid": "b6f205be-de29-4443-8e64-0db76c20a70e", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216924, "uuid": "5b659f3b-b1d6-489b-8a18-ee8b9297dac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216924, "uuid": "d6383453-a6fd-47df-9711-40fc91f2a066", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ab47f8-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptOne)", "timestamp": 1676229550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229550, "uuid": "22841cde-954a-413c-ab52-13dac0f7ee12", "comment": "Malware payload (CryptOne)", "value": "009297b1a22d1b81b4a9024bcaa07382", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229550, "uuid": "fc168713-9937-4ec2-bb71-7524f9bb5737", "comment": "Malware payload (CryptOne)", "value": "cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229550, "uuid": "e620eb88-41d9-4066-b143-5557b03d6a24", "comment": "Malware payload (CryptOne)", "value": "b4d816dbdc214fe5c05dfd1651be5c893e4a8346", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229550, "uuid": "844a9304-4509-488c-a042-7d7b72eb1b59", "comment": "Malware payload (CryptOne)", "value": "e3b3cc315130af3d7303d9fec404ed2516775cce8cd2e7c61453d6c62bbbe5f882e9141a41c705361cc8cbec6d590623", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229550, "uuid": "2e2968ba-ff05-40fd-894d-2a406f1f5fe5", "value": "T1C875232179C1C4B1D46B14344DA9A7B2AB78BC305F76CAD79B882F6D8F300D1A931B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229550, "uuid": "2325855f-16f8-4155-8c87-dce1b79811a7", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229550, "uuid": "498e5f47-6ecb-4a22-9bbe-748e92824b25", "value": "49152:WBqaaG+hjNW6EPKqXBPG7hceH2cYopsMPg:WBqan+tI68qtceH2zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229550, "uuid": "a3582629-ed53-4550-9e23-3dde77effcf9", "value": 1615036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229550, "uuid": "3697802a-3d7f-4f2c-8526-36cd1c8b097e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229550, "uuid": "35b6e4e9-779a-4fa3-808c-8f5448b73db2", "value": "009297b1a22d1b81b4a9024bcaa07382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e6a9c7-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676179391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179391, "uuid": "c94948da-1bbe-47e6-ae8a-7eeda068ab3b", "comment": "Malware payload (Amadey)", "value": "ce6e0c3f4415d2b32fafbfd3d2438beb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179391, "uuid": "7bb4a050-fc13-4ed7-91a9-1cb70cf62baa", "comment": "Malware payload (Amadey)", "value": "cd897352f84905a910a26d26ce824213c2dfdd122280b421e9f7dc8fdd588797", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179391, "uuid": "fa48df90-e32e-4e32-b0d5-37b60c8aa604", "comment": "Malware payload (Amadey)", "value": "70d4e301378351dab252d4386ed5b5141e06f859", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179391, "uuid": "b7711fb2-de3b-4982-a262-8e9fe67fedb1", "comment": "Malware payload (Amadey)", "value": "0a726a1ec6cb9010d9ee5b5d07dcf34e8e5dcb8955bcfce9be19673b04b8a8582152b1b06b3c07b70e71fb3fd2f9be4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179391, "uuid": "b05dc20b-e97c-4c83-aefa-0308b0d8a2e1", "value": "T136F4120BFBEC8072E9B0577005F603D32A357C655A38439B638EAC9D18726B2763536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179391, "uuid": "21bc68a3-27e6-4dad-a78d-bbd9d9b32254", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179391, "uuid": "66a63409-b326-45ec-a9ff-067cab40f379", "value": "12288:7MrRy90PZuJkV7AfxemhuOBSTRKRFzvIhreJ3axitAgmvIBfofTnNpVI:Cy65Vc5eY8kFse32MoTnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179391, "uuid": "4fed36a1-408e-456d-b699-e310dff3c314", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179391, "uuid": "f8990d6c-7e64-47eb-8d84-021f97bade9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179391, "uuid": "e2e0ed9d-e3b7-4a7a-b8bb-0e39eea21d1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fff22fc-aaf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676221925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221925, "uuid": "ba471800-dda1-4e33-b0c7-bdecba9332bf", "comment": "Malware payload (RedLineStealer)", "value": "1450f4dcb89c51964eb3a4516761deed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221925, "uuid": "3e10d7e9-2ffe-44be-aea5-7f12c69a8a5e", "comment": "Malware payload (RedLineStealer)", "value": "ce3fd7f8b043d72232aa9666df38c3021b6fc8aebb92d51b9ef46e8c18f8074d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221925, "uuid": "3444b4b7-c052-46af-ba6d-ca6110dce5cc", "comment": "Malware payload (RedLineStealer)", "value": "a6362d6280670c8574645696f410be0bdfa801ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221925, "uuid": "2a55ba8f-1ba2-48f5-8913-f63d13948d85", "comment": "Malware payload (RedLineStealer)", "value": "01c17a1c97be36aab04763a71449704ebf06d0042b21f1ba6b1fb53e42f843dc305439c1cba6197f3ef809eb33276e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221925, "uuid": "18905789-d967-4c75-83d7-efbab957fc34", "value": "T155F4120BB7E85131E9B457B049FB03C32A377E616B34C39A134F6D6918B26A1B235763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221925, "uuid": "92bd81ef-aa99-4915-95ad-75100f7267a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221925, "uuid": "5f659ea8-1e0a-492e-8f04-7c53aed0e74c", "value": "12288:dMrFy9031ioWiwzVbcDGxqpceJhVSso9Pj9VRR8tvW86TDR6MnNfLfK:MyMBWjzVbcGxqDhVo9Pj9Vr8tu8sDRH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221925, "uuid": "a6a05fd2-83d8-4ff5-b0b8-e6efbc1aa0d8", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221925, "uuid": "ddeebfb4-3f79-4590-968d-afe438aa0e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221925, "uuid": "e37166fd-30a3-4803-a374-17fa3af64ac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ff3499-aadc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676210045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210045, "uuid": "edc41522-aa08-4b34-99ff-b31ae86a61fc", "comment": "Malware payload", "value": "b45b456efc93d3e724bb87e1b6ed91c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210045, "uuid": "6a60a3d6-16ae-4dd9-b50f-3124df493b31", "comment": "Malware payload", "value": "ce67242e8674618f4efa78a56850263801295541c807fd18c33ab9d40bef3d31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210045, "uuid": "c01fc86d-b7b9-4da9-ace5-0ed9824e5c21", "comment": "Malware payload", "value": "617627bc79edb7e00f75cb24b6a9f3ff4d71e2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210045, "uuid": "9d75ebcf-7a1b-4e64-acf8-8c3d8aca1f26", "comment": "Malware payload", "value": "a98e19d4616d1ccf46a91d218b7c83a11b1b3a50a0fae6ca58c0848207b75bd3ce0bdec42a237c48f4d46d775796f560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210045, "uuid": "b8486f7d-eb73-44b3-bfa6-33f2c86827d8", "value": "T14D66237356299189E6E1CC399937FDC0B0F6172B8906F874A1EB6DD6323E8E1E603543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210045, "uuid": "908664ed-89c0-4bef-94e7-cd2f30440c44", "value": "e15d8fdaba025278971a192141f26d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210045, "uuid": "d8cedc6c-b47c-4ee5-bd44-f6850b0e98de", "value": "98304:Nwbl5fYvGYLBgbGgfFZae8p3PDF7S3WafAPrTcPEo84Su4s+gu6JMvlQMR8d:NwaGOB4ptZ5l+TAEV4sgu6Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210045, "uuid": "76129a97-bae3-4719-a243-e409c3100a35", "value": 6668288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210045, "uuid": "ceee75cd-db72-4275-a245-e85c63f7bd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210045, "uuid": "e12a9007-240a-4055-8e67-b75b033ae0bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d9928b-aaed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676217313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217313, "uuid": "75850420-394e-4089-9c9c-1b1091dd72aa", "comment": "Malware payload", "value": "6ab5b77cd54cae2611f761240180c6a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217313, "uuid": "0d3710ab-e39b-44bf-8400-0a101d3abb77", "comment": "Malware payload", "value": "cee08e6b571523dc55190e098dd2ed2fd88d308ad261633bd47968a7c0a16f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217313, "uuid": "f4d0934a-9df0-4ac8-b90b-795aab6b7dd8", "comment": "Malware payload", "value": "4261ca6a0b0cb67eba187f7049ae97a097bce360", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217313, "uuid": "db355e1c-ca9d-444f-b939-544b5d4bcb05", "comment": "Malware payload", "value": "86f99183ea061e374f0ea41f366a24f1cf6b5e57264770917df19855ef31f25d9b502a3e32b1dcc8ea389e184a26e189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217313, "uuid": "709762e2-5439-4f49-9723-d6705d37e754", "value": "T13FF4120BEBEC4123E9B557B158FB03C31A36BE615738961B278F6D0908727A0563636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217313, "uuid": "c6684223-339f-4386-ac41-d04d15b0b21a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217313, "uuid": "a8a4e8c1-c0fc-4afb-b092-d6d976f0c0da", "value": "12288:CMrUy90nVaDwAcYdNyM1GZ9ChyYkVqReJYgEhHdCeeqsmlI2v:uywVvYTr6ILkvYDd3syr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217313, "uuid": "8f52c8e5-d4bf-4f42-b4dd-3a5cfdf1d7fa", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217313, "uuid": "4e686bd2-92ed-42a3-93a0-23c453c1a006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217313, "uuid": "007f74a9-ba05-485f-9541-692e3279a4e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8502df-aabf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676197470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197470, "uuid": "8a7c4fc3-2f7f-4c23-a525-556f060dfe17", "comment": "Malware payload (AgentTesla)", "value": "4773ba9bbc39964e69f46ac909f3b1bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197470, "uuid": "a8f2e678-cc09-4254-b3d0-da266b277e71", "comment": "Malware payload (AgentTesla)", "value": "cf609ee7e0581b02c23fd6688a555810b88672da6d0e5f041a0daf836b6f2ddd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197470, "uuid": "4f70ed9a-927f-49b4-b72b-2b27e0295206", "comment": "Malware payload (AgentTesla)", "value": "15ed7bd31ba58051a375098a0668dc9fa75ce08d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197470, "uuid": "76600ee9-9c21-4763-af42-a478db77ef4b", "comment": "Malware payload (AgentTesla)", "value": "212fe0d6815b18092f20ee92f2f5db555f0bf8a249c158f78b8f36ded4e37c4e2bd2fbd8690fe840db0f82ca2003731f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197470, "uuid": "28b15a8d-1c72-41fa-bf39-c9a3f6ef6218", "value": "T14405D42929B617E2C038F66A42E78520BAFE5E437313D859ECDE37F10BB15412E8B51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197470, "uuid": "3d7ee070-2bcf-448d-913a-dc44908f3819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197470, "uuid": "046a4cf7-2028-4c58-9fde-b62b7f1c2b36", "value": "24576:U3zLsRg9db30NOQA+/7l1yhfI1Tn54pLvS4/qWB6AAgZAAHENadzz:UUTn54LK4/TB6A0Ak8zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197470, "uuid": "a219ec5e-4cd1-464f-b523-b8d12aec7daa", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197470, "uuid": "496dc0ad-cdbf-4779-ac46-554c582fde97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197470, "uuid": "952d8713-fe02-4b20-a6d1-1d0bdd16ce02", "value": "ORDER -S909475B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420a3a02-ab10-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676232183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232183, "uuid": "06b7a404-87a7-4708-98f7-988e8be7323a", "comment": "Malware payload", "value": "68a7059a95d1c2a27a4431bd8705617a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232183, "uuid": "b532248e-cea8-48cf-a707-62e922210001", "comment": "Malware payload", "value": "cf7bff0aa3b65bf158278ddf7e50ed155e5a08d695d309c778a0966fe00f5ff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232183, "uuid": "406c5d53-fc3c-41e5-9512-1ef9363a3e03", "comment": "Malware payload", "value": "92bdbace4024f48d776576a3482a1c4f0c721883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676232183, "uuid": "721841cd-7b10-4e7a-aa6b-9a508a8cc4ae", "comment": "Malware payload", "value": "25f55035d1851ff7616b84f2a064c2aaa2629b23748569fd51d91796a091e80003cd400d35fc7dc9a16133eb9d495187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232183, "uuid": "5643d3f3-b56f-4917-9e14-8eb5b2575806", "value": "T1F154F0017992CC76D0CBC5345921D6906A2FBBB1AB63C0DB23982B5E3D307D14EBAF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232183, "uuid": "c0c3c4bc-2d76-4882-a907-d850fd5e6493", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232183, "uuid": "0000f207-a10b-40c4-8abf-77e6f05ffbd8", "value": "3072:E7VrT+H8ohq56pBV9hHXI4rrWJhQRC4QSTPyP8TPtNfpG545rj9PVPJvihvkt3jy:uJCRh5bV99XImrZTPyErtNRGoRtPUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676232183, "uuid": "1a90cfa1-2484-415d-9764-e3b5c9dfa444", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676232183, "uuid": "9c983898-9f10-43f0-ba34-696d2fdd542a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676232183, "uuid": "eaa3c286-805b-4bcd-bb22-6957fda47a9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777c2121-aae7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676214663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214663, "uuid": "2009ddf7-c99b-40ff-8137-6efb5a5d9d9c", "comment": "Malware payload (Amadey)", "value": "31d3ac4b97e41a875e0c3409936370e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214663, "uuid": "5930ec7f-98b4-4fc7-bb03-54c34a7ebdad", "comment": "Malware payload (Amadey)", "value": "d0193c009989b346faffcee4149c1514f1241bbd7709353b4bd2496f39f899e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214663, "uuid": "be6af7fe-b173-477d-8923-ca82ce0c089f", "comment": "Malware payload (Amadey)", "value": "bf8c70f416db94c94b9d4dc4946b4de982e93b50", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214663, "uuid": "e9ecb46a-9def-407d-80d3-e6b7aaeac176", "comment": "Malware payload (Amadey)", "value": "13646ecfec6d70c5d6ad97e65395072d4071bc22ddaf19cf3ce353a842c585a25b27f179b1e0be11f1754661c511a739", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214663, "uuid": "d9d8ea36-ccef-47c8-af4c-5ecdecdd81f5", "value": "T1F3F41207B6EC8432E9F1A7710DFA03C30A367DA0AE38415B274E6C5D18326B567757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214663, "uuid": "c4e3b94d-1205-4696-ac12-4785c0c6deb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214663, "uuid": "8e267498-2c99-4d61-ab5e-74bfcb244f01", "value": "12288:WMrDy90Hb+31GuHyjid/HDMC1cqLbGeJIPI022gJe+rzILq9e6RHD:tyx1tHyjkDR1cqLT462gJTrzILeeeHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214663, "uuid": "ea4571c5-9ecc-4c12-909e-18902f9653b0", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214663, "uuid": "9f33be07-344c-46c9-90e1-0293bdb543d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214663, "uuid": "54c4ecda-3847-4238-94ae-4e059a5891be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a353cb59-aa7c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676168781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168781, "uuid": "b42d0d35-44bb-48e7-878d-32fadb236029", "comment": "Malware payload", "value": "e12eac8c1f474f6414aa5a5c61e5a495", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168781, "uuid": "022cc4fd-5e29-4630-842c-c939607f0f61", "comment": "Malware payload", "value": "d069242110ce090556d137dbc597026dea64f04a69ded8981a58d65f72398c03", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168781, "uuid": "4b64cde1-1bb0-49fd-8d48-872cddc99e9a", "comment": "Malware payload", "value": "995538cc22270ec323fb855160c191ae8dd6944c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168781, "uuid": "9b5453b2-830e-4c72-a7bd-3d34bd330136", "comment": "Malware payload", "value": "75df9e342704c2a09108b03d76e314393cac4f85b09a37c9043800f12d23b852b84f106623b478c6b2f0b1a3dc9b1a9f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168781, "uuid": "142fc182-37d2-44ce-9c63-b2c5b2719f41", "value": "T1D32733A31C069CDAC131A03A097E1345A875CE5A3EF27A212454DBB7D5F39A5CACDECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168781, "uuid": "351db1f6-8ea7-464e-9792-60e802b3f526", "value": "393216:3M0sJA35z7A79L+D+01mbgafiubcgZ3bRT9i/zVN2I+TXZxUKpPbNiRSKcsIJ7:cbJA35z7c5rKmbBffca3Li/zVN2IkpSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168781, "uuid": "0dd8ced4-076d-4f92-81cc-a5d178e2df3f", "value": 21503066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168781, "uuid": "7227d875-737a-4495-b7ff-babbaa03d8c2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168781, "uuid": "0389bd04-fc07-40ef-87c3-576c1ba04d96", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068730a6-aad3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676205884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205884, "uuid": "cd56a35d-3a7a-4586-ba5a-da61aa190a8f", "comment": "Malware payload (Amadey)", "value": "2b8917ca7231d51e0fb64bf82acfa118", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205884, "uuid": "c2467b7f-1743-4c14-b5d7-876f1c6e5f31", "comment": "Malware payload (Amadey)", "value": "d11d6cc5234c4f771e5942b5f50a924758a756689e52f9df4e2221c44a69ba4c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205884, "uuid": "6f140e7f-739d-40fa-b16a-748ce6c67c4d", "comment": "Malware payload (Amadey)", "value": "3cd21a44fb2e47c51eeeb5288d0ddcba4be83bac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205884, "uuid": "cc02e43d-4d60-4c42-b4b5-70fb7d5c476d", "comment": "Malware payload (Amadey)", "value": "2ef1e9f3884ec4d9e1c0c029ebdb868613a4a4fb4394756db9776eb36d1a3d0f73f6e31233d53bb581be809b6756a866", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205884, "uuid": "a9910f85-95aa-4d83-903c-e6d274d5dffb", "value": "T17AF41207E7FD5422E9F697702DF203D31A3A7D605B3482AB63CAAD5D58322B46831367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205884, "uuid": "bacba8dd-7730-4d5b-a7ca-6c97a947baf9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205884, "uuid": "f1721138-9da3-4fce-90d8-8336c2da70fc", "value": "12288:jMrvy90kUpVvSFlDkCM08WSwB7VSbnweJeQcEiBLidfgBTRQY3IZEui:sy9AVvc9kO8WSOh+heQ/iIKBTWYgEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676205884, "uuid": "be47b50d-c628-4773-8153-77129e47191b", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676205884, "uuid": "0953e58f-8cf5-407c-acf4-c2c45535931a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205884, "uuid": "c5ba1aa5-d5a1-4c33-9cd4-85e44c973499", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416923fe-ab20-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676239054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239054, "uuid": "0b17aab4-f5e0-4bd7-a8e3-4a4bc3674a57", "comment": "Malware payload (Smoke Loader)", "value": "0fbd624f1a4c263d6bf69cc3aecbbd0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239054, "uuid": "888f6a43-b2ff-4b24-93ce-1f59e76f10c6", "comment": "Malware payload (Smoke Loader)", "value": "d18e128b5e7f0d6a1d7e4b4c2c7daf8e2ee1768b2cf87e6495d7f596756e911a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239054, "uuid": "6792c02f-2ca1-4147-8de4-51c04e492a63", "comment": "Malware payload (Smoke Loader)", "value": "869223a42c31744c4834b797333a0ef4092ba2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239054, "uuid": "ff8f04fe-28d9-471d-a59a-df7023a099e6", "comment": "Malware payload (Smoke Loader)", "value": "c62a2539cc3159a2ba135ce61a5988683f7b084bd7c674879d045d8a9f868c1c18b588249acdf50158c6253d73b7affd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239054, "uuid": "dfae1af5-ff9a-480d-9f48-5cb3ce2dfb6f", "value": "T1D104CF12B5B18072F067857B6521E6A1692EBBFF2791C5C7234406EF2E30BE09B79313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239054, "uuid": "05c8263a-d6d4-4f3e-80ae-2752717a6ad2", "value": "e846e4e65f8973af5941088654b5219b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239054, "uuid": "d924bda9-e070-4d7e-8bc3-abd6348e28fe", "value": "3072:1KSZkKi5Hvgj3Mm7Z8eXp0nFEEfwm47Fb9Jr9:HKbYj31WspfEfGr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676239054, "uuid": "0dbb8e0f-1b73-4581-8a85-7bac4ac294fd", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676239054, "uuid": "cf1f7929-a27c-4b3d-b4ea-a61f290fc914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239054, "uuid": "1d2cef72-fd15-4c88-95f0-e27966d535e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844f61a7-aa8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676174742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174742, "uuid": "726fff9a-83bc-4d9c-bdf4-ccd64ee1097e", "comment": "Malware payload (RedLineStealer)", "value": "ecf3cfd06380e7db32e5daefd72f8cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174742, "uuid": "bd264196-c231-4803-adae-5e2520de058c", "comment": "Malware payload (RedLineStealer)", "value": "d1b43cf9ff8a077bfe9d8cb1b6b86d40b486cadc1bf1d1ae5df3cd85cad7bd6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174742, "uuid": "762a4e73-ca29-40d3-9484-c96452cc4564", "comment": "Malware payload (RedLineStealer)", "value": "90a115cb8536b4eec316747439625a5e9f882450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174742, "uuid": "533dce8e-173d-44c8-b2a5-430c1b1c9de3", "comment": "Malware payload (RedLineStealer)", "value": "4553944e51968d565caebd20c16160e0d656394b2d848c46346b654901ec1275151b9f10e29cd989952194409be80ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174742, "uuid": "7a3f38aa-22c6-4687-bf4c-152afed2afe2", "value": "T1E3F41207F6FC9836D4B457B09CF207D326357E505E38868A638EAD8508B26F1B171B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174742, "uuid": "da400e4d-f842-4c84-9cc8-373d97e83386", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174742, "uuid": "c7d9e847-4435-47c7-aa01-f175e8ee3477", "value": "12288:0Mrky90zEhbAVRIJYU9KU+OuvxR6u7wheJwh8biJiyHS8Te+C8yS2C7U+aIOa:gyzqVR9UNybwhqu1hC8yQUXIOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676174742, "uuid": "9247d79d-124f-46ef-8f89-f3c2a80e199f", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676174742, "uuid": "11f737d9-71c1-4422-a248-4166ccad9d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174742, "uuid": "d3f17016-b4bb-4d00-b4bb-de279df6eef0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67173f7-aae2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676212621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212621, "uuid": "32bcd88b-6838-4ed7-902e-5076300418ff", "comment": "Malware payload (Smoke Loader)", "value": "713639c7b80d8a8999b5dafd001295d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212621, "uuid": "ae505fc8-f584-45d6-ae4a-0724736afb97", "comment": "Malware payload (Smoke Loader)", "value": "d4d68aae0611fb7905294b5bcb68b607d9c7064791cfa615f17c7ee779be038c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212621, "uuid": "a044d7a5-e2ba-49d5-8c32-38186d83c385", "comment": "Malware payload (Smoke Loader)", "value": "fc86cfb41f097989fd1dd7f367c97cae0eb4f4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212621, "uuid": "cbac01a8-dbf2-40db-9a1b-ea25a417a18f", "comment": "Malware payload (Smoke Loader)", "value": "de498b9d8ca56a59cf360c2e792ef8e6b16d58be30a4e6d24ed8d0acd95980039c563d2e355ec8b8f1497aa167b6f3b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212621, "uuid": "53c21939-5038-4ff2-b80b-7c8c1c727a24", "value": "T17214DF1239A18432D47361B4D131DA98A63FB8F1A7A2A1C737481A7F1DF13E14E77396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212621, "uuid": "5c647f90-bbd7-4ba1-b0ab-e79a9364d903", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212621, "uuid": "40f9657e-4d1b-4594-8432-de7983bff776", "value": "3072:l7j8+rG6U565PSTqe7lQ9MxP4cG2YwGQsKWQINYUzM2eExzNYChV:h4Ly5a2OdvXDyJ/xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212621, "uuid": "db7c3050-66c5-44eb-8a8c-8525844bf5fa", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212621, "uuid": "dbda1eb3-2b39-410a-8314-420570b24d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212621, "uuid": "7eef2223-332a-460a-bc14-17561aea04c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983af65c-aaab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676188948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188948, "uuid": "c0980809-44d8-4309-8a24-b22c1c9f4657", "comment": "Malware payload (RedLineStealer)", "value": "becf15b8e4bf1aca5f7887e2f9bbaf2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188948, "uuid": "eebf8184-51da-4594-99bb-3bc0778d3605", "comment": "Malware payload (RedLineStealer)", "value": "d59978186fe37912cf01b9ac17dc7b8a9b1b6130b06ba56d35614e0e53a7d8b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188948, "uuid": "2cd72203-a80e-44d8-971d-625199680555", "comment": "Malware payload (RedLineStealer)", "value": "8a2d85b795524934b227f525a6923fe086ff719b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188948, "uuid": "299aab9c-ea09-4c24-ac27-51d38f998007", "comment": "Malware payload (RedLineStealer)", "value": "a5ad0319b4d50e42ecaccd2a2a88a8b9107fdc0324aff69a1228b38bccd9d9e2a80f06bee8680bc0f3b5dcd8cfa03b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188948, "uuid": "0e17ffe1-56f7-4694-a13e-15cadd40d47e", "value": "T17654F11272A1843EC6130AB91D35FBD56A6FBCB19B5981DB3308096F1E303E29F76346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188948, "uuid": "60e738ed-36a6-4653-9f0a-8d7d88e64d43", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188948, "uuid": "999600dc-255f-4ff2-b51c-87ad1562dd5e", "value": "6144:PGARaKSYCjfJ1dYgdAZdL4lDwVHFdgpol+Vg7BqTJD:PGuNSYCjfJzYgdAZFEDOHXgRVgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188948, "uuid": "1c44e6d8-fd13-4533-8370-38d4b88014f4", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188948, "uuid": "91cd00ab-cc6f-4761-a28d-099dbe0128c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188948, "uuid": "48f2a891-b41c-4f0e-974d-76b7bcdca774", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e857fc92-aacf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676204545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204545, "uuid": "755bc685-c5f7-4cf6-badc-6d4c9ad8417b", "comment": "Malware payload (RedLineStealer)", "value": "6a818e38728eb4fdc0ca6261706dfe01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204545, "uuid": "115be104-3b7b-42e2-b612-52f84df28bb2", "comment": "Malware payload (RedLineStealer)", "value": "d675f70c15ddfa55823f474f9fc0a8a1b62c28b2dd0b1a380e956b82a6fda166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204545, "uuid": "15318220-c06e-459c-b84b-f907ee07793f", "comment": "Malware payload (RedLineStealer)", "value": "501fc84e85ac3e178278de566e3a97fbe1f98a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676204545, "uuid": "71b67d30-4c80-40e5-98c4-5eeaf3ef6915", "comment": "Malware payload (RedLineStealer)", "value": "26bbbb805fc443092db30032c18fd9d44cf83b5a4820a01f8ce550d31150cfb104a38a64b0a2c0dbdd193bf7c20f9bce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204545, "uuid": "6cdaa3e1-2bf8-4506-bef8-ad843a44c48c", "value": "T19EF4124BA3DC8132E8F4237069F707D316367E205F788259578EAD5A0C72AE0B67539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204545, "uuid": "e39d0aaa-5ed9-4761-ad4e-6de16c0e74b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204545, "uuid": "ac24f912-f1d6-405d-b7ef-033e0eec044e", "value": "12288:mMrxy90qjLR8I3Qug1wITPwMLRR5wzQ0eJVcXDzSms1hVLyBnca21bwr:Pyn26QugiuYMLyS2DzLsG2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676204545, "uuid": "991902c2-fb36-4656-9e38-b3ae84fdb0a9", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676204545, "uuid": "38f8dd0a-0a26-4463-9dc0-1c3bc070315d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676204545, "uuid": "f8838ce1-3198-46f3-b18c-473adf6c3b36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f0d8e0-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676212137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212137, "uuid": "de076977-28e7-4440-b2d1-2d66279e323f", "comment": "Malware payload (AsyncRAT)", "value": "3cfa08af2e428627fc94d12cf816fa84", "object_relation": "md5", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212137, "uuid": "3774ef76-4312-455e-9154-4d9bf1e75758", "comment": "Malware payload (AsyncRAT)", "value": "d76a3ee345f410aebfc11949c542acfea7b7445c3e396f1f2d7a785875d3595d", "object_relation": "sha256", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212137, "uuid": "8da55f15-7201-4955-a26b-2df959cc9f7b", "comment": "Malware payload (AsyncRAT)", "value": "fd620819a91ab99ccf03e564803da214775be163", "object_relation": "sha1", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212137, "uuid": "7d315f45-5d18-42d8-aacf-3d4e0fec5e64", "comment": "Malware payload (AsyncRAT)", "value": "5446492beb7ed07d51aa8ccd989f33524820a733594d555aee33c7e7393a84f1ee1d117b380c86bd430e9e298c7eb354", "object_relation": "sha3-384", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212137, "uuid": "350a28b9-e54f-40d4-9e08-5808a2fe46db", "value": "T103E4BEE01281EEC2D27D7779123019A08AFD7C552DF9EC0E3E5072AB9BB27855FD06A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212137, "uuid": "9e3dd832-40bc-48bf-9832-4e44692b5943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212137, "uuid": "36f6dcfd-9b36-40d1-87f1-1d68265e20d1", "value": "12288:HmeFQUUbkWZ6ueafd/dEwUrJLXWO8c+yyn/xcpyO9D94AQfJ:5FRueUdUrFXWfncpBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212137, "uuid": "f358dd92-a979-4bef-a941-f8c92182052d", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212137, "uuid": "85222a4f-bb31-43d5-bd9d-26366af20118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212137, "uuid": "af20244e-e1d7-47ae-92c7-23e8dade21ad", "value": "tmp83B8.tmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6c8a84-aa6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676161840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161840, "uuid": "b9eeed85-8a67-453d-bef7-24c9be599a30", "comment": "Malware payload (Amadey)", "value": "a7f700bf72c2e6b57c573e93ed68017f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161840, "uuid": "f4c45ca6-c4b7-4d3e-a8f3-7b9782aedf3c", "comment": "Malware payload (Amadey)", "value": "d84085fbd1a2e9967240291685fe69307830e1af50dca615194688adf6c94d21", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161840, "uuid": "4f1c7fde-983e-40fd-87d8-6bf122334939", "comment": "Malware payload (Amadey)", "value": "d23233b4c1ed78458e0fce199b99fd8500c33e2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161840, "uuid": "ff61790f-ccf6-430f-bdf7-6e02cbd9f79a", "comment": "Malware payload (Amadey)", "value": "2f92fa1cd4426f97178d450499c77b9b7abf98c9715cf8ac4cef473145a9ba7dfe5e7718ed9f543fc371d578a35e6c57", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161840, "uuid": "384ba5bc-9c2b-4ae8-8c61-36bdc4629fe0", "value": "T128F41247E7EC80A2ECB5A77045F707C31735BD519A3442AB23CB6E9C18726A0627937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161840, "uuid": "5ff95247-024b-438a-9068-1837d26170ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161840, "uuid": "45629722-2648-4e22-bb38-d12e57503597", "value": "12288:RMr1y90awQHkPdAcbVLK/v4uXOjAkeJasQIBm3bsAa0tltSGyIr7ftCNz:cybwQSfVo4uXOeI80tOGyG8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676161840, "uuid": "1c2385d6-8e33-4866-a41f-bf22514af6d7", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676161840, "uuid": "ab734e76-b9ad-4949-96d5-f958d3ea7a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161840, "uuid": "c36065c3-2d0a-4db9-8854-d3f994f93b78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18f0556-aaae-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676190279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190279, "uuid": "9919d7d9-7568-4bc4-bc55-d24411a22af0", "comment": "Malware payload (AgentTesla)", "value": "da0550e9b9209bf014cb7f0045a664e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190279, "uuid": "6ab7c3c9-2c4b-4820-a87d-b2912dd8cb89", "comment": "Malware payload (AgentTesla)", "value": "d9ad88706af6bd773f193ee94035d88ac9b562a6d77ba68bbc59bcc2a41129d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190279, "uuid": "2099941c-b74c-41b0-af95-28bc14dc71a5", "comment": "Malware payload (AgentTesla)", "value": "119ec8931c3fd18cb185341c45bdf94942ccc447", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676190279, "uuid": "335b24f0-a262-48b6-add3-461bd0163d22", "comment": "Malware payload (AgentTesla)", "value": "abe7281a5bb56bc0e723b6522e30816d386ffe029c8d0491238f57f1774a70e9e0ed67f8b389d5a056df35b0560ce38b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190279, "uuid": "fa1ac799-86be-46bf-9662-97bb3da4c599", "value": "T11245482439FA501AB173EFA64BE8B9EADA2FB7733B07645D109103864723A41DDC153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190279, "uuid": "37cddea1-385e-4cec-9516-6bb929486ec9", "value": "12288:8qY7enorBt0YALlDZU9wZ+bJPKh1MgDYOuYJfj+ndtoyLI6w8kxZLhjhWX8R/dJz:KeZ60kSMeJbIw84CXybXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676190279, "uuid": "ea3f6ee1-fab2-4790-91e3-6587509216be", "value": 1190768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676190279, "uuid": "dc105e8a-86bf-4174-8e95-f3d82764d603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676190279, "uuid": "f9a9f918-f545-4bda-891f-1e704581ef71", "value": "Pago transferencia.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ab3895-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244136, "uuid": "6b9e2de7-82e3-4b94-bc98-d925443d3be0", "comment": "Malware payload", "value": "09269f2773006ad0bd35f0c351c8c8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244136, "uuid": "4c49fdb2-b321-4155-9330-cbfabf21c0dd", "comment": "Malware payload", "value": "d9b2b49b1aec0feef6b132067ff23fbd450b5656b9be52b4ff9e86d9e6274022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244136, "uuid": "42b6e011-d4da-436c-bdc2-b5658e273f5c", "comment": "Malware payload", "value": "baaca66289c4be786bb9401a006357242a77601b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244136, "uuid": "ee55a4df-7206-42d8-9b17-f06e720ad5a5", "comment": "Malware payload", "value": "cef30399632adba52ba70fd1f3aab190f150c4d854553aac84c630acd974b3dcd206748f5ec09c618d072326caefd8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244136, "uuid": "a6b535a9-2f42-4066-9a19-f376ea1809d4", "value": "T10FF4120777EC8526E8B117B019F603C32A7A7D105B74839F620D3E6A5E226B0E175B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244136, "uuid": "f618cc5e-64ae-4433-aa1e-d07379f22e66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244136, "uuid": "22b87baf-894d-440c-a59d-b9212e4ed7df", "value": "12288:2Mrhy90i6AD3rVOq0HOVAwimURSJVlUueJiciXp58Ckj1R0rIkDqLRG1:fygAD3rQuV9imUAJ/2icq58bSs7Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244136, "uuid": "a5457ba5-82de-42bb-a7a3-a4b192a2c78c", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244136, "uuid": "e8d4c404-620c-4bdd-9cf1-13bb361ff61f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244136, "uuid": "9f6931a9-ae35-4aab-b2cf-9bc61e08313d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca11cafe-aaaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676188602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188602, "uuid": "1334fd1d-df92-494b-a1e9-ec093f8a9927", "comment": "Malware payload (RedLineStealer)", "value": "94f7f58600bd78fd8179f0fc6d57d9b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188602, "uuid": "7111801c-f430-4d6f-b658-01a3c01bbf38", "comment": "Malware payload (RedLineStealer)", "value": "d9d2775f50c7aa183b850e881681fa9020682269dcb62ce18eb869f43f7194ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188602, "uuid": "2466d3f9-fdb4-4885-b141-aa419df976b7", "comment": "Malware payload (RedLineStealer)", "value": "a9e8cb1265ade098177b1bdad15623db0eab82d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188602, "uuid": "fe88df0c-9473-4468-b5ee-684deac1e1da", "comment": "Malware payload (RedLineStealer)", "value": "3136872b4358a55f3c003299731ea0490d26862837101277bd8b43049bdb03bfaa7ab589b4a02299b467b65ec620c7d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188602, "uuid": "468aead1-0d99-4fd4-b4b6-ffd600e18d0c", "value": "T16DF41217ABE89022E8B4277058F302D30A357DA25738935F2B8F6C890873AE5B535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188602, "uuid": "c90c1440-49ee-482c-8115-d39dd1af5e7f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188602, "uuid": "e29667c7-46c0-4e19-af35-cfa6b907a279", "value": "12288:GMrLy90LP9SAS03GTXHTEFTsWVz3XPeJpZRNc6rSLRypm7BwPjpDD9XzT:lyI9hS03SXzEXpwp/NdrWMm7BeBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188602, "uuid": "3879ad35-7fb9-400b-9e55-63af4adce64a", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188602, "uuid": "d6746b75-e152-4609-9499-88f7af1ea2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188602, "uuid": "b4379bb5-b677-4dbd-9a40-df18164339e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8fb8a9-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244277, "uuid": "75894559-9e58-4b59-bad1-90130887b830", "comment": "Malware payload (Mirai)", "value": "2fa922ce2e2ddb6b4f5b03e6ae38e25a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244277, "uuid": "d86dbcaf-e1c9-4ecf-a730-22d03536c98b", "comment": "Malware payload (Mirai)", "value": "d9ee093a42ef44cd59f2c1fc376c746c4863c6168912343d5c755a3c434fd09d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244277, "uuid": "57436d98-2d3f-4438-9855-6f60c197cd94", "comment": "Malware payload (Mirai)", "value": "0976dc7953c0b77213560644faeeaa212cd63ec1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244277, "uuid": "27d0d571-4815-4a7c-aced-d9313fe57a93", "comment": "Malware payload (Mirai)", "value": "3facdbc2c44e6ca7126201b2234a1a61459012e459ebcedb6d01ea1121db672922f8c66fe6e67fda747171ba912f458e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244277, "uuid": "1f418e26-ae8f-4f8a-a83c-7ae49a601b06", "value": "T118E2E15AE1E8CF80C45B88396C297D0F1830A56D6A404F62ABAC753F1E82F5CAE1D1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244277, "uuid": "50a786ea-457f-465f-88ad-cb9db94d1c8d", "value": "768:TkuRGSh9v7SsXclj5tju6j5ircSBVkvSipd5hTnbcuyD7UiyqB:guFhbXGbX5RSBivJnTnouy8ZqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244277, "uuid": "007d96c3-ef6a-4183-8b7c-79f8320219dd", "value": 32984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244277, "uuid": "aa214f17-b0e9-4db0-baa9-86e0a5b7628a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244277, "uuid": "ef70d891-aca0-414a-9aaa-9f5b5e6ad54a", "value": "2fa922ce2e2ddb6b4f5b03e6ae38e25a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbe8768-ab22-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676240014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240014, "uuid": "2f4e1f3e-aa61-4bea-bbf5-371627637f22", "comment": "Malware payload", "value": "8beb0da8f026344561f219916061dd13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240014, "uuid": "59333705-6114-4ed7-870f-d31e2e57e2cb", "comment": "Malware payload", "value": "da46a0fe5653c885fb9db5df9f66c70c431b943e66b77c5455f0d8d995ae09ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240014, "uuid": "87a9c59c-2f67-4397-90af-b7361cf74bdb", "comment": "Malware payload", "value": "ed0ae9aa703e1084e9c4073a0d579a5b260cebb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676240014, "uuid": "9bb3ee84-5fae-4dca-b6eb-60189be2c81e", "comment": "Malware payload", "value": "275c7916af5aedc2a2e5d0860167a2205c0c4cf2597cb3386b52fc17d24157d0794b4ba8b10b5bb1d25e93f126a923dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240014, "uuid": "68f4006f-cb73-42c3-bd1b-4f5c94803c59", "value": "T1D3F41217B7EC9032E9B8577006FA07C316767C91467883AA234A7DA92C716B0F1753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240014, "uuid": "190a16b3-3941-493c-92ab-296bba85e3c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240014, "uuid": "ecf0ce55-6564-4845-97d8-2086bebd3b3e", "value": "12288:CMr7Uy903YLoCyhaA1RmZUoGEoaye/eJxFBiPRhBwYaFCGj9R0r9SkqNE0LV:SyE/fYioG7xSR/wpSRIEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676240014, "uuid": "2baf2fcf-ca9e-48bb-99b8-13c6c2bf3c7a", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676240014, "uuid": "87de936b-646d-457b-b66d-ff310116b42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676240014, "uuid": "dd6954f7-5283-41df-a218-e8ab04ff67a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07dc88c9-aab2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676191713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191713, "uuid": "1110345e-9fb4-4a1b-a499-1109e7f7dad9", "comment": "Malware payload", "value": "05fb726d6ee0292ddc4a144f02cad81c", "object_relation": "md5", "Tag": [ { "name": "DDoS Botnet", "colour": "#D747C6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191713, "uuid": "e451c60a-5fa9-4943-8331-932a45f5c211", "comment": "Malware payload", "value": "daeeb4fa4edb56ecce7b430308bfc9b231e58e50013d10930b3ad03b7dc20cc2", "object_relation": "sha256", "Tag": [ { "name": "DDoS Botnet", "colour": "#D747C6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191713, "uuid": "cc89c5cb-a4a5-4fab-9d25-55c6ada3c8b9", "comment": "Malware payload", "value": "32b26874ff049d4404af5870a6525c01c585baac", "object_relation": "sha1", "Tag": [ { "name": "DDoS Botnet", "colour": "#D747C6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191713, "uuid": "8113e7b4-3bb7-4a73-aa53-816c02251109", "comment": "Malware payload", "value": "428e102e1f14fb8445ba72e18cc7917f6829c3ce71765326cb3d4709e5669f91e8de9c857ebea2bb243f1063a0bac24c", "object_relation": "sha3-384", "Tag": [ { "name": "DDoS Botnet", "colour": "#D747C6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191713, "uuid": "a8a56c32-5dd4-4ac0-b583-716256fd2462", "value": "T1B2667E47F89151A9C1EAD230CA768252BB717C851B3023D33B60F7B82E76BD86E79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191713, "uuid": "bb56c0e3-cdec-4e15-901e-4a4084135c6a", "value": "49152:CjR0OPWGMorb/TvvO90d7HjmAFd4A64nsfJdLk7BFgKbdFUQNIVRkBR7FULOC5E6:7zIgQNn7FyESR/JwXydLdCyy5EbbwN8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191713, "uuid": "09dd58f9-d9ec-4b95-92bc-b0a947a6afb0", "value": 6978800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191713, "uuid": "bed6e23f-e12d-4b5d-b8d1-630ce83f252a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191713, "uuid": "93ac0c32-d195-4014-8b8c-97bdb6d06292", "value": "client (2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c7e653-ab25-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676241269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241269, "uuid": "d24a0e9c-bf1d-4eea-bd43-3c014cd039ae", "comment": "Malware payload", "value": "ddb56bfa4fb472553ad65298740716f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241269, "uuid": "6b9abd2b-aa8b-4e6b-b37e-4d108045c573", "comment": "Malware payload", "value": "db19e51ea407bb6e2362111286a5a2a016ed658d500785989bae5aabcc876de2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241269, "uuid": "21db145b-f921-4901-85d8-9e744253d997", "comment": "Malware payload", "value": "f5e6285f8330d2247b789ff2190b72b7e93d9ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676241269, "uuid": "8295b6c2-a8e8-4efc-8f3d-c25461b11964", "comment": "Malware payload", "value": "fba34249c207f766caec0c2f11fa81ce111e754558ad17db6b4c9c0642a499b84b9edff1b7df4c3703e881d3ed26c6e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241269, "uuid": "5c680f26-45c2-47bc-8862-ea7519fde011", "value": "T16004C011BEF19072C553F1B56821FAA0AA2FBC719760C4D72F040AAF5D213D29A7937E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241269, "uuid": "d3e6e8b7-3939-4894-8aae-69b49aea9e24", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241269, "uuid": "21784e40-6052-4c3e-90c5-31e0ce89f248", "value": "3072:IMNZ1kOtr5H0MN8Y2W59/A4ki75PFtSpIP6:bP1B2Y2mkISpIP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676241269, "uuid": "4654f627-e936-43ca-bc58-100642ae4441", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676241269, "uuid": "5a0f8d5b-8fce-4766-bb6e-6d30b2f25a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676241269, "uuid": "875093c1-771c-432c-bfae-afe43ad2fa21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a1735a-aa6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676161986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161986, "uuid": "c17013dc-3ebd-4dca-ab9a-dcf9469e7cfe", "comment": "Malware payload (GCleaner)", "value": "f02ce1a83a291d58982aee263ae1ea05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161986, "uuid": "63832fd8-7054-4fc6-92a0-63a7b614087d", "comment": "Malware payload (GCleaner)", "value": "db39b86eb665bc0b5e819ad7fb2d91481570df424077f808df24218da03bb095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161986, "uuid": "99a0cc70-4d83-493d-9b68-f9190209683a", "comment": "Malware payload (GCleaner)", "value": "966ecc06429da9fbbea0d324c25b41b282f8fdd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676161986, "uuid": "b94678d7-31f9-424f-9757-79083f1cf116", "comment": "Malware payload (GCleaner)", "value": "ff759bf082c7fd3f06477dae36f363df0c35d12b37b9a3d557c332b3b1450fc614843c610b49560185873a1f94a77a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161986, "uuid": "94c67844-5c00-4f0d-87c7-dd0343273f9d", "value": "T1DAB5017C7144C4ADD6C0BEB88C3AE8E75CD6ADE3A9A4A16270CD7F3F9578288460D147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161986, "uuid": "7683bfc1-5875-47e6-a286-9b98e2acf001", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161986, "uuid": "a36e15ba-2e8f-4deb-95ee-7e331e98b0e0", "value": "49152:rdHKCtDNF3S31vlIYrjmenjFtY6ekyXrtuV9exgLCgv2MR:JHZq1djmWjFtYIKIhv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676161986, "uuid": "e7d3ebee-6bca-4aa6-9703-a381014e26b8", "value": 2455130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676161986, "uuid": "7332945d-4ebb-42be-b656-277548cd96e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676161986, "uuid": "16584980-d8ea-46d3-8980-32a5d1bf4fe2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad7b87b-aa68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676160338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160338, "uuid": "4c825518-6bd7-4842-bcfd-3525d63bc45b", "comment": "Malware payload (Amadey)", "value": "b79026514f29cf210dac7c15ab4f877b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160338, "uuid": "bbc9cb19-34b9-45ad-9a8e-f406efd4ac90", "comment": "Malware payload (Amadey)", "value": "db407adec64ba4da7f6650ee61d887ef765312d1314b22dbb330c9bfc87b0d88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160338, "uuid": "667af383-79c3-46c1-9a91-305426f4ab73", "comment": "Malware payload (Amadey)", "value": "55aa64f8db14a96dbb3a4d59e2ec8a4200dac122", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676160338, "uuid": "5bf18bc1-1cf0-46cc-b7b8-829b4e7dff12", "comment": "Malware payload (Amadey)", "value": "3359647955286b1d2091eef38e905d91e39a23d71937a8c9f2fe3b870e635dfe3ca02a3cbee33e6c6d44fd4f3c39450f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160338, "uuid": "393aef9d-ba4a-41d2-9db5-7334872f3948", "value": "T1B4F4120BB7FC8062E5F55BB155F603D30A34BE515A34822B53CFBD1918B2AA0A17637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160338, "uuid": "e17ba4e2-672e-4c64-b015-6e9f75e25050", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160338, "uuid": "e2424adf-1552-496e-8756-34b95344a7db", "value": "12288:zMrdy90rTLVBG1fOtrkJFORE9m/ceJmXBOuQo2CovGOVustSGU5Ng8yKwB:ey2VBVK3OlFBocGOVudGU5N8Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676160338, "uuid": "c62e1e9e-c35f-4661-928f-ebeac543ea88", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676160338, "uuid": "19635ba4-d7d0-4b47-aadf-1196db4ecd8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676160338, "uuid": "9ae5b8a9-2bbd-4e3a-9b38-f26bcd561c1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f92884-aabd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676196516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196516, "uuid": "6b472930-78f1-437a-9e15-74ed74cbaba5", "comment": "Malware payload (Amadey)", "value": "e0e25eba9378d85a4691a858d589a910", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196516, "uuid": "a17fdfc0-cd14-41b3-bde2-b4ba9eefe674", "comment": "Malware payload (Amadey)", "value": "dbe6481dbed838acfc1c345b13bf6a85d6ac963d7d437e1d87fcaab73cbebdce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196516, "uuid": "cb6f0ab5-9881-4f8a-89d7-9b612748df12", "comment": "Malware payload (Amadey)", "value": "5dcff40c290edc2feb9d9e30f8f8c113475b6d61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676196516, "uuid": "58a7e20b-78da-46ac-9038-58f2415bc163", "comment": "Malware payload (Amadey)", "value": "7824bf77c08653b378a7fa8b4731a817dcdd872e74dc32dc29bf498b4a12d417a9e774358bd5f27363fa230ce5e52bcf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196516, "uuid": "11a73239-24bc-497b-b6b1-8faa225308c5", "value": "T13EF4120BF6FC8423E4B467B028F207C31B367EA05B38C25752466D5A6C73A646A7176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196516, "uuid": "3ccc6d9d-e2aa-498a-9ef7-b63eaefbc19b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196516, "uuid": "e38238f0-4831-4b5a-9edb-6896cc1d7182", "value": "12288:oMrIy90qnA5TmoiJWvMbMG904Sy61ZqGqVZuX1CeJJB5UmbnIE1GqgIxzhNlxl8n:Ay3WKJJWvMoGO4SyNzZuFOinX1GNs3lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676196516, "uuid": "79362d2a-a72b-402f-b9a6-cf9d50c6d6dc", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676196516, "uuid": "f7ec6d26-580d-47ec-891a-850d9c4891a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676196516, "uuid": "5eb5ffbd-d932-4cae-8a35-3609597f60a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff96c195-aad9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676208879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208879, "uuid": "b3c1b9ad-c7da-4f09-9788-dc37d9382cb5", "comment": "Malware payload (RedLineStealer)", "value": "219a28859b9f7a6c76dff939e5d188f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208879, "uuid": "fd07c825-f182-4e0e-8dfd-c320567241b4", "comment": "Malware payload (RedLineStealer)", "value": "dc43cb064ec08bb53e29fe0b49f12aa36e729c491a855d49804cd2fc92eeb690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208879, "uuid": "52f15be7-29fa-46bc-b65d-331f491bf626", "comment": "Malware payload (RedLineStealer)", "value": "8406643e030cd3a54039332db51a76b40967c74d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676208879, "uuid": "18160077-4066-4b13-925a-7f253838f8a4", "comment": "Malware payload (RedLineStealer)", "value": "2cbe20cd7c6833ecf563d993659093b618986909a5e08dcfbf4b1d652b62e4b1c752736a92dbfbdf3aef236f3d0a1dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208879, "uuid": "1a91517c-b3a5-41b3-a69c-679ba684fad7", "value": "T183F41216A7ED8432F8B4677069F707C31E35BEA05A384297534FAC6C1CB26B0A07A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208879, "uuid": "3147fa9e-a0af-4bb2-9b41-b8789fe288c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208879, "uuid": "4b4ade88-3653-4beb-aae9-4215e60f6644", "value": "12288:UMrky90TBNEzaqc3m+29bVwj7uBa7yBeJCzYlMpNnAOGhgf+LOQlZe+weY:gy8HGaqc3mt95wuBWNuppfQ9ZVweY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676208879, "uuid": "1d0f6b6b-9e5b-4926-8cc5-41139c5899f6", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676208879, "uuid": "d133d3b9-1069-4535-a02e-58c3ec96e0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676208879, "uuid": "35c83750-54c0-47b0-86d1-d0152dee7e2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1a0e18-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676229163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229163, "uuid": "fd27b99c-5063-43a9-b60e-723aea68d7f1", "comment": "Malware payload (RedLineStealer)", "value": "83082232e13c9d8c4bdf53250665f2ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229163, "uuid": "732337a8-5087-40a6-be1c-c6ccd4cf7d24", "comment": "Malware payload (RedLineStealer)", "value": "dca38093bc51d165acf5754982d66fe28509c85d65492d8428a240e1f85df435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229163, "uuid": "de53d499-2a8a-4b54-9345-71b5672a92b4", "comment": "Malware payload (RedLineStealer)", "value": "ccb6e6406d2d09fc1e81cf247eec2ef7334c218d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229163, "uuid": "ab3eac16-12bb-475a-b3d6-9b9fce002fee", "comment": "Malware payload (RedLineStealer)", "value": "186f132df72dbad47990b350a88d62ea82ebcfe20ca294030539e3e1abc3f0abc08a14cdef7a6370dcfb6857d6c287fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229163, "uuid": "b88a7f41-9fe9-438b-a181-7fb31002ef09", "value": "T1F9F41217A7FC9422E4B62B701DF312D31A357D619B3CC35B1B8F684A08725A4AA36377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229163, "uuid": "023d8b26-9750-4519-966c-df8b6fddabcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229163, "uuid": "57f41c27-a027-40a9-89b2-b26e0a902a70", "value": "12288:cMrcy90+zgGidfPtVnYqKlvNAE5tUOetsKd4UTRta7/ChiM9wsYyIYSl3:Iy7zENW5jHRKhiMJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229163, "uuid": "696c8443-a85e-4a70-9441-c2c6940ab8f7", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229163, "uuid": "3653dad0-64c8-4a49-92c4-85498159b412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229163, "uuid": "1838e931-476c-4b6a-8286-db0ecbfd4304", "value": "83082232e13c9d8c4bdf53250665f2ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400ce322-aaf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676219295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219295, "uuid": "825a011e-af29-442f-a62c-0bc9ad8e8955", "comment": "Malware payload (RedLineStealer)", "value": "e65d9e377244aeb0a60cb653f60b315d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219295, "uuid": "9ef97c68-aa89-4560-a15c-e39d8a146903", "comment": "Malware payload (RedLineStealer)", "value": "dca8f3bedff4d14276ff3621f6b171cac6cf4e4c3abe36beca67c6dee2ed03d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219295, "uuid": "f1285012-245a-4d66-8fa0-c33d2e24d2a6", "comment": "Malware payload (RedLineStealer)", "value": "e4c37f24ff84401d97ce3ec2520a60c11edcd682", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676219295, "uuid": "2db568ae-cd9c-448d-8066-5fc8cfa21b67", "comment": "Malware payload (RedLineStealer)", "value": "d8e6da018fb48ee623e27f52cf474f639d7bd31ce10e397c601ba9f758590ef94eb99005fd42ce2643885aada7f3169d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219295, "uuid": "7131d8f5-5fbd-4480-af6d-3b97c6f9d0db", "value": "T1BDF4124BBBEC5461F8B42BB11DF703C31A367D5199348257378EAC4D09B6BA4A63132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219295, "uuid": "0256f70b-90e2-4227-8c1a-bbdda0dbb0aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219295, "uuid": "39a7a886-8273-4504-a870-851444ea680d", "value": "12288:dMrQy90uLaCF6pVkrA/TvxJeNtDEVB11kO9qprp4usNPNB8/8J4afaNY:Zy9LHokrWTJQLAnZ92LsNPYUJ4afKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676219295, "uuid": "2b6ac238-dcb1-45e6-9900-643724d7ca79", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676219295, "uuid": "e9d2ef51-3f5c-4852-ad69-e3f32cf34586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676219295, "uuid": "23bd6d86-eeb7-473d-a372-97c4b4014881", "value": "e65d9e377244aeb0a60cb653f60b315d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac5ebdc-aaef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676218185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218185, "uuid": "8ffb0593-84de-46ba-93c7-ca5500bf9b34", "comment": "Malware payload", "value": "9d7204098694f4149e635c5341c93f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218185, "uuid": "e91b13eb-5f4c-48ff-bf99-d522c2ac6b5f", "comment": "Malware payload", "value": "dcb0a47e3b047ccf1c51f2edb936938c7b4537ea9d75b53d97df6cfcab702219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218185, "uuid": "6aa69d32-707c-4e3b-b7d1-59ccb8f4a1ef", "comment": "Malware payload", "value": "ccc6f909b4caa52103b4a1f4acc97eb594c92421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218185, "uuid": "c754ed3f-cd89-447b-b5dd-57545e5972ff", "comment": "Malware payload", "value": "c36931e34093cebad8eface130dd2339f527feb266ddadfc0254b2ba4ba5926449bcd75dd175e684e1e7a655cbc2ad43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218185, "uuid": "d6eca4a7-ff5e-4540-8ceb-03742794af03", "value": "T1A8F4120BB6E89423E9F467700CF706D30A35BD604638C66B2B8E7D1909B69B5E13473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218185, "uuid": "e2903d70-600a-46c2-9e42-b1ba4cd8cb76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218185, "uuid": "561317d1-0c9b-4c38-b599-8eaccdefa54b", "value": "12288:HMrUy90sWqKSnMWu0+d376rUFeJe4ysws9QZwsASXEP:3y3xMWGdYeEIwSXEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676218185, "uuid": "c12c6d0b-7635-46b7-bdcd-b39b6891ff47", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676218185, "uuid": "8663a867-7fec-413a-bcd3-822e16a40502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218185, "uuid": "3ca534ba-1e32-4ca8-a37c-be9806af1ede", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84973b4d-aafc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676223705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223705, "uuid": "4c226109-14ee-44e8-a579-4b0aeb4aa411", "comment": "Malware payload", "value": "044ada8c26063d57b5e2c402f3acc7a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223705, "uuid": "8697a847-46e9-4974-b6f2-38ea689e2064", "comment": "Malware payload", "value": "dcdbb1b2c91f8df190e07303fdb6639a9618e965d0b32d56d511b222c6c5d1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223705, "uuid": "088c7412-3b5b-408d-bc65-65ba47de747c", "comment": "Malware payload", "value": "5781c40483f3f72a7bd4aea2d8771c784afa0998", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223705, "uuid": "0532de47-c517-417b-a70c-917737feb1b7", "comment": "Malware payload", "value": "7944804a24a8a99f1a023c44be61c533b6de6899a87d0fba8c27b0b770efb50e193e506ed4c8323544313b366134d2d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223705, "uuid": "0418cc74-03d5-4f96-87b2-62e28a03fb08", "value": "T186F4121BA7E9C563E8F063704AF743C3293ABD505A38E39E23CE581658721F4A13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223705, "uuid": "53d3fdfb-565e-4650-bb58-e99e10a4d347", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223705, "uuid": "78aecd37-7ec9-4a69-9a49-109f19d1fdc2", "value": "12288:HMrNy906mvaftzO+/WTyMOj9w94YL+oreJZJPDcjVAnPeJ/yXCMcZXxTT//Nfa:KyevaftC+eTtOxfVFLwjVSPetnzTLNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223705, "uuid": "ea8e88dd-14e4-471e-9a6f-4c9c410dacc9", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223705, "uuid": "4ca9494a-3b33-4f5f-9862-b39ec0655d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223705, "uuid": "c27b8e7e-3924-4582-b2dc-9d12ca9bbbb2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce500ab-aaab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676188956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188956, "uuid": "dbbe21f5-62d0-469f-875b-2382df3eea03", "comment": "Malware payload (Smoke Loader)", "value": "ad65c8b37835930ead374d3105f0b0a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188956, "uuid": "3f1a97f4-e2d5-4720-ae9a-f9e738d5e499", "comment": "Malware payload (Smoke Loader)", "value": "dce05e55ba32734099b6acde8fb7468bedfa216c891668cff8dc52104ff0c738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188956, "uuid": "e084df26-e432-4b56-a17f-0a4af9e2c21a", "comment": "Malware payload (Smoke Loader)", "value": "36c45ccc27eca9d651deca7c24f2f8249d1a931e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188956, "uuid": "05b963e7-8017-4924-a0cb-c08b3c0e9052", "comment": "Malware payload (Smoke Loader)", "value": "1fa6412e9206db52614c4e5e6e36d74b3fd81de60190423e1af413e0dc2d0146d7e995ead5009a4b0794909452de1f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188956, "uuid": "b2bb0411-a756-4158-a19a-301c593446ed", "value": "T1D314DF11F6A28072C51706BD2875DA90BE6FB8B15B54C5DB330C36AE1DF13C28E7A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188956, "uuid": "4dfc809f-6035-4d61-a8a8-92fe93b09e8a", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188956, "uuid": "56070ac1-04a4-4a26-bfe4-d34ab8b60668", "value": "3072:PjqeqQ+0JiXqG5CIXHMfDvqEKJLZHsD/2GIlRLt9X7Yy67TJDY:PGehR3kHgchZHjlRLtB7YRTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188956, "uuid": "63756f0f-0308-4037-9e28-a33d48544202", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188956, "uuid": "d9075563-b35c-4fc2-8b88-dd028998b9e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188956, "uuid": "c0689528-0369-4533-b007-dd0373f50e12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16783165-aa9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676181859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181859, "uuid": "2a7cee2a-adab-43b3-ac01-3633732e1b71", "comment": "Malware payload (GCleaner)", "value": "ce6677463d646c5206581ebffdb3890f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181859, "uuid": "d4cc030f-4b80-4675-a1c7-333c80aa1b05", "comment": "Malware payload (GCleaner)", "value": "dd22ce2ab4f6ea15431785da25df6239e148e83016f5c150e7e041bd275b921b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181859, "uuid": "e07c0e77-ca13-49dc-a196-134417614c41", "comment": "Malware payload (GCleaner)", "value": "c4ebb12bda83bd95c6662020164bd435df256f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181859, "uuid": "efa39ec4-4255-4c45-949c-18f8ea6c0115", "comment": "Malware payload (GCleaner)", "value": "64ae909425542ba50a1b7e8b3ff88ba9fc1a2f820a0915e03c6365d1b52c880d0c3be49b6b635b68592f5395bc905b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181859, "uuid": "e71ec446-7017-4599-b16a-6188fca5a959", "value": "T15CF5123C7146D9ADC2D4FDB48C2A98E31CE76EE3A8E4906670D97F3F91BD184960910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181859, "uuid": "12b9212f-c46c-4c45-88f1-27053ed2c068", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181859, "uuid": "00a852bb-9dfb-4345-baa7-644e234be2c1", "value": "49152:rdHZLi7ArjMxPoTcWPNCNyRQAP+Rjt6FY9LuHrELJcGU23LCgv2MR:JHNiaM5YzUyRqt62LuwLJPDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181859, "uuid": "f95ad4a6-7a36-4330-84ba-505d58f4368f", "value": 3445306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181859, "uuid": "894e3e24-d7e6-4299-97fe-c93051f05849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181859, "uuid": "ad037160-7574-4c2b-a031-2cfdb49e42d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7905d65c-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1676212089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212089, "uuid": "adce3862-f054-45ac-94ba-049d914f3d26", "comment": "Malware payload (SystemBC)", "value": "bc0927b65c4fec62ba3bc1c9c932d27b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212089, "uuid": "378e5012-393a-4d89-8c05-041f9c13eda9", "comment": "Malware payload (SystemBC)", "value": "de049c4399bdbf4ada27184d44ee972cc95b4dae8f4f0a0cf796f53df3ce4512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212089, "uuid": "ab5519de-9939-4d32-af94-d6b6a58807ce", "comment": "Malware payload (SystemBC)", "value": "6d2c65d6e2be8bce931ac235dcd24450a5000a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212089, "uuid": "88efb9dd-ffdb-4488-ac80-6a2c706546bb", "comment": "Malware payload (SystemBC)", "value": "4014f3558a46c9a97edd316d53c9dd664e3ac4140066ed4c2ccfcbe2287118a2911f4e1f0048e78dea3d456c5b3f2542", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212089, "uuid": "3609d069-5540-4267-b456-9e1a208ada7c", "value": "T172F1F62BBD915153D327E2BF368F9329D8BF5A3393316409CFB14D2065B98A3D761409", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212089, "uuid": "ae2ea660-ce49-497d-899d-2b5cdbfdd678", "value": "9a23b632a1a60399574f160ad5f6cac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212089, "uuid": "6d62a68d-1d65-4613-b9a9-4db9862b78f1", "value": "96:kymr9/6A9BDW+tahe0+K/MM4odWLoO+ZuBoUymmrgIs9+nezU2FFxgDpCOM:kFr9/hDLax/ZbdFLNrgFrFFxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212089, "uuid": "a39470d0-bcc5-43ff-bf69-790a3a498318", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212089, "uuid": "d22f64d9-0bda-4163-8462-3e3b3830680f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212089, "uuid": "027204b1-c76d-4a27-8bad-f6162988554a", "value": "bc0927b65c4fec62ba3bc1c9c932d27b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec061f2-aaeb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676216313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216313, "uuid": "bb768bea-c88a-46dd-8011-1fb679df094f", "comment": "Malware payload (Amadey)", "value": "3482f5a23742cd53811a2e865e1cf4be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216313, "uuid": "f2d0db52-93b9-4029-9d8a-1cfa34b11811", "comment": "Malware payload (Amadey)", "value": "de6eab2e66af63bdb03d9832fed8a4cdd49c2b530ebb5a562177188edff84b4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216313, "uuid": "73af7ac4-dc58-4412-bf45-0828971b1ff1", "comment": "Malware payload (Amadey)", "value": "12b0118f472c473b190500f867533778391b7588", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676216313, "uuid": "724e1e16-930d-4f4b-8657-eb64f1067166", "comment": "Malware payload (Amadey)", "value": "b2ac80682bed6f2dbbd6f284b9e4a7d3313d318f62c47651b1ab670cff2d81f9cc61df8ceee6a386f25c768e4d4a2f87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216313, "uuid": "3e46dc20-49e0-44e6-931d-11c801e16d24", "value": "T125F41207BBDD8132ECB457B105FA03D31A363E91AA3483AE639E7C891C326B55631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216313, "uuid": "3199f45f-f8d5-4f1e-ad09-9bc4b2b384e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216313, "uuid": "8b97aae6-f31c-45a7-8d32-72ee748caf58", "value": "12288:IMrey90pG4fOVmmVFvSes5srxSQa1WeJXaysreqqQ+s:WygG4fO/VFOKAKy4qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676216313, "uuid": "fc184f0b-38cd-4f7c-b1b3-dd29b78539d5", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676216313, "uuid": "ffa6f7c6-e081-4809-8ef1-0f31a3d7a716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676216313, "uuid": "0b299288-ad84-44be-b398-d04830c7c3df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441b5bda-ab29-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676242924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242924, "uuid": "241ba4af-95f1-4d60-9f6f-acf5a563c0ff", "comment": "Malware payload", "value": "e98311331f930001c801d981f6657a89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242924, "uuid": "d37c7903-1dc0-4505-a8f1-ea2da7ef7cab", "comment": "Malware payload", "value": "de7076afe2253c72894047b04d65e5eafc75ff3f4df8f65812b77a25008bd7a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242924, "uuid": "d18a2eab-8170-4851-bf8e-829313c9ed87", "comment": "Malware payload", "value": "41923a5e511949111cfce231be3e706ffd06b784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676242924, "uuid": "a2ea80b3-f48b-41cb-b15e-e6768c06a96d", "comment": "Malware payload", "value": "97bebde2bbd8c3ad1a98d48d6a20395b4d5e1e33273e4df63bfe9edbe32bc7a7fe8ea7617ea78f3bb57dab2bc5d97491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242924, "uuid": "cfa7d325-5fd5-49ec-addf-001ca7bbf653", "value": "T10804CF1179A1C0B3E527AD746931E5A0593FBC72E7B1C4DB33041A9F5E302F289B9366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242924, "uuid": "ed948d99-dc63-4c13-acad-c5e5c9ddc4cc", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242924, "uuid": "aca33ad7-8b65-4186-b8f8-e5f70f3bcc7f", "value": "3072:WINZ0oL5HG+scukV47X32HmE8OLJowBtHfhxDfNo3NVJj:FvVHjR4T3jOFXFbDm3fJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676242924, "uuid": "59316e7b-4264-4e30-abce-aae03c1edabb", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676242924, "uuid": "22385415-ca46-479f-bf83-a2ea698be7e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676242924, "uuid": "13327b2f-d7f5-4b82-a195-67253c180ca4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dcc922-aad1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676205096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205096, "uuid": "862139a7-cfa2-4ecf-95da-cc76e6f0d728", "comment": "Malware payload (GCleaner)", "value": "56b9cb2f180e0e95f817a444a22033d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205096, "uuid": "2747acad-8bcd-4647-8a2f-5522cbbf7d6c", "comment": "Malware payload (GCleaner)", "value": "ded476ca707092f4f6db121a94cbfb60197b225061d3dea3b3e24f6d47ae342d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205096, "uuid": "b9fa4476-829d-4e16-b220-05e0b02511ca", "comment": "Malware payload (GCleaner)", "value": "37d8177576ec0b44e5928dc00a22a2ae06c86ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676205096, "uuid": "d50dbc6a-df8e-497b-9757-ce2dead0ad80", "comment": "Malware payload (GCleaner)", "value": "9466201940189d2eba41075758ded87797ec091dc94d395b2f719f69446886f1119da55c08719f499ed2b9849043eec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205096, "uuid": "c29cf876-197e-4f01-9ebb-29b016eb032c", "value": "T1BAF5127D7111C56DC1C0FEB48C2A98EB1CE66DE3E8A4906370E97F3F51BD2885A0A51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205096, "uuid": "12a88fca-3219-4ba4-94be-62f4393bee11", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205096, "uuid": "3a1bf58b-1427-4cac-a05c-26a746f2ac31", "value": "98304:JH68JDa6Baflf7UzaU2as190PTFRjWDqt85uUqMG4v2MR:dRBUf7kaUFsX0PLBopqMG4vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676205096, "uuid": "4ff4d7fa-d3aa-449b-bb6c-2b73901374a5", "value": 3649465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676205096, "uuid": "98df14bc-714b-47cc-80cd-de3402e46b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676205096, "uuid": "9d55c8aa-f54e-442a-92d7-de5031a5b18e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7679f9f5-ab2e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676245156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245156, "uuid": "9b7a8614-7a9b-4fcc-a7a8-6534a23ba88e", "comment": "Malware payload", "value": "6c97a892cda03679d0e779972c79f695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245156, "uuid": "3475be10-5c56-480c-80db-a3bb60811aab", "comment": "Malware payload", "value": "df1a42f825140f4d9866b0d20b42bfa63e0f2ac9a5801774c337ad0307450cb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245156, "uuid": "1131ea77-1984-4a8e-b90b-5832f49b2828", "comment": "Malware payload", "value": "3381df898475e8e0f674a41d25d107ad0cc5178f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676245156, "uuid": "85b6ec6a-cc63-4451-9561-2d466565eb17", "comment": "Malware payload", "value": "4e312a4c2c7d54da6c74f94407ce43b21d5fe23b8b29bd2223998274a70c8177a782c22149695628d1913f554dec5afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245156, "uuid": "0ef4e4d6-9adc-44da-8815-10653ac5d46e", "value": "T1AE04D01C3AE18833E5E755792931E6916A3ABC32AB64C4D733441B6F5E306D38EF8316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245156, "uuid": "3588acad-3ac8-4d6b-bf8d-d7bf11068b96", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245156, "uuid": "5a700ee1-c716-4e4a-b34c-84f29c822503", "value": "3072:PU8ZbsB5HWt4dTJgpmyCAmCBNFfJyIzQ12QFoX4:FiLASMmydmCBNFPzQ9FoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676245156, "uuid": "abec6748-5c4c-4f24-8cda-3412c0f07e34", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676245156, "uuid": "af79ac95-0968-48f4-95ff-91f43d249457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676245156, "uuid": "e7a63f82-4594-4523-bf5b-96571bba20a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7682d4-ab0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676231687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231687, "uuid": "0f428808-48e8-4478-8304-1e4dfc60028c", "comment": "Malware payload (Mirai)", "value": "77acf1514425fa76ad604c665deda3ef", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231687, "uuid": "ccd1f52d-2345-4182-88d3-991b89ccf8a6", "comment": "Malware payload (Mirai)", "value": "df514233cec90ff921b3d3599244c0a077e7724e6e13af8603185b17e5c27367", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231687, "uuid": "6f5823e1-18db-46fd-ba24-8a98d53a2fd1", "comment": "Malware payload (Mirai)", "value": "e26a70de670bab3e2c04e3376b52fd916ace50d9", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676231687, "uuid": "2e93ab2b-2e93-4dc5-860a-864a93e728a2", "comment": "Malware payload (Mirai)", "value": "09ae5fc5ff0c5155a0d877270b875843910857ddaf882a84399dd9673db1dc1df226469d7829a42dd55b48e6f4113280", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231687, "uuid": "2d20f3d6-03c0-4549-902b-1f77fc4a8f58", "value": "T1EF2302B48816F626C2B1487EDD585C83002D3770A1D53419032E8665C3FBA9FF5F9EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231687, "uuid": "b196127a-86ef-4daf-b6d0-92f409a18c12", "value": "768:2Dv09+jiChImVhQJ/hBPP1fcyrHg4p66P5jRBD0TmHvwNpZCpZtuQWl8XVBcHu3+:6v0xJm4ZhBBHTp6A5dd0S4rZMZtuHlKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676231687, "uuid": "fe671516-8f0b-46f9-819b-727e3ce06af5", "value": 48388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676231687, "uuid": "0ec0e7db-2d84-4bfa-a5d8-7f5b62cd86a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676231687, "uuid": "1479416d-9b57-4eda-a76d-eb4c1c768aaa", "value": "log21.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2c5c02-aa8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676175909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175909, "uuid": "63ab20e7-076b-450e-bdff-629bae5ea819", "comment": "Malware payload (RedLineStealer)", "value": "44721b1c1a3eef0f92fbf9063701a571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175909, "uuid": "df0c2fd2-c755-498d-ad9d-8fa8382f47c7", "comment": "Malware payload (RedLineStealer)", "value": "df7509c4cb5ee685b7cbc335d2962796ba029f3297ef2468710d0da274c3503d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175909, "uuid": "491582e5-047c-48d5-95a4-193d46044a2e", "comment": "Malware payload (RedLineStealer)", "value": "b1279c7b36bd33dd88be6f1a8ec552353545b06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676175909, "uuid": "5881107b-e91a-4408-a539-52e66997cbbd", "comment": "Malware payload (RedLineStealer)", "value": "aa486ec720fbc504a4b8412ecdc2dd49313153ea2f7ba307dee91833c1804bf7f44ffa14575fc17f2b49c282306a8bd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175909, "uuid": "5442c658-213e-413e-8baf-b55b82b5168d", "value": "T174F41213F7EC8032E9B997B01DF203D3193A7E225B30876B278A6D5D19726B16138767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175909, "uuid": "b90822f0-a55a-41b9-b582-67ab26f8a294", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175909, "uuid": "1da5eb6f-f87f-442f-9253-c8beac3d9ac8", "value": "12288:3Mr1y907DcLvVu6o1CNX2p6KDcLwhMBPeJG2Ai6T8Te+Cf7RctUiAP:OytbVu5cNsjewSC4i6ahCf7Rct5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676175909, "uuid": "72630321-ba75-4f37-8b52-deec7a534892", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676175909, "uuid": "6f40d1a5-ba28-4434-9be9-6182081a28f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676175909, "uuid": "118957c9-88ed-4e3a-8965-7bad9c0f7cf0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e7d489-aae5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676213635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213635, "uuid": "5779903e-f1b7-4b05-a059-76fe47c7744f", "comment": "Malware payload (RedLineStealer)", "value": "1cb5c583756c46ecea81cc0a61b88d93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213635, "uuid": "0726b92a-6ef0-430c-8b53-392efbcc6e66", "comment": "Malware payload (RedLineStealer)", "value": "dfbca902423ad0c0b53e3abb0cb4e57b3ee266cb4eaec98b9baf4b107d19ccd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213635, "uuid": "a818de91-76cd-4342-ab0c-d5bd7be44879", "comment": "Malware payload (RedLineStealer)", "value": "a67c6b95dae32bab95a9d212250520f3b70baa57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213635, "uuid": "ae0ec8f2-7f3a-42e8-abc7-2dd19260941b", "comment": "Malware payload (RedLineStealer)", "value": "cee12a35c1076083a96b074367d86a8be4440e618c0650009ccd5ed8775d393eee6017b76695f90c0a45dd1670c24a32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213635, "uuid": "482e42b3-b177-485f-83dc-aeb019906681", "value": "T1AFF4120BF6ECC436D9B44BB018F24AD31A36BD625E38535B628F6C4D19B2171623477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213635, "uuid": "cb33f483-91f9-4773-90b8-7a376a1b5d5a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213635, "uuid": "1cdefa05-4498-4bbf-9049-fa55dcb2bcd1", "value": "12288:QMrzy907kBV7WSIE+BRIdHJdrTmTGPRctfUvYFTn5fLpnEhjFUZk5slk79mutyi:zyCQV7NQRUJdmu2fUwFT5zyjrqk7Xsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213635, "uuid": "8dba369c-01ce-4208-9e01-6ca51c99ae0e", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213635, "uuid": "ae9808bc-adbf-42e9-9925-cc54268e7c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213635, "uuid": "04b5ec1f-0e89-432b-82ff-2c39a3eb28dd", "value": "1cb5c583756c46ecea81cc0a61b88d93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc4fa20-aaa6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676186726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186726, "uuid": "c16f21b7-b8e9-4bfc-95a4-f868a9dcde1f", "comment": "Malware payload (NanoCore)", "value": "cb32cc6026943b8ff0e7dc0247b7170e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186726, "uuid": "64fed9a2-3bce-4958-b279-e685e7d2f8cb", "comment": "Malware payload (NanoCore)", "value": "e0291120d9a153c405fd95ca06cdff4a821837a0da3903e9f38b0e71d3132622", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186726, "uuid": "0f24846c-9168-4bf1-8e9e-d439a00012d5", "comment": "Malware payload (NanoCore)", "value": "08f0f7d4e445caca649a0f510839610d210b77ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186726, "uuid": "fe42c4d8-c96b-41bf-8665-18ab5cacd4e8", "comment": "Malware payload (NanoCore)", "value": "88b077b9a784ad0239329cb323fe97e841da389eab0df3de68633d47f423f4bfbe0728f1fc097365064f3c4632fe37d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186726, "uuid": "388eca83-d9b2-4491-8859-882bed24766f", "value": "T1B8158E6337B099B2E78721B104387B9C5BF07513BE56E2938BBB37C06785DB67298142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186726, "uuid": "d8fb40d0-8afd-4633-828c-6965930553bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186726, "uuid": "c8806ef2-b113-4690-bbea-edf9766eaf4d", "value": "24576:xeSqG4yPacEg2+F+Gy6cdIL/B2DVeG6F0xM:aRgHoPIL/B22Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186726, "uuid": "c52f188b-5f1d-443b-b318-a34753a8d7a8", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186726, "uuid": "f738f21d-9cb8-4380-b0a0-143bb7c9b92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186726, "uuid": "294693bc-a4a8-4c7f-89e2-0bc506fd0169", "value": "cb32cc6026943b8ff0e7dc0247b7170e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff7a0c9-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244259, "uuid": "35d4b8d8-1911-4da7-8abb-5f59d9907d39", "comment": "Malware payload (Mirai)", "value": "43ad44f962146da266acb2c165d328d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244259, "uuid": "85bf1722-269d-4284-b7b9-b51790f9f8e7", "comment": "Malware payload (Mirai)", "value": "e083fa594127642480f7492f47f130a0a489800fbddf8d2111c9afb4d6306680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244259, "uuid": "6b78a718-7a4f-44cb-a176-01ffa958da88", "comment": "Malware payload (Mirai)", "value": "f4910ec2b08e86edba5cafb5021659eb5e0678f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244259, "uuid": "6b5bfb53-88cf-4f28-ac95-fd94032f2c24", "comment": "Malware payload (Mirai)", "value": "b7c231c79f7160ca69a44fc4c222206164be19a61923df7b8d1a2bfe769e9c7137fd4a84690e1ec97854ad9a4406ee53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244259, "uuid": "447caf42-7cc1-44d9-bb34-71826c19aa25", "value": "T160836A25BC7A2E13C0E4B43A22F78325B1E5274D25A4CB1DBE760E4EFF256A034535B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244259, "uuid": "868e1e64-cd53-4c26-a772-c335fd0afb92", "value": "1536:zeIyCrSUituCVEFcZWhCBqZ2mOsXEoHqcEY0ANIZ3:z5OPEcYpZ5OcEoKcErAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244259, "uuid": "019de40f-5657-47a0-b927-73b62098493d", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244259, "uuid": "48e66640-bc8f-4741-8970-2cca4f4bb0e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244259, "uuid": "4f38a69a-6bdb-47a1-a0eb-5b4db8a21b1f", "value": "43ad44f962146da266acb2c165d328d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73326fa1-aa7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676168270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168270, "uuid": "4db10be7-bbc5-4f30-a672-de9f505e3b56", "comment": "Malware payload (GCleaner)", "value": "7af705d886a454b5a4c0ab1015b2b668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168270, "uuid": "416190cf-6217-4bad-b530-1e7864abfdea", "comment": "Malware payload (GCleaner)", "value": "e11d430c234edea9e19b76396a617111256a3c80383ce2dbb497861e6c9da27b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168270, "uuid": "d5315541-8a05-463b-a148-4ded6687f7db", "comment": "Malware payload (GCleaner)", "value": "7253411e73b9f30e75dc654a319820c0b49afe14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168270, "uuid": "e40c3818-0bb7-4417-aa94-555e892b7b65", "comment": "Malware payload (GCleaner)", "value": "17b6b97677f40d8f2497107bea2b27fa8f8b7cc1ff7834a9414573c193bf34fe2e409fd5940acca45082d84c354f8008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168270, "uuid": "8b008d40-2464-400a-95c4-4657fea097b1", "value": "T135B5027C7145C86DC2C0BEB48C3A98E72CE66DE3E9E4A46270D97F3F52B81855B0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168270, "uuid": "11a655ca-b531-4ec1-be6a-89dcecd17999", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168270, "uuid": "c2bc92bc-3d5a-4d31-bf4f-443961a99c72", "value": "49152:rdHTDsM5VUN3nUGsPIJE/7uP9SOpcanErX/Ph3kQceCbLKbLCgv2MR:JHTD/TUN3U570czkGCbLWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168270, "uuid": "9a0418e4-2ac2-4637-b8f0-faa843742d18", "value": 2463569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168270, "uuid": "799255d0-b113-4903-b45d-909946ae0b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168270, "uuid": "a3e4a9f0-4496-4382-9a4e-662c443787b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1cbfa6-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1676229816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229816, "uuid": "a3963ff8-160d-4a21-9001-78b93d8db47c", "comment": "Malware payload (Nitol)", "value": "7b1f03fb9936f72548c7d006eabfc310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229816, "uuid": "a40021b8-59b9-4780-816f-b31ac5bf6ee8", "comment": "Malware payload (Nitol)", "value": "e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229816, "uuid": "1fc342c0-b270-41ed-9cf8-466487819ef6", "comment": "Malware payload (Nitol)", "value": "66aef8129896c6e6dd36b2e3abadbbce7b4d51d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229816, "uuid": "5436cade-8915-4f11-9548-ceca2007ad45", "comment": "Malware payload (Nitol)", "value": "4b8e09968dc8ababcaec1b98af0ee728d88ba2b50d023e1d995de3d4c59524b768553846b761e72c0dd4e9523da0967d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229816, "uuid": "89a9bc29-cb30-453b-9799-5efae53af318", "value": "T1A41512C5DE7811B6E2BB15B0600760CCDAB41DA10E7CD8BB43E60795BAF13B8B576683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229816, "uuid": "f0bfdd9b-fadc-4304-a7ce-b2fc2923eafe", "value": "320ffb3ead7d13ea9d4a4b7814c6523f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229816, "uuid": "b6617630-1a4f-4180-80d7-fdc86f168489", "value": "24576:b2c2oVEmdgUwB4qM742kyxzDL/KHYAmCS:ac2osByEby5DL/Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229816, "uuid": "d652b56c-b7fb-4d05-8331-a31a9e148520", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229816, "uuid": "b74ac3e3-3e9e-47ba-804a-2184047e94fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229816, "uuid": "95298634-cc2b-45f8-a008-c4f698bfdf70", "value": "7b1f03fb9936f72548c7d006eabfc310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8884d18f-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676212115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212115, "uuid": "8f87ccda-22cb-4873-ac78-d8c87de7a7e3", "comment": "Malware payload (SnakeKeylogger)", "value": "6a0853e4d03c66b400464152a9872dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212115, "uuid": "840af4e1-6131-4ab1-a479-c6e7a6af4730", "comment": "Malware payload (SnakeKeylogger)", "value": "e175719a9c226b9ef410b3ec21354f6efc4d7d540825f4fa9f2a62912d97cdb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212115, "uuid": "9a69f001-eb8f-4ffb-a98b-184b43cb5715", "comment": "Malware payload (SnakeKeylogger)", "value": "4c7b90b521ca150dbf1a0661c527b5fbe5130f0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212115, "uuid": "0a0f0730-a007-4418-b719-3e2e85414011", "comment": "Malware payload (SnakeKeylogger)", "value": "89966e8bdac9f64930d6647bdcf6aa5f8703653273fa1bcadf9e3f0f8b03b4f59f2484a5575da232ae651884ea660a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212115, "uuid": "81220815-3d6e-40fc-8f4e-4d951a468af2", "value": "T14A1512A0B2F3CFB2CDE50AB2D4F24D3923F1A69961D3E70CBDC11661AD13794A9492D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212115, "uuid": "d849c251-5034-44a8-9dcc-6f3db9f03de7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212115, "uuid": "624c1f9b-8ccd-4e31-b8d2-ffddea62f357", "value": "24576:hfMUueDYKQPSDmegJXeIiWVZJlC7+vXq7LEUF6X:2UueUd/ZfiGJlJfSLfwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212115, "uuid": "2da2dbbb-c006-480e-b0e0-c18d81b99a7c", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212115, "uuid": "d8626276-a374-4319-a7d8-b6e649fd2bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212115, "uuid": "a5763808-ee03-406b-9fc8-3894043a1522", "value": "6a0853e4d03c66b400464152a9872dfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e83a08-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676211914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211914, "uuid": "21f983c8-60f2-47ce-8464-d159e324e296", "comment": "Malware payload (AsyncRAT)", "value": "4e37d7cdacd6f2f1fd4bba48a6705705", "object_relation": "md5", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211914, "uuid": "b51af671-0388-4d89-b7c5-aa7a92f17a47", "comment": "Malware payload (AsyncRAT)", "value": "e1a8cbec6916b9b07c41afa1d37b9a8d20aa1ccce0d04d7d2971100d72540d98", "object_relation": "sha256", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211914, "uuid": "54a5c6d4-2927-480c-8e61-18e62b02f131", "comment": "Malware payload (AsyncRAT)", "value": "75196ee0753bce1d388528659b29561046de99e7", "object_relation": "sha1", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676211914, "uuid": "781e7877-d2db-4b0f-aa15-11e05836ab5d", "comment": "Malware payload (AsyncRAT)", "value": "431bfdc4d1f51a5ce5f198c107721a2991c50b5318970f87c23c24d6e823b8f395e5370cda4bf049b5247d2892a67966", "object_relation": "sha3-384", "Tag": [ { "name": "138-201-81-121", "colour": "#8D01B0", "exportable": true, "hide_tag": false }, { "name": "144-76-65-183", "colour": "#C900BE", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "FakeBinance", "colour": "#EC0324", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211914, "uuid": "4fb6234a-fb7f-443b-b9ae-ede1ea8373ef", "value": "T13F95F13195947ED5FFA90D0620AC051B3FF005CB97BE3688E71A7F4ABBF2984691B064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211914, "uuid": "3e7a2cf5-6548-4fa6-946c-390cba270ee0", "value": "24576:Sj9+381kQDOl4H/DMQSfUs5r3FyvDmcpZ64hmcHS62y2M6v69ePIxhAt:F81Av3WDTHRmA6i9eGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676211914, "uuid": "98f98c07-d14e-4632-b052-efb42d413fec", "value": 2028947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676211914, "uuid": "44067b3e-1143-4bd1-bbe9-8a8fd0ed965f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676211914, "uuid": "3714e699-3cec-4024-8628-2260820a1fe9", "value": "28.01.2023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8cf775-ab02-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676226104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226104, "uuid": "33dad185-6d5e-4aa7-98fe-826477c6fdac", "comment": "Malware payload (Amadey)", "value": "5dce169bbf97a66c525ffe55b6f24a12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226104, "uuid": "47288b98-1f71-4fca-95bf-443a4989f73c", "comment": "Malware payload (Amadey)", "value": "e21d57cbb204f532554bb0ec8f6d580596362b4c6edb30124cc94b62366e0811", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226104, "uuid": "3b6a493a-bed6-4459-b324-9886121ca08f", "comment": "Malware payload (Amadey)", "value": "2920052f78973c76ea61b4423f13e286e9757838", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226104, "uuid": "ec9b4632-009b-464b-bf95-461d2404fec9", "comment": "Malware payload (Amadey)", "value": "35889ea5e2d3c697501b909514ae64f72ad8d0f0f37a933a140ff62438519699c3bfaf784f4e82f3b3e57756e575aa4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226104, "uuid": "141c4f5d-358c-4186-b023-702ae0a77a96", "value": "T164F41207B7F88422E9B1BB7055F203D31936BE615B38D25B238F9D5A0C720A9B631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226104, "uuid": "ea19685c-05df-4242-b416-e5e876109808", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226104, "uuid": "6a8441cc-87ee-4477-9fc1-e466a1abdd70", "value": "12288:mMrly90NFT9hWRVQYEfHcH4MJQHk7Dpfr9leJMPmFzBrJDAoncPeo/iXbIEece2:LyETTyV1JQHUR8s7ocPekFPD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226104, "uuid": "f6fd4955-cd1b-4bca-92a8-ab83cf3cd51e", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226104, "uuid": "8b3c3fc0-05cf-4a3f-86a8-8af9e6e13544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226104, "uuid": "88b3c2bd-51b1-469f-b42c-e54f90904aac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dc5280-aaff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676224831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224831, "uuid": "07b3ed27-8518-4cc0-bd86-a785ed1d5cb0", "comment": "Malware payload (RedLineStealer)", "value": "461e9e2acb75438e669958f5b317d473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224831, "uuid": "7dd61ab9-ae35-4095-9507-52b3358ca7d6", "comment": "Malware payload (RedLineStealer)", "value": "e249b5368ee003c62f1458b6e61e86acf1f7cd81abcfbe3a1d22a6a3e2ad4afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224831, "uuid": "6a029d72-3aeb-42ca-ba34-70c0d237a9c1", "comment": "Malware payload (RedLineStealer)", "value": "e96964021b6c81d1ac959af313d466804d983739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224831, "uuid": "a0d5c6b0-0ede-413a-a945-f6874443d2e5", "comment": "Malware payload (RedLineStealer)", "value": "cf861c564ba86d601a1d26e816ebd03ae4472688795e5b524bf5bac97f4b5ccee0a7ff902eaaa6ca2ac65357fed32471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224831, "uuid": "290bbfb8-20e6-4399-857b-aaa2b6a59c37", "value": "T1E9F41207ABD49162E874A7B01CF603C30D393E515B38929F9BCBAC5D58725E4B232B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224831, "uuid": "6150fa2f-fcb9-4b68-8037-369920d3de4a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224831, "uuid": "9302d10c-ac2c-4254-b0a9-e47393004048", "value": "12288:GMr2y90b4AaUIPTWX1Az77w3bkfQ/AzzeJ9q33bkI326V5PeN/vXrPgo4iou:4yk5aUIKX7BooE3wQ26V5PepzgCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224831, "uuid": "fee07210-a6b4-4744-8dc5-daf7becf7eb9", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224831, "uuid": "7776f930-21b1-4ae3-9a50-01367b704b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224831, "uuid": "b00aa4eb-9d61-4c11-8afa-c7cbeb6c654a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d56f6c-aae6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676214152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214152, "uuid": "10f4bab5-ee8f-4d34-9e35-74fc72f4b70a", "comment": "Malware payload (Smoke Loader)", "value": "f7939a50799a524d23fefef088a71317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214152, "uuid": "15e9e0dc-8892-499b-92ee-dec02f416abb", "comment": "Malware payload (Smoke Loader)", "value": "e37ae8d9066fa8238f2197da00c89b5607c6cca41c05d385d1ba82531385f228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214152, "uuid": "26591209-5500-4641-9470-d90493ffe68e", "comment": "Malware payload (Smoke Loader)", "value": "27363be02bf634d233ba9e43678e5dd9318c8aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214152, "uuid": "2231c520-3ce9-4ad0-b9d2-034dc3ff0875", "comment": "Malware payload (Smoke Loader)", "value": "4b595ed4231d410930e6f125cb72fafacb2a733d8f327afbc5ba247fc0fdd196206ea62cd6d0a801458ae50d0917834e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214152, "uuid": "30dfc396-339b-45d2-bb21-a0186bc8af1a", "value": "T1BD14D0117EA9C072D59787742822C6A1A57FBCB2776180C733581BEFDD303D18A7A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214152, "uuid": "ed818228-0606-4855-a3d3-fcacf416c03a", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214152, "uuid": "bd6de848-74c2-47e5-8f4a-a48c7dc93341", "value": "3072:z7Cg+rGQP5i2W5XfSuGsfEU32XN7z4OuX0RFQWUpKCQhuFc:P3LJJJmsH32XNwtOQHKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214152, "uuid": "76f14cf7-0162-40b0-8ab2-f2a902e1793c", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214152, "uuid": "ea151c95-d7db-4926-8ef5-4d1211a6e57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214152, "uuid": "0ec79ff9-7e43-4461-91b5-57143a94daa3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa94ffe6-ab03-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676226909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226909, "uuid": "c4f66f33-d7a2-4302-8229-39dd598eab27", "comment": "Malware payload (Amadey)", "value": "5394c78255755edf4db0e913774bf6fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226909, "uuid": "353ce25a-137d-4c19-af3a-6a14a1e10eb2", "comment": "Malware payload (Amadey)", "value": "e3a3192b19f4869340049ccf74bbc215917885061fac55da097a1d24192ea56c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226909, "uuid": "88921fbd-4076-4945-b54f-eacedb3a774a", "comment": "Malware payload (Amadey)", "value": "685f87963f82e39a86787e4dc456c59500f60542", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226909, "uuid": "ffaaf5df-de58-421a-b0b8-e1ffb77af6d5", "comment": "Malware payload (Amadey)", "value": "d2a91e4160cf69c2cc1b6e5dbc3aeb984f8243d2cb2e87976581edaf9e7c4218b85c6e11e29a21167038a5e8848a1526", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226909, "uuid": "f6ee3392-355a-4dff-9627-512b10233601", "value": "T1F0F4120BA7FC9833E8A5173019F703D3163A7CA05B3482A76B8BAD5D08725B5B635367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226909, "uuid": "f539018d-2bcd-4032-9e0b-b2fc29dba36a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226909, "uuid": "db481cf6-d049-4cd5-8485-bb4234537178", "value": "12288:hMrty905jx2Cxww52nAR1lPj2HMT4SeJ0hxrPel/nXG/Yeo:sy+xF5oARHjaWrPeB1eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226909, "uuid": "a6968df3-aed8-4c66-bc87-0f4d4ffb7ae1", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226909, "uuid": "526656b9-5320-48a7-8c00-2d455661eeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226909, "uuid": "ddb2c0fe-e1f6-4717-9cf6-97ea4de6ffd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dbb6ea-aab8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676194627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194627, "uuid": "771928cb-922b-40e1-b4e6-fb8526ef91b2", "comment": "Malware payload (Amadey)", "value": "282c03f57c03d4bc6717a1b3e413a4ba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194627, "uuid": "a954ee8d-037e-420e-9b09-d5635370bf71", "comment": "Malware payload (Amadey)", "value": "e3d803544c3edaff128a750f59d3c12ae823cf5b931984df163e39e055a28a64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194627, "uuid": "a43b74c8-9a22-4ee9-9943-69d046e3abde", "comment": "Malware payload (Amadey)", "value": "ffa93566fb631884289a8b17ff7c15ea462208c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194627, "uuid": "53a6d72f-8af8-4ad4-a5b6-f53aaa15979a", "comment": "Malware payload (Amadey)", "value": "8a59ff66bb13e4471ee9f63695957efdbb474d645a7c7a01ba3be7e87d837d80b12971fd329b96989007558278518608", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194627, "uuid": "5faf8bb3-bafe-4946-9041-2f049ddd4862", "value": "T1FCF41207BBEC9032E8B5677019F207D32B36BEA11A3883A6575F9C590872674293177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194627, "uuid": "f3ad62e4-537a-4a7e-a038-ab51e59acfef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194627, "uuid": "1f1426d3-c612-46ff-b71e-cb5fccd2ba2f", "value": "12288:rMrBy90Vmo8/VMXNvblfILCR0f4nbYWMSeJkB1GDdIizhsSl8Iumk8:KyPoiVGiL740tkB1GRbW+l7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194627, "uuid": "d717c962-d023-4867-8a5e-c33c5bd3ca8d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194627, "uuid": "d78c2c5a-5a23-48df-acb1-28b2805b7ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194627, "uuid": "0a182bce-c385-49f5-b38c-e44667570f61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1362f01c-ab0b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676229957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229957, "uuid": "7d32bfe5-9bf4-4905-a490-ad628ebd3a7b", "comment": "Malware payload", "value": "ecc3da68c97555659a3bf906fa76ee37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229957, "uuid": "c31339dc-64de-48b3-8964-39a89dd1e03f", "comment": "Malware payload", "value": "e4e8ff14746cfcb6b724851bff443d219c2be38d34147b4f14dfb8935c74a584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229957, "uuid": "5aef6741-0d85-43fd-827d-4cf8758a76e1", "comment": "Malware payload", "value": "84696359247d3d3c365090c18903b09c56c3db45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229957, "uuid": "4ddaf949-b487-40d1-9467-139fbb9e3986", "comment": "Malware payload", "value": "84418ab8c37c9e371bd63b42c35af3d120eb5e68d05303bfc44cb2df15aa5b73b80fdd20aad90b60db07887ac6b5082c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229957, "uuid": "9bd67059-2af2-457c-b93a-aa027b7295c1", "value": "T1BAF41217ABEE4022E8F457B15CF607D30B35BE611E38435B638A6D191CB26B4E2353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229957, "uuid": "a77f6e10-0833-4920-8763-c54913e34d40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229957, "uuid": "0fea8e72-3135-4636-b991-43a9aa92ed95", "value": "12288:eMrHy90vDQJnOSrgYSvZtdJOKc1MipeJN0Y4Qcg5a5WfVqNXL4yHrR:JyoDcW5c1S34ya5CqVprR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229957, "uuid": "2daa2ae4-f21a-4b94-a584-1fb41d575dac", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229957, "uuid": "f1dafd9e-c26e-4f3f-8165-761b9a99a0e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229957, "uuid": "3eba2578-058c-4be7-b0d6-da9f8708d48d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937384c6-aab5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676193235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193235, "uuid": "ba0b9701-7e53-4406-bf38-26aedf183b09", "comment": "Malware payload (Amadey)", "value": "b78e0458511e604f3eb22819769a7a1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193235, "uuid": "7f0786e5-45d1-4a3a-b020-b7c63763a0d0", "comment": "Malware payload (Amadey)", "value": "e4eef4b028ecdedb39a1dd7f553f378b89a3bd8924dc939bca2e08666b5381f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193235, "uuid": "678e3f56-32bf-4a7f-aaf5-56968c032dd9", "comment": "Malware payload (Amadey)", "value": "5e9d4571970c7824fe7d14a244dd6eeef0baa256", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676193235, "uuid": "8b9f82cc-a314-4e4e-b93f-4288b225ce2d", "comment": "Malware payload (Amadey)", "value": "c73fdd77240e139bb867ef9462268ac1f6bbbac30a338fe5bba912b4b635ecebf02b43f3ff93923d4a2cb9a5c6feec92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193235, "uuid": "80236522-2623-447f-91d5-c01145d2cc80", "value": "T1C3F41207BAE8D122E1B413709CF607D31A357D619638836B278BAD5E0C73AE0A771767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193235, "uuid": "79d72020-66e4-4738-bb06-dc7b63d50c1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193235, "uuid": "8a37ed21-1b6f-46c1-b795-4d10f18af1f3", "value": "12288:qMruy90yO4/BgMkNsNhElck4w1QHEEeJFy14dL1yZoEIuo7C4JbQ:syFO4WNsT4cklnFa4dpyOp177W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676193235, "uuid": "89addfc9-ca39-4937-a4a3-f0b647660a8d", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676193235, "uuid": "5664215a-45f8-47f6-98ec-d7f6f671fba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676193235, "uuid": "54d17d0b-b9b8-4e84-9642-a34430258eb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3738fa4f-aa87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676173324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173324, "uuid": "5e721a7b-3d8d-433e-af1e-9d6e5a13f8c1", "comment": "Malware payload (RedLineStealer)", "value": "7df72bb1f975808bdbed3492142bc6e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173324, "uuid": "436c6ead-796f-455b-a846-a40ae722815f", "comment": "Malware payload (RedLineStealer)", "value": "e52a728445980bbefc1bab5d135628ff57196f2e65b9dfd3c990705d7bd6b4ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173324, "uuid": "ae242f56-af99-494a-a36f-db706e5b15e5", "comment": "Malware payload (RedLineStealer)", "value": "a4de51dbcfe3128bcec0f2c2d2ff541949ef42f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676173324, "uuid": "7e02b2bd-b420-40d3-950d-b2dd0ed18f0d", "comment": "Malware payload (RedLineStealer)", "value": "45d01a6915992a090b0235a13c1ae39a6ad09237f565803e6eedd1d316015000d0369b572a3751d882caf035ab76d6ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173324, "uuid": "5c2b3b5a-8ce0-4259-b168-3ead1a563b8a", "value": "T14BF42307F7ED9022E8765B7069F213C31E353D625A3883AF678E6C9909329B471317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173324, "uuid": "ecf14820-3e99-4061-acee-e1913cfd35c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173324, "uuid": "076d31ce-fb94-4606-8a86-8948d99d7ba1", "value": "12288:GMrZy90SKJmVcoTyY55RKIvO0/KBssB54JxeJrLVde6k6ZW4SVyZRlI:vyzVwQ5RHvO45SrRf1ZWV0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676173324, "uuid": "80c18244-b004-4ee3-8711-7530f3a34884", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676173324, "uuid": "281a0aff-4001-4c89-bdb6-65325fbd31eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676173324, "uuid": "ea4b30ce-fad7-436d-870f-cb7e9bd6da10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2e0544-aaf6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676221003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221003, "uuid": "452fec02-1e04-4d73-bae2-dac28471290b", "comment": "Malware payload (Amadey)", "value": "54aabaa8639e5f14d6e829a89d1680a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221003, "uuid": "829a0da4-3e00-4096-bdd8-6b116fe71011", "comment": "Malware payload (Amadey)", "value": "e541b0e557fc2c52e8372effd4a4c36c13ec393ca37dfc2f5612be72446106e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221003, "uuid": "5183e481-055e-45a2-8a8b-f5056d9eb381", "comment": "Malware payload (Amadey)", "value": "8a1eb0f7a6f66d302bf841ef13fd5c86af3f4056", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676221003, "uuid": "e1e642a4-3c77-4ac8-8b42-beae8f43e129", "comment": "Malware payload (Amadey)", "value": "ddb517111e0dbf5ec98e3b1b24cfef166d73e2a77f7bf3184200175ecfc9dc64f403f5f330461282ccace4f3242b8e17", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221003, "uuid": "89b96a80-9dec-4c81-b241-b086247b9241", "value": "T153F41207F3DD9122E9F41B7018F702C71A36BE502A38921B678F6E4A0D727B166747A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221003, "uuid": "61e1a456-2ecf-409d-884f-a815c571ea3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221003, "uuid": "cbb63e4e-8962-4e48-b02d-44af23b960b9", "value": "12288:KMrsy90nyBBUnO/kFikCH2Zl/YeJsYKj+MPirh3Ef5jeqkS:Wy/BUn8kFnlhsYKjOufdkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676221003, "uuid": "ea51ca97-71b9-4f6b-9402-4e138f8ec3b3", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676221003, "uuid": "c7f8157e-1d54-4c2c-a9d7-9da63d9dec26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676221003, "uuid": "a7dbeca7-3169-4d43-b34c-0652c452b95b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7384d422-aac5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676200054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200054, "uuid": "9f3761e8-1941-4658-9ee2-9340368d2a46", "comment": "Malware payload (Amadey)", "value": "219095b5eb9c4292e00c2848e9c73a76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200054, "uuid": "8e6f8d28-f903-40cc-b987-1aa60e4deb6e", "comment": "Malware payload (Amadey)", "value": "e57dc8f3707b1a9bb2bfb82ed410c1c7733307d3015d5bfde3185fc624778414", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200054, "uuid": "afce2bff-b3b4-48bc-a9c8-6ae5972336d1", "comment": "Malware payload (Amadey)", "value": "06e4ee5f78be2c21b55214ce51634e3f0f2e3ef5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200054, "uuid": "c271af9b-662d-40ec-8e30-5de4ec398261", "comment": "Malware payload (Amadey)", "value": "d1a798be61d6ce3379b0392cc657020856b622d029f77e946d19bec8835a8d2409f6d3a5e9fdec7e464492da2e5d0ea7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200054, "uuid": "27c578da-b00f-4514-9b86-9a90ad74970a", "value": "T156F4120BF2F89022D8F563B018F702C31A327D605738835B63DEAD6A5D756B0A93576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200054, "uuid": "bdf800f9-a123-4e01-b037-7c3353331c66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200054, "uuid": "c4435a4e-7cba-435d-afa7-28c535a3f592", "value": "12288:JMrPy90FBdkqB8GwNZI0Gh7T0Pjpp7YRR0w0FJeJQyPjsP+piVF0pyG80IkzhelS:qyfVPa07zY2IQiiVSpyGbpclHmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676200054, "uuid": "95fc5a6b-c9f9-4941-baaf-fc5d65fcc7f3", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676200054, "uuid": "9ca14cc8-bed6-47dd-afea-36ad2adae9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200054, "uuid": "87032cde-2c82-4523-aa3e-9e3b73d17a01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfeca3c-aaf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676218885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218885, "uuid": "e71bd755-daa4-446c-a9df-61a0fd811275", "comment": "Malware payload (RecordBreaker)", "value": "9a3375c7b1bf70cf646e5bffe22ae974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218885, "uuid": "655b4c8a-bc92-4ad6-8e2e-a4ca024864ea", "comment": "Malware payload (RecordBreaker)", "value": "e58277ef012927b9d2edceb826ec6150a81ec6ddc91ef8c82761f38102727c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218885, "uuid": "c35d23b0-ba6a-4f21-9c58-b4a0dd457261", "comment": "Malware payload (RecordBreaker)", "value": "aa56b0b7ffa8968b9a6aa762365d673d27db8580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676218885, "uuid": "f3f5b455-9fcb-4c89-8fff-21bfe3869900", "comment": "Malware payload (RecordBreaker)", "value": "a872edc5d4ad8858d24c3654ab2b45860998025a05d86498d2d22c7919f23a49dd0070a1e10a6e32bac986f55e543e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218885, "uuid": "3fedbb64-ad8e-4203-abd0-770505a106e5", "value": "T16E14D0117AE1C073C11B48B05062DAB0AAEFB8B16B95C1C7334C9AAF6E307D15F7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218885, "uuid": "1a8267e5-0475-431e-98e6-2bd5d6d5166b", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218885, "uuid": "a75136aa-cc36-4c6a-a17d-fefbdeb18c2b", "value": "3072:A733+rGt5iRkedWWOHFJ4HkEtkeYoJSZGT20oLxy2jiSqE:CnLCRxHOHFJ4q+SZE3oLg2GSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676218885, "uuid": "18960b33-15d1-4e4c-944a-017444ed3c8b", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676218885, "uuid": "71f537f2-03a3-405d-a1ed-0c273e0a1668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676218885, "uuid": "aca958e7-549a-4f05-bd7d-a5ec6d84548c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a7854f-aaa5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676186426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186426, "uuid": "a5f05b36-bbd0-4fe8-873b-c1b9e2c609e1", "comment": "Malware payload (RedLineStealer)", "value": "ca8943c39c83362a45b0f2bcb964d681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186426, "uuid": "376cd3ee-9700-4a86-86eb-b21edd2f747e", "comment": "Malware payload (RedLineStealer)", "value": "e5aabd432ea35e8dd632d6c930c84f1896a86eeca31ee0074c42771c3dcb8d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186426, "uuid": "83728530-9aad-4774-9462-9ec33d36fd84", "comment": "Malware payload (RedLineStealer)", "value": "d57ec32a15ad99e2dfd929d0ee2e4ff1cc5c9127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186426, "uuid": "8bb4c63f-ca14-4e43-9f0a-18cef3424773", "comment": "Malware payload (RedLineStealer)", "value": "74759a5fba42cd4d0bcd50ca21ba6528929b2daa288f051141c02735f18d32169a9e2a6f6f21265f0bc307659b9aa0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186426, "uuid": "18cbc80a-cb2b-499f-aa96-2028fd2727b0", "value": "T177744F42AEE95A58F2F5F83F0061CB1050E9783D6A57AED23C29BBB507C4974C62770B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186426, "uuid": "48fe3367-d0e3-4940-9c16-70d98951a60f", "value": "f56130a002be4d36c5e35790a357b9ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186426, "uuid": "86fa9b2e-0264-4f38-b087-b7a053c66665", "value": "3072:WfgbNatEUSqWB7f6vdJeonGJvbENN4m4huTPkh/2ol7MFny7zfaDzST0Tj593MT:Woxc7SpB7+Utvm4oTQ2jKT4j598", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186426, "uuid": "c7cb43b5-1776-4d31-9c08-f9f4d2dfdce7", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186426, "uuid": "f688a90b-8993-479b-a446-5393e11b338f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186426, "uuid": "91eb9ce2-afef-4369-b40e-dff84e918204", "value": "ca8943c39c83362a45b0f2bcb964d681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9949390-aa95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676179636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179636, "uuid": "58024667-c39a-4722-b64b-36242a17a903", "comment": "Malware payload (Kangaroo)", "value": "2521b704b6aec30809ede4efdf437940", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179636, "uuid": "6ab82d9f-1584-42ea-b653-9e176f9a0ccc", "comment": "Malware payload (Kangaroo)", "value": "e690f3be09edcf2cb8eaf63b00347ba3a270dde857d70d5705734012a1b8c3e5", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179636, "uuid": "f98f1398-e5e5-478d-b47a-ed5e10ea0bcc", "comment": "Malware payload (Kangaroo)", "value": "1e03c4afd8c2854f7ed897d4620d9bf6e18b1037", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676179636, "uuid": "127cb504-6c7b-40ea-859d-d480f943d2ca", "comment": "Malware payload (Kangaroo)", "value": "e15e71bb69b24f92e6d43369fe8855a2b5105dbf42fd7d4802c4c7a975c98956f83456c6a6e25cb50e3872632d1d28a2", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179636, "uuid": "fa6971e1-6f37-4170-9432-f6eff3fcb411", "value": "T12C82F8471FF80966FBF2DE7014FE6846C17B782AAB39EACF0614580819B15A0D57C7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179636, "uuid": "aabd0914-4721-47f7-aef9-ec44d64636b4", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179636, "uuid": "54bc85c4-aba6-44c6-a469-f1693a61cfe6", "value": "384:19uTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zF1WwhWaWhb:19u9CaxEovcm/BCvXFpgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676179636, "uuid": "b930f4e7-635e-4f61-8921-27e16e425a55", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676179636, "uuid": "c9744136-7d2c-467a-b3ca-a0cce497ac0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676179636, "uuid": "06e6ddf5-289b-44ae-9ef4-e686df143377", "value": "2023-02-11_2521b704b6aec30809ede4efdf437940_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57bee27-aaa2-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676185239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185239, "uuid": "837c0226-3989-4d96-bbfb-9d780c17616b", "comment": "Malware payload (ManusCrypt)", "value": "539bfe2e8d608d2d76e17158dec4fb6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185239, "uuid": "bc2d5cba-4f98-49df-acea-b9423df91f8f", "comment": "Malware payload (ManusCrypt)", "value": "e6a503c99e5afadde39a9927346470a6476458682ed8f536c95d79feb3896f90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185239, "uuid": "f0f6ad0b-b9b1-40bd-9f25-93aacff7e6e8", "comment": "Malware payload (ManusCrypt)", "value": "43949b16088e2a182c02db614828e25ce559cdda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676185239, "uuid": "2e96d4f4-d70f-4dbe-9dd9-387e1915e85a", "comment": "Malware payload (ManusCrypt)", "value": "43918e310f7b987427fdfba717285c3e8834587277c0ef0af3d42d876c7ee853fef4fb4aad7385a0d0a0720f628290d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185239, "uuid": "c491e7f7-7f5c-49ec-a98a-d4a71d6602d8", "value": "T1C114DF1136A2C0F2F25786F11831D6A16A6BB8B16766C5CF33051E6E2D333D18E7A3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185239, "uuid": "e28de190-726d-45ed-b536-de5f8d02cfcd", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185239, "uuid": "a6227f3c-a203-4d08-ab6a-0f5418c1acb5", "value": "3072:Vjq7u+0J71m5CyfG/WAlDih+Tk8NEBHIyP3MHwhfm7TJDY:VGaRjyfnAls+REBHIbKWTJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676185239, "uuid": "ca653cbd-1f3f-48ff-96cc-5dd51c78853a", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676185239, "uuid": "c94f7385-0573-467b-8d3c-606b2c10eb11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676185239, "uuid": "efe44293-ab86-4436-97aa-361d71efbb03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df002ea-aae1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1676212151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212151, "uuid": "19fd442f-7441-4706-9b87-c8fc51ddc204", "comment": "Malware payload (Matiex)", "value": "ad9e2f6721193598cb32a4db4fde4161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212151, "uuid": "c2d9af94-df16-44a2-9ae4-14b0ef905ec1", "comment": "Malware payload (Matiex)", "value": "e7465dd8e5586b02206eb42b4e814d2cfe0df1af6b8295507c741f0d04f59a8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212151, "uuid": "daf56cb1-bb43-4d99-82c2-33f0a229ae06", "comment": "Malware payload (Matiex)", "value": "c387c92a11336fd6011a0e9eeea0110a89132385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676212151, "uuid": "aa60eff7-a8aa-44de-a2a7-a2500fc87df0", "comment": "Malware payload (Matiex)", "value": "0ceb524fab09326307ea2285a7823d422541746c3b7157defe99040245557069cc2a9f9368a8951c58f9b14b650d1649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212151, "uuid": "6939f2e9-2b39-45e0-9c67-a4025ff231f9", "value": "T101D40191A32480ECC46BD1B4CA046627DAB3746817783EEF4BA5CE614F23BD5F43EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212151, "uuid": "6f08cfaa-395d-421b-b5a6-bee0dba1e019", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212151, "uuid": "414588ba-fe33-4fc3-8f43-535ebe05cca9", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676212151, "uuid": "6e71c9d9-d4c4-4b9d-863e-733953d6302a", "value": 655490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676212151, "uuid": "7594f012-2a5a-4572-ab3d-b81a4ea083db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676212151, "uuid": "f6ed2e38-389e-4112-9a00-01ecaaed80b4", "value": "ad9e2f6721193598cb32a4db4fde4161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd0ee45-aaf5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676220583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220583, "uuid": "d610bdb4-5595-48ed-bd83-12f1058d279d", "comment": "Malware payload", "value": "6f73d7da49102283506bb1f2590ed496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220583, "uuid": "0149d6b5-307d-4947-bc83-2c834c021856", "comment": "Malware payload", "value": "e8548eec6e50f72e578b00c7004811f6478f53dba43ae6f5e115af8946f83c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220583, "uuid": "e22eaf15-53a0-4517-bb40-359cefb9723d", "comment": "Malware payload", "value": "8381a0ad8abef4a8a40e678a90d811afae15ce01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676220583, "uuid": "13d32c5d-ddf8-46fe-8192-45646d75b376", "comment": "Malware payload", "value": "d4aaaa608eec10e19f9663887ade1c069e24bb7409661e725e31132a495805195ffdbc2676d79f9ecc1028d4e82d4642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220583, "uuid": "dc543c4a-c83d-4beb-bfe4-88ef584d3857", "value": "T1F1F4120BB7EC5822E9F66B700CF603D319363D605A39925BA38E6D5D0D726B2713472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220583, "uuid": "5da6e5a9-0a25-4e4d-9337-f57a2f396251", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220583, "uuid": "8a0f9173-be11-46f9-ac0e-4bc519673f4c", "value": "12288:lMray90HyKVNuVxwVfQ5MRGAfyDOcG4MFfkeJPwQ4sGLaCD/gRYna/Mn:fyiVUVURGPGhFtIQ4/LXqH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676220583, "uuid": "cde9bb46-d4d3-4111-907c-c07922e0efa1", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676220583, "uuid": "7a99f569-f784-4b52-a490-a0ee2e232ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676220583, "uuid": "12ca5203-d19c-46ea-af6e-48e2bd6fd7f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0b3df5-aafe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676224734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224734, "uuid": "b55e8aa5-292b-40c5-a2a3-a5271d99165e", "comment": "Malware payload (Mirai)", "value": "7495d31d894bc02db5cd288b6a4b6150", "object_relation": "md5", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224734, "uuid": "d74a6ca8-25f0-467b-9257-0029fc045f6a", "comment": "Malware payload (Mirai)", "value": "e892f2e92635f30a7329926d07df05160664f6667e5731cccdf5fb30690b50c9", "object_relation": "sha256", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224734, "uuid": "59660f9c-412a-4a41-aa8a-cf0c13e90e81", "comment": "Malware payload (Mirai)", "value": "1eee45ae68d336929cdfca52ec85c1a1473f138c", "object_relation": "sha1", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676224734, "uuid": "ca0cc413-8bb1-43a8-ab3d-0ee60db84dd9", "comment": "Malware payload (Mirai)", "value": "4cd2b7ca6d7c3a28c2463a133a2cb87d02c9efa1e61f168677c9a38eaf617c57be1616939e4fd8a819ced9c06a6315c9", "object_relation": "sha3-384", "Tag": [ { "name": "Akur Group", "colour": "#312ABA", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224734, "uuid": "a9016554-265c-40b5-b6f8-5770ade21be7", "value": "T10D13F167CBA54A5AA62BD33164397BCD5814F616C8688BE297D470E52AD5F3F3C4C0C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224734, "uuid": "80f21700-7bb0-4091-b90a-1aa993605a91", "value": "768:wVV1xydkW8OvBFJrzmIip7Vpt2PdvfWqPLzLbvHjv1cT3F4TD4NuznbcuyD7UHQc:wr1xydtJBLriIiRLS5fWqnvDv17agnoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676224734, "uuid": "832693a5-2a05-4dfd-ae5e-41e852f54251", "value": 43664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676224734, "uuid": "43622ea6-b906-43db-b9e7-ab8c27e0328d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676224734, "uuid": "2cbe9cbf-7a61-4373-807d-517dd2437a59", "value": "log21.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d51976d-aac2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676198808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198808, "uuid": "a1c63a85-ae53-4893-8664-0039a46d7517", "comment": "Malware payload (GCleaner)", "value": "d9f04f830205d909f4e317229694f3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198808, "uuid": "6bb6e142-49a3-4e71-af10-90b3b555716c", "comment": "Malware payload (GCleaner)", "value": "e8948dbbe3a6f1e3979fe666eada32fbeaae3a012d385e4b982f4369357d712d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198808, "uuid": "6e5817ce-2aa6-4f65-bc54-60311ebdd7d5", "comment": "Malware payload (GCleaner)", "value": "e8afe86286a59bdc89ec7712b43bd94f6ea60e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676198808, "uuid": "a8c7f394-fc8b-424c-bbc7-a3ab86c1c635", "comment": "Malware payload (GCleaner)", "value": "b65c8ca8033c1d7724633139205ec3a10313fb8d99a43bd5bfccbe8753e579c3e37f4ec5369d3787c617c7a3b2282bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198808, "uuid": "c6879297-7720-4f40-9113-9ffbef725527", "value": "T175F5127C7105C4ACC280FDB8883A95E71CEB6DE3D9A4A46371DCBF3F42792859A1A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198808, "uuid": "3542d962-8f61-4621-a317-13099b0b05b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198808, "uuid": "8de25567-ec6f-4cb4-b40a-5d12ff0568f4", "value": "49152:rdHOyzjEmDbuij3Kkef3QoSGOVKIBwT3Yhw3rDkFP1QmfSLMT3MEIWgLCgv2MR:JHOmELiOlfgobgKHn3fkFxP3TIv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676198808, "uuid": "000967b3-13bf-4e5c-8508-b09bfca13d5b", "value": 3438500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676198808, "uuid": "1658ef1e-e97f-45cc-9e18-6d8d72d987d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676198808, "uuid": "4cefb97b-262a-41f9-92f3-f76e53943756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8627b776-aab0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676191066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191066, "uuid": "bbcd05bd-a11e-408f-90fc-9f22d15b3054", "comment": "Malware payload (RedLineStealer)", "value": "4e2d4ddaea50548ff2728f6bb8a1e5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191066, "uuid": "6feaa719-b037-45a9-bc5f-ad13ace9ff7b", "comment": "Malware payload (RedLineStealer)", "value": "e961d1e5fdcab1f4154de635fa221f1368c36fb39ec230e0f6090695529e517a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191066, "uuid": "975c67ee-7b99-4f8a-857f-3a9b9d983852", "comment": "Malware payload (RedLineStealer)", "value": "b422a03d232a8b61532a38627d8d60c39bfc3ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191066, "uuid": "d518f650-383a-4bc5-baed-7dd414e7f580", "comment": "Malware payload (RedLineStealer)", "value": "bb28a911ecd433a1c54ea70e7468a7abd29cafea6f75f0cf7f98f70bf7ae129b451bf2d0aa5cbe50a7daff1ab0e38143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191066, "uuid": "3e02bbd4-1a4b-4343-900c-c9cde561593e", "value": "T1DF14DF263FA2C073C15B46B61430DA81AB7BB8B15B95C1CFF318165F2E302D29E7A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191066, "uuid": "c62c57e3-2af3-4e9f-b1c1-68b5e7e508d2", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191066, "uuid": "ed051c29-dd61-4e01-a1e7-12bd816b434e", "value": "3072:Tjql6+0JdnG5Ckf95wyZJKGplAlGO9bD7Sn7TJDY:TG0RPkf9qyfKG7CZ4TJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191066, "uuid": "e2b86eab-8c7f-4012-a389-ca8473016d9c", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191066, "uuid": "c770f3a4-9ece-4cde-be77-ea93b44ee5ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191066, "uuid": "fdd9fc27-ac37-4beb-bd73-e05039dbd611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b135147b-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676229792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229792, "uuid": "e24ce56e-e8ce-41d3-8a96-a8e7475d705f", "comment": "Malware payload (RemcosRAT)", "value": "b9958280d7974182504bcdfbe56698f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229792, "uuid": "785b9bc8-8879-4916-968e-cd2fdc454731", "comment": "Malware payload (RemcosRAT)", "value": "e9b9ee1dc81aa5f6446ae52d861ae97fd211a3ccf58746e7154ce384457d3460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229792, "uuid": "5e19aacb-5d7e-4906-b04b-d594e4f4d78a", "comment": "Malware payload (RemcosRAT)", "value": "5620831c28fe95fdc43a5688765f65489dca4ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229792, "uuid": "3a53b809-9a27-4c61-81e2-68194c73970a", "comment": "Malware payload (RemcosRAT)", "value": "6d2895436ff5bbc792b7f241d28014b15028222ce10fc38b03944984d7d7b83ec10a03a7e0b7a0904fdf977f585161da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229792, "uuid": "81359e7b-5588-4745-ac79-d12d377b0c26", "value": "T1F235025C6CB4D711C26CC2BE86A36635E3BB7E93B486D7290D9271CA0CB43E2505CD9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229792, "uuid": "21146b91-7e3f-4547-81f9-f37fc5232051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229792, "uuid": "2a8114be-b695-407c-b298-2643a31d1822", "value": "24576:/HCtn9BoO/NeSQlQXD+YJH5gtOLdxKR5IIkU3XrotWbLgZ2KvEN3ZZ+7:EwKiGHWt+dm5IjULotw8r+a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229792, "uuid": "037c6e2a-9aa5-4f79-8a59-669f01c0689f", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229792, "uuid": "8ecb7bc9-3771-4282-85fe-e26c2345b94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229792, "uuid": "3545ba50-6eb7-46d5-b44c-f5004673f9ef", "value": "b9958280d7974182504bcdfbe56698f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a484b2b-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676229566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229566, "uuid": "fc6bdb8b-0538-4697-b69e-5adf2c425407", "comment": "Malware payload (Quakbot)", "value": "cac0391efe9142563c0ddf9324c438ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229566, "uuid": "47180333-8a93-43fc-bd58-4519450697cc", "comment": "Malware payload (Quakbot)", "value": "e9c26d64eb7f949eb5032fdec8b40ff8de51ddbbc3550570afaf60d0b145127b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229566, "uuid": "ac59621e-a423-4bd2-bb7c-a5a48a314e90", "comment": "Malware payload (Quakbot)", "value": "df0602c2abf759771d9295a3ed81bbfcaeac0259", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229566, "uuid": "b01cc003-e97b-41a4-8001-8114211d7e99", "comment": "Malware payload (Quakbot)", "value": "d412ceeddca28558a7f5c22803106f76f39a1254e67edfd4da69c7719f79698d028a094da7d181e1f923702144c64257", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229566, "uuid": "04e3a0c2-6150-48ff-b4ba-37e17d581300", "value": "T13C940805B792873AFEC7E0BF0346829A9A74627BA433501E6514BD75FB303B1716E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229566, "uuid": "29416f80-4619-427c-b377-b7bd54de85b3", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229566, "uuid": "672faf2f-ad32-4044-b8d6-eb5cdef2a27d", "value": "6144:Iubpx1ymed01f3UBRxFoNgKIlp6Ydc2Zo5QLxZ8Ex6kmh08PfJO8L:XN8d0dkfxFoNgKIlbdc2WQLy28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229566, "uuid": "bc4864bc-5397-401b-97e7-85e3b5b08a85", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229566, "uuid": "95b992ff-d281-45cf-8825-1985aa75f3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229566, "uuid": "a739e2bb-0c9a-4574-b788-bfe82401b362", "value": "cac0391efe9142563c0ddf9324c438ed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c416fa-aa8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676174556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174556, "uuid": "f90f9417-ac66-4b94-808f-d4a3c5330c0e", "comment": "Malware payload (ManusCrypt)", "value": "35681210de3f848707e16d15fe032f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174556, "uuid": "7ee96433-b11a-42b8-85eb-39efa11b5e1e", "comment": "Malware payload (ManusCrypt)", "value": "ea00e7aba317832fe7ee630e343d633389da5e1c1b08b4c1e41e77d2c80e242a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174556, "uuid": "693752fa-c49c-4437-8de9-e1020216bc94", "comment": "Malware payload (ManusCrypt)", "value": "96e93d496cf56b837e95c6c4d30f8731500f30a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676174556, "uuid": "d8e48c73-ce3c-4b82-89a2-9489a5fc2b9c", "comment": "Malware payload (ManusCrypt)", "value": "fadb7602ee162949c9fd480cf59ee094b7a81df629dd7dc2fa959350e1fad8140a4b913ce9e3cd33c5e3e326b79b7633", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174556, "uuid": "67c898f3-4ce2-4248-a404-5c653c80adb8", "value": "T10814CF1172E180B7C59F45BD2420EE942A6EBC7297A5C1DB374817AF1E313E24E3A35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174556, "uuid": "2cce9519-1f78-48b6-8787-a2ef41985771", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174556, "uuid": "0d3f277d-55aa-48b9-b328-d2bc04456ed4", "value": "3072:+jqAO+0JVTq5CZQAteEfe4uk/PB8RKo9TiwOKI/Fw8btG:+GNRvZQIfe4YRN9TiplK8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676174556, "uuid": "ac5a7232-9d61-461a-a2eb-270614cf17bc", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676174556, "uuid": "51980ae3-c5f7-4ca5-8e9f-8e4841f259f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676174556, "uuid": "0a122b82-5207-452b-ba6f-a31b8b9e362c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71872367-ab2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676244288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244288, "uuid": "e6582d9c-0213-45a6-9c0a-61e749469f70", "comment": "Malware payload (Mirai)", "value": "ab994a79ef471f63bb304220470b13c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244288, "uuid": "9e0ebf81-0bd4-4023-b5e0-d4acd1b8a7eb", "comment": "Malware payload (Mirai)", "value": "ea1028e0decc99f12704a59ae95caa0dd6fb345e82c5a59536a35a43b81eb762", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244288, "uuid": "c911b974-aad6-4889-a7ad-d2db20ea29d7", "comment": "Malware payload (Mirai)", "value": "1e1129c7d967b2163b63eeedffed16b941e27b0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244288, "uuid": "f70860e1-cabb-4e10-b71e-56ff4221c8e2", "comment": "Malware payload (Mirai)", "value": "b1c22c0eae43cb2a78a2c5271105df9048f31aabbc3924adedbfcdf805257d1a682fd1a6a8708cc0936526386df2dc40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244288, "uuid": "2cbac065-e7b6-4157-aa99-b3bc3b5ef196", "value": "T1648329B81996B77CF9F250B5F44320DA28A10A1C379CE1E3B9936076FFB4708B169D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244288, "uuid": "63f42895-e5f3-4771-9104-cad3a0fb22fa", "value": "1536:RFsqdPA6xChpzOWYbgABe2Gx7v1/WGQlhyc4po7o:Xdo6xIz7+Be2g1/WPycCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244288, "uuid": "8780f357-c338-4207-a6c8-79641c48a61d", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244288, "uuid": "657b3192-5312-4689-9081-01aa3656687e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244288, "uuid": "27704726-5a2e-451f-b11b-bb70c01650cd", "value": "ab994a79ef471f63bb304220470b13c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d490db93-aaf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676222121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222121, "uuid": "8b986d59-6bef-4850-8b42-623bb246b3d0", "comment": "Malware payload (RedLineStealer)", "value": "b3a58e6362ab9bb522206ca83778b84e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222121, "uuid": "0a852a71-dc4c-4c3e-a682-36ff9f158864", "comment": "Malware payload (RedLineStealer)", "value": "ea4e804e68f2593d3ada18fe9e5cf26754e6a5349e862d77028911d3ac613333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222121, "uuid": "f53cc354-ee30-46b1-acb0-fc2f6d9f769b", "comment": "Malware payload (RedLineStealer)", "value": "82a0dd0d8d5194b23a7fbe30c90ba2ecd2d52a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676222121, "uuid": "01e0253b-28ef-4c79-af7e-f97965c43e2b", "comment": "Malware payload (RedLineStealer)", "value": "30ad3d858183f68dff7c155d6c5c6a0ac808023759474ed44596c98299e6e44c39c914d9b981d58f5e0719f8f0fa9236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222121, "uuid": "3d6a53e8-6306-4350-907f-e25a4372f109", "value": "T13314D0117AA59072D11781B06421D6A4BA3FBC736BA3C5CB334B1B2F2F313D15A7A396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222121, "uuid": "44a8b658-b1fe-4bc0-8a09-35c860250b3d", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222121, "uuid": "3cbc0fd2-d793-49cb-8bd2-1bc684dc3e87", "value": "3072:u7mD+rGx7FW56HpJA6pA+ah5+QcCFfYh6N6ioHdk:wALdHnDm+ahLfFQBio9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676222121, "uuid": "4427bced-f851-4ed6-b696-9f3b47a5b544", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676222121, "uuid": "125acf9f-72bc-451c-bc3c-56f386fa8080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676222121, "uuid": "43d33959-af97-4c35-8588-7297b3bb8c58", "value": "b3a58e6362ab9bb522206ca83778b84e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5878a538-ab03-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676226637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226637, "uuid": "82d47a36-c5a9-449c-a510-363345d81773", "comment": "Malware payload (TeamBot)", "value": "8d79aa9eedc8602ce960887e9bf87457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226637, "uuid": "84e2262e-90fa-40cb-b550-1355a111f636", "comment": "Malware payload (TeamBot)", "value": "ea7e4df834e94fcbc429656a14079d68943b23791382d056825497e35f7aaa4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226637, "uuid": "6371354a-d423-4da6-a1e1-6490d54fffe6", "comment": "Malware payload (TeamBot)", "value": "ca7b96e78b7df53219c6b29d286f4f1a59fcdbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676226637, "uuid": "569b7119-d16e-46f2-a985-6a0c51c2a48e", "comment": "Malware payload (TeamBot)", "value": "5817fd78ce473c96fd3d4a39e604461ef0547be78368a8eb9d387e556e5c37fbee2ea2cbca117683bba0cfbead365d2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226637, "uuid": "52496e13-c88a-47c0-a978-30ee281422d3", "value": "T18314E0117A918073D15755746821DAA4AE3BBCB26B91E0C3334CDBBF5E313C19E7A386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226637, "uuid": "b6935de8-b063-4720-a656-8af5278d4db6", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226637, "uuid": "f36f94f1-5fa2-49a7-bf8a-7b208141e52e", "value": "3072:z7PY6+HyU56CdzjpVNRWjKy5qrxbVWzhZp+cIT:PrCYCbV2dIrxZEZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676226637, "uuid": "07ed091b-88a4-4442-a1e8-e3e93723c305", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676226637, "uuid": "bde7584b-4d7b-437d-9344-b25306dec1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676226637, "uuid": "84c3d92f-6d6f-4a12-911a-dba7533f516a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192bc048-aa71-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676163824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163824, "uuid": "5b6bf612-3e5f-46b1-8ef2-a84b0b60f668", "comment": "Malware payload (GCleaner)", "value": "73a3b1f7bc4db7fc1f07bcd99e63ac5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163824, "uuid": "388d1548-7fb2-452f-b29c-cedb42ee45a1", "comment": "Malware payload (GCleaner)", "value": "eba2ba557e1b44e4f95cb4631597f5317e80997153f31868042722f9b14c953e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163824, "uuid": "18f265f6-5318-46c2-9e55-f6472ab31a17", "comment": "Malware payload (GCleaner)", "value": "d82383b2e03237990b3a7c5507a2945a6f67677b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163824, "uuid": "992ec80b-ab52-4786-b415-6d18e03ca1f2", "comment": "Malware payload (GCleaner)", "value": "7082fab6729a2a7d351abe2191cf8aa1c988dc80aa45806716b883586bceda24478210721131876cca8919279266e0c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163824, "uuid": "eb801cee-6a3d-4652-b473-84e1b9284e0d", "value": "T169B5127CB145C56DC280FE748C2AD8E75CD62EE3E8E4A02670D87F3F91B92849A1E517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163824, "uuid": "0b965d6c-3060-40b9-ba07-80e73598424d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163824, "uuid": "6db5e68b-1bff-4c45-a87a-36f641a84b60", "value": "49152:rdHXkXyrQt39kmiZa9+PsgfPAzsjuISHIOmLCgv2MR:JHXkiktNBiZu+PsgfwhfpWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163824, "uuid": "2d1298d1-2a5e-4687-960a-fa5855ec362a", "value": 2434392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163824, "uuid": "5cc31fd3-8bbf-492d-87ca-c372a07f51dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163824, "uuid": "acebefda-a579-4f2f-bf92-6df881f2550f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d1b26-aac9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676201662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201662, "uuid": "9b142457-b99b-443f-8811-f5f2bd368e26", "comment": "Malware payload (RedLineStealer)", "value": "369106594773c80b1809e90cc62f0288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201662, "uuid": "476468a1-c7f0-44a9-8d48-63d81230d7b4", "comment": "Malware payload (RedLineStealer)", "value": "ebc4c541aab0b1aea85b33a1972534c3ff3f14dbd5822dc3ea99e7b688f4edc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201662, "uuid": "7a88def6-4b5b-4b4b-a693-edbf4e8c2732", "comment": "Malware payload (RedLineStealer)", "value": "656e03fd2c609e2d753b8275c1d451dd0536be06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676201662, "uuid": "a365312d-b7ca-4a2a-a7d3-cf8e50749740", "comment": "Malware payload (RedLineStealer)", "value": "293c259e96d2b8e4433356c44c712c4ee53101f13e0d42643ceac11ba4c186831151580886dcf94b8df45f3e3c7801fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201662, "uuid": "910cec77-4170-4e20-b750-623296ea7495", "value": "T1D754F1D27A9281B3C25B82B46975C754AA3B7C3163A5C1DB230C171F1E713E24E7A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201662, "uuid": "e7671df3-1ce4-416c-8370-54c8622d4a3d", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201662, "uuid": "525900c6-99d9-4948-beba-44a15d15fdfe", "value": "6144:2oFJjLov0xeWgfMIII58MeID0r6oTiguFKMu:2CLHeWZI5jDK6silFKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676201662, "uuid": "9c14318c-172f-4362-a25d-1d80d63660d5", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676201662, "uuid": "e0bc29cb-59d0-4833-81ad-9a44d33f9061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676201662, "uuid": "51a6932c-9110-48ce-8720-25f8b1826cb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f3b215-aa81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676170939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170939, "uuid": "2f072e4e-fc18-4ef6-aaa7-fd490a18c007", "comment": "Malware payload (RedLineStealer)", "value": "c68d8aa0f82123d6e69422e670b408e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170939, "uuid": "8d0b3b6d-b3b4-4ee4-9655-66f19125bcd9", "comment": "Malware payload (RedLineStealer)", "value": "ec63016a18ad43654344796f50c48fb0d1335adc8548b073f37a419ab1835a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170939, "uuid": "fb418117-4c53-4e0c-a6cb-fac5d2bc3a4f", "comment": "Malware payload (RedLineStealer)", "value": "cb9636916c39b8b7b818c59f51eed0dd3292e66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676170939, "uuid": "0eceb02d-f959-4b2f-83e4-dfbd2629eac1", "comment": "Malware payload (RedLineStealer)", "value": "7b9b2d5dabce4a95af233f766e5374638660ba7643554bfa64b972f596c531d1b2806326c3b47bfee15fd81d24b667ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170939, "uuid": "3af88948-d9a4-486e-acfa-411b06d3c121", "value": "T1B254F02176F1C3B3C5A245F56936EA916A3FBCB197A580DB3379016E0E313C18E7631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170939, "uuid": "e244823a-640c-49b8-978c-c5ebf9205d33", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170939, "uuid": "b3fc2f87-0088-4d59-a8ec-1cbc7b28954e", "value": "6144:FGVRqBranjmHk7dmTMVbMzask2cinlA2VMp+uyWx2i2g7:FGDcrbHccjesPjVM0uyWATg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676170939, "uuid": "97f87c0a-ead3-4e0f-b733-dabc1cf31c77", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676170939, "uuid": "89b2dfab-4bad-4324-b81a-af78efbd6181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676170939, "uuid": "86e7dbc8-c014-41d0-ae89-840cb2f89465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f57975c-aae5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676213791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213791, "uuid": "dad9cac3-4ad8-46f3-bde6-e5bad027bfe1", "comment": "Malware payload", "value": "3f6a65b1722c40b8b162bace4a67cc80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213791, "uuid": "ba68ac8d-093f-4105-8924-2198f3a255ef", "comment": "Malware payload", "value": "ed5d4dbf41ab5846bd701f673cce82a246a568ac785db6e26713ce7ffb023082", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213791, "uuid": "43a516ce-d3ce-4030-bfaf-ecd7438af72e", "comment": "Malware payload", "value": "74c1b55a2a0ad111b850331c0388ddf28451c7e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213791, "uuid": "b7408c98-5ddb-4877-9344-5e8948a6ca0c", "comment": "Malware payload", "value": "a53b3aca47bf8ff8fc8fa4522e45ab21308a9a8f70ec0af4111c45e89816fc80ca2b073076eac0469b8b51eee61f8aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213791, "uuid": "f11fe6d5-54c1-4937-84af-3adf72e885be", "value": "T1188580082D8C40A7DB5296FEB4F82CB06C17F7B5A6A47CC715BA1A8E35645E65F3008F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213791, "uuid": "44543406-e528-4416-8ac8-fbc01c6aa5a7", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213791, "uuid": "c5f20af8-754d-4976-8811-b9880411c92a", "value": "24576:mTUbmKy7dFUgTfawCvP8xpSfGPcawLAnC5rv/b1kfAysKqrlPEBMH0H:mNKyBhqP8kGU6CNp/yZqy2H0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213791, "uuid": "12604718-55e1-4bca-84b9-a1580bc11c1d", "value": 1741368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213791, "uuid": "0d8024da-9976-4e76-bd02-40c74f85a7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213791, "uuid": "300d1bae-5c79-47f5-89bc-a1557427daee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20ec1e4-aab1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676191569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191569, "uuid": "b22a6514-cc0f-4944-a38f-6b628736862e", "comment": "Malware payload (RedLineStealer)", "value": "9b90f2e08b11ff874d0c84bf1556bd06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191569, "uuid": "010658aa-cfbc-481f-956a-aa933bfca200", "comment": "Malware payload (RedLineStealer)", "value": "ee1d9ad886a558be300cb235de4254ad7b081385b26646122212885e98b41441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191569, "uuid": "0388e32b-210a-4bf7-9280-452acfdabca7", "comment": "Malware payload (RedLineStealer)", "value": "5b5829d46a6905147a2d406cd6cbef2d9252ddd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676191569, "uuid": "21939783-fb0c-4d0e-bee8-9897027ec4cc", "comment": "Malware payload (RedLineStealer)", "value": "622b213759dd209a5e60d8e9129169b166cc557e2441947ea5251b8528da2ba451483c3028085fc37414a507054ab97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191569, "uuid": "c26ccd0b-c928-461e-b412-f571cc63e356", "value": "T1D3F41207AAE89032E8B5137049FA03C31B367DA0573883B7A65E7C590EB16F497357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191569, "uuid": "dfe84ee5-11bc-4970-a7e6-9e1c66387f3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191569, "uuid": "69fe7076-d362-4f42-be1c-d2c29224f95b", "value": "12288:zMrAy90XMXECLwtD0zt0doxQhIofjeJVMGorJxlITyZoEYtor4qFNg:TyMK2Q2EQhIosqflKyOF+cMNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676191569, "uuid": "e87f2759-aa16-4ba3-afba-f13b4c6269e9", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676191569, "uuid": "441eba35-1957-4a66-b39f-cce5d1fd3dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676191569, "uuid": "642d68aa-b03e-448e-a83a-c29bc08e5d54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51ae291-aa9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676182098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182098, "uuid": "87c7cce1-fd4d-4411-8821-906d2eba2c67", "comment": "Malware payload (RedLineStealer)", "value": "7d48ffadd18a160d5b773d63f1ce632e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182098, "uuid": "7beefd1f-d277-4bdb-ab38-21f5a01c5e3c", "comment": "Malware payload (RedLineStealer)", "value": "ee20bffacdaaa13d5cc9c48a102ef5b92e43c25a655c70fdfb61965fa927e324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182098, "uuid": "71807fa7-77a3-4dac-9bae-8d92e8a7d5f4", "comment": "Malware payload (RedLineStealer)", "value": "cc9ca4f055a08b9b2cbd9e52f8e987bce9b14bf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676182098, "uuid": "af02a8a3-1c7f-428d-9033-c9a004f95e8b", "comment": "Malware payload (RedLineStealer)", "value": "3f73584e839722e0b517c38b28243d44f8f9c0a889c0f778b13099ae7e536f1c7d4de32853572717e0fdf120d234fb89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182098, "uuid": "76a372fb-a33d-4593-9a4a-60d38cd46369", "value": "T152F4124BE6E88436E5B153701AF303E31A37BE705A7882AA530F7C994D325B1E13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182098, "uuid": "fd1d32ad-4fc0-4a45-88a0-395a85bdb4ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182098, "uuid": "737a72c7-be16-402c-b1ca-bdabdddefc79", "value": "12288:0MrZy90pHy42YFGDN/NxcmD0m9v3I8P+neJxJVRqVodv9uoFaX3O9x1FO+noNy:ty1YFGDNLcePIO3PfvcoAX3Ol9nL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676182098, "uuid": "dd94167a-826b-4141-b75f-2e7a0e1b4974", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676182098, "uuid": "abbaa751-4c88-4fdf-a2cc-d4a5ab60f98e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676182098, "uuid": "be8f108b-ac42-47d1-9f33-13479f791832", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d027bdd1-aab3-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676192478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192478, "uuid": "33c03c8d-df38-4de1-b0ba-4bef8c43fe77", "comment": "Malware payload (TeamBot)", "value": "a7c1891fa46875989205d76567a8975f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192478, "uuid": "b440d3a3-d971-46f1-999b-9c9a674e9ae4", "comment": "Malware payload (TeamBot)", "value": "ee89695f51211160eb0bb1aab63e829354af151d4c51d69d073c15153982972f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192478, "uuid": "decef245-5ce4-4d22-a9c2-4c94a339c673", "comment": "Malware payload (TeamBot)", "value": "3ccbba1b2ec99f9d6e4eca2332f0d20cb22829df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192478, "uuid": "90617650-49e7-4c74-9f39-ca7bafc61553", "comment": "Malware payload (TeamBot)", "value": "8942b50c526b998c73882325639fde2792d9011b171d28be60e1ca5f10fcaa8746e093a5f8eb41f806f56f595d895479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192478, "uuid": "5704bff3-27c5-4143-ba48-70cdf233bbbc", "value": "T18D14D0117AA28073C15747B56935D752AA2FBCB2976681FF23011AAF1D303C18E7637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192478, "uuid": "cf958564-79fd-4dfe-bb5e-7a13d9614968", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192478, "uuid": "0b9a39fd-368b-4b8c-a48c-6f1bce5cb0fb", "value": "3072:Kjqft+0JeUZ5Cx4U2DSogazUvnYjmrdnrJYase87TJDY:KG1R+72+ps6/nFITJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676192478, "uuid": "a9c67984-1dcf-4c8f-8605-5d71544f15dd", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676192478, "uuid": "54c9b6a6-80ec-4d2a-b39d-ce80fa0ebf1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192478, "uuid": "5b81752b-9fd4-49e7-86a0-e08c2dde6ce9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7c79f4-aa9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676181686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181686, "uuid": "4b138eac-4324-4e7a-9b7f-f1f06b9aaf13", "comment": "Malware payload (RedLineStealer)", "value": "c8388338f5bee030e017a7860f8cc2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181686, "uuid": "911ffd7e-aa1b-452f-b15d-aa9bc0fe7463", "comment": "Malware payload (RedLineStealer)", "value": "ee8f0e850243a2aef508e5a14f8495d3aca0e9d88c0a059eb085357c543f55d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181686, "uuid": "f25255ed-efd8-4396-9bda-cae8c527ef3f", "comment": "Malware payload (RedLineStealer)", "value": "6effcd6c6b4e2fd78ce5b7d0b2b1b4ec7f6d71d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676181686, "uuid": "615d5cbe-6ad6-4f07-a0e4-792469775b1f", "comment": "Malware payload (RedLineStealer)", "value": "8f9a0bf151c086577c63ec198eb84e78edd354e395e58c3920ae383bb0a8b11db6aa6b85a789f14b5c17af72269bbfea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181686, "uuid": "42971147-cf61-4edf-9594-c0cdeaa32b57", "value": "T1B154F111BAA1C077E5A708B41531D680AA7F3CB167A2C1C7777896AF0E313C2DD7A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181686, "uuid": "c663d91b-5324-43d4-9711-f1cce53ef9ca", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181686, "uuid": "d592eeaf-af68-429e-9276-42a378f5ba78", "value": "3072:dje77+d5V5CuOtU3efzJ7Ox1hjBM95X8MDev7gXHQks0Z0Ih9jCK9f3qj1xRK28v:difCquOUWJ01rweeY7kQksK9/9ClX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676181686, "uuid": "3e991f63-c6b3-4393-b561-576bfd680cab", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676181686, "uuid": "109912e8-fa37-45e5-864e-3d256a8ec804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676181686, "uuid": "bc078e7c-82e0-4cc4-824c-4009ef03cd22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f2198a-ab1b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676236890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236890, "uuid": "e7c5da38-f080-46a8-920f-ac07656eb335", "comment": "Malware payload", "value": "048a51139902b2a763a480a2cc0b4a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236890, "uuid": "5e4daaa7-4b03-4886-82af-8076f4285f40", "comment": "Malware payload", "value": "ee9526e4d71584ddb33438757ae15641900eba1c70bc6f95a1bc0bdcdf5c0f1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236890, "uuid": "9f9b36cc-e1a6-43ab-8e36-307ec23bb969", "comment": "Malware payload", "value": "9028291dda40cf4a6221cfa9dbf87e86a69a1068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676236890, "uuid": "366e3607-2110-479b-9dc1-bb88b1e0f01c", "comment": "Malware payload", "value": "9e21e441fad2f31e7d00425698a3174b75c2ea5244e9d4c1e56c065ab4d7a75d29f8275d63b55ff75f4583d3d380e8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236890, "uuid": "0e8a767f-646f-436c-92a9-a84e9d31d147", "value": "T1FD04CF1279A2C1BAD16B44791E30FA646A7FB8B15B61C6C73348176F0F303D26EB5386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236890, "uuid": "0ed63a18-b1b4-4b00-b0b5-9c0ff96252fd", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236890, "uuid": "1d1e0e75-2eac-4fc8-af76-b79b33701310", "value": "3072:T7TH5+HKlbB56svhyasTiL/8mEA85e39zZ154+eX8X:v1CHsctTizN38sNVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676236890, "uuid": "6398149c-752a-42f6-a5f0-bddc473ead2a", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676236890, "uuid": "e061dc50-5ebb-4afb-a891-ee357590fb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676236890, "uuid": "9f81679f-58b9-4b80-ba2c-6cc33e0384dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35d5847-aaa8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676187813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187813, "uuid": "831c14c9-34ea-44d2-9420-00db20b6282f", "comment": "Malware payload (Amadey)", "value": "7920e5cdab4e548d490a57b9992db4be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187813, "uuid": "d01c0f79-21c1-471f-aee0-959cfc14f4b0", "comment": "Malware payload (Amadey)", "value": "eeaced9d8194d154da472bd9a50aa3d41feb30711355244304d329dd5cc4afb0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187813, "uuid": "e9350fe4-6518-4b92-802d-6581e02690b6", "comment": "Malware payload (Amadey)", "value": "1cb23386654b9c313d1c3966de24360dd8f018c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676187813, "uuid": "71ab021a-509e-453d-9fa4-cd941fd1530d", "comment": "Malware payload (Amadey)", "value": "1b3955635ad05faa604876e4b6663debe04bc6b26d13f338bca0bbfc598a38bec528306ab4f0e782f8e793669dbe9625", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187813, "uuid": "05455d89-cf83-4468-8078-d30d9e30559e", "value": "T1D5F41207A7ED8022E8F057B11DF606D31A357E51673883AB174FA8590873AB4B3717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187813, "uuid": "8d22a017-bb3d-4a53-b696-945089b8e1a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187813, "uuid": "f927cf5c-14cb-4a2e-afa1-c1a41b40250d", "value": "12288:9Mrzy90X0q3RX44Dnujod959gvq82rEeJlw6L+Cuyim7awPCnDEOfF:yyM33RI4bkqoq8olJLUm7aBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676187813, "uuid": "17fbd59d-d892-46e1-8442-47b4052d5c56", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676187813, "uuid": "5f393ea8-8fcb-4242-b68c-5158941acb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676187813, "uuid": "988d52d5-de89-410c-83a7-8a53b8e11e07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3475707-aa7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676169317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169317, "uuid": "3b4d366e-391e-42d7-ba65-446e670f516a", "comment": "Malware payload (Amadey)", "value": "3488d36e8bcb5774b044ef3a9356b891", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169317, "uuid": "554bbe77-1f81-4f66-a395-3b2a7e0c9b5d", "comment": "Malware payload (Amadey)", "value": "ef69eb24bbda010acfd57a11f83ff31b37818233f434611681aff10612e31d86", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169317, "uuid": "72c6549d-b315-43e5-8f4d-17e761e36df4", "comment": "Malware payload (Amadey)", "value": "4c49b3bf57e4436b8ae89cc51f2f39365ece3070", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676169317, "uuid": "b8253e0f-38c6-48c6-b8bc-ae522fe1ce89", "comment": "Malware payload (Amadey)", "value": "e29848ee44ad340eb2d4890f6f449fd6c67095d3ce47ece16155d53004a8f79028c9a9c2efd9ef0adf06e0a8806c4b2e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169317, "uuid": "c037a82c-5c0e-4240-ae2d-e5f9d34f7cbb", "value": "T133F41297B3DD8432E9B463B119F603D316327D719E34C327238B6D9D48B2AA4623536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169317, "uuid": "0fd352e5-50de-4f2a-b339-2ef70805ec73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169317, "uuid": "b88bc10c-1670-441d-a4dc-65c679f5b080", "value": "12288:HMrIy90lcc8ZtIw22Kb0HdxQffO8WnZMZyKeJjGRQ1Y2cWsKdp1EjS5S9zdA:LyO8kwrIsaf5WZM8j8q9M9zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676169317, "uuid": "a68d44ca-ec8d-429d-8efb-44cd1ef85c0d", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676169317, "uuid": "7af710de-777b-459c-b748-08e42a877cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676169317, "uuid": "28618555-430a-47fa-8dc7-6f5d2c2140ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd6aa06-aae6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676214350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214350, "uuid": "85fc1ca1-3359-4516-9454-6fff881be66e", "comment": "Malware payload (RedLineStealer)", "value": "3ba1dfc6d56615e12a364844c2bd4667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214350, "uuid": "972a19f6-5eca-4e29-af5f-3c53de5653d7", "comment": "Malware payload (RedLineStealer)", "value": "efd665b2a1d8916078bdc7e83b368fcb40397fa26a1df9b0a1bb680d32a5145e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214350, "uuid": "0ff93331-7c84-48fd-b37c-d5c442b96c03", "comment": "Malware payload (RedLineStealer)", "value": "8fb0b68db9d957f39ee2aa0b30995bd372aea45c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676214350, "uuid": "16287a3d-933e-440c-82d1-b0e29ddf5877", "comment": "Malware payload (RedLineStealer)", "value": "04321354a75d6d9a93793dce4f222280845a96f57ca5a0fed885bc4083b36d9626ec84658bf5e664deece1997ce5b140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214350, "uuid": "e3a9a19e-39f5-4ca8-b75e-70df54a62dcf", "value": "T1B5F4120BBBE99432ECF19B701DF603D31A317E515A38835B278A2D4C1C726A5A63477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214350, "uuid": "4b5e38f1-b4dd-4791-815f-8681c926c97a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214350, "uuid": "604cece5-2f8b-4df6-a803-3f42443b73c7", "value": "12288:mMrry90JTZYVSWuftP6zeHwgD+lvUx/I0CQIeJwMn2R7uKKAR3rdnarr:1yKeVcP5FDGvYgjSYR7uKz3rir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676214350, "uuid": "19c18991-9517-45a2-9df4-3f96f2f0e3fa", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676214350, "uuid": "8ed2eb60-0670-43c1-ba3d-a9762a147ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676214350, "uuid": "09278c8b-914a-4fb6-a6d6-5746a9d9cbab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c81854-aa79-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676167362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167362, "uuid": "3f1ccc53-1a7f-4ce5-8657-1b5ff04518b8", "comment": "Malware payload (RedLineStealer)", "value": "8b6487416b0612c73143ff6949d1d094", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167362, "uuid": "0e5bcd8e-b512-4e2a-9ff9-bce14ecb170c", "comment": "Malware payload (RedLineStealer)", "value": "f0a6c814624edcedfa89ce88ad62383ea4a00f389ee9e789a0fb241eb1f65067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167362, "uuid": "c1114d58-ddf8-454d-95e1-f18f817c5025", "comment": "Malware payload (RedLineStealer)", "value": "e6c0a5b9060ec953ac5e819cbefe9ed76b309d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167362, "uuid": "9013a953-baa4-450b-a18d-5f0c30fa5966", "comment": "Malware payload (RedLineStealer)", "value": "c9e71d84590ccb7e68756128e69e271f5255a1f3653b3605543a29d2a894de51a7f5ed14f54e95cd8e88863e2f2f6728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167362, "uuid": "d26a6a78-d7d6-4f72-849c-c4ce2e72b3a9", "value": "T10454F12175B09432C45382B56931EA946F7FBC71ABA2C1CB33C916AE5A303D37E76316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167362, "uuid": "9cc8b863-c86b-4491-a171-d7d6577bf15e", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167362, "uuid": "d00d8a10-1da3-4d1c-b1d6-feb9c1a31ec9", "value": "6144:uGERGQvsv/JdwTohyzdWxL8rnV0MiBgbmY3Om03O6SvwEVH:uG62fwTPWxqV7M69NRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167362, "uuid": "52d8f897-302a-4bd5-9fab-d9c2d862f0dd", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167362, "uuid": "8c35200a-3ab5-4ca8-8bce-55ea81ab162d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167362, "uuid": "fb5b4687-0cdf-4810-876c-708f2faefacd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d069f92-aa84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676172179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172179, "uuid": "72fa040d-52b5-4709-9b7f-c59ebfc3ed12", "comment": "Malware payload (Mekotio)", "value": "0a2adadda5bb7b6a0a4d7e0028623927", "object_relation": "md5", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172179, "uuid": "f986ae92-def8-4483-9000-4fb2cdd2937d", "comment": "Malware payload (Mekotio)", "value": "f0ce0b2981dd1a5dae08cba87e14b814320a592a278943ef90c90e5b4c613bc7", "object_relation": "sha256", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172179, "uuid": "f968932c-d556-4f9d-ad21-7323f7698f4d", "comment": "Malware payload (Mekotio)", "value": "4acfe1bc66606bb18f40940fe2c6e701656eb108", "object_relation": "sha1", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676172179, "uuid": "2b810c63-54cf-43c6-aa69-272f6533bb89", "comment": "Malware payload (Mekotio)", "value": "09f9f5bc517c3927c5b326c34e8b6b8269c74168bc47535a896680d09f5bd7568ff8a468c08767548a9ff828c67423a0", "object_relation": "sha3-384", "Tag": [ { "name": "AutoHotkey", "colour": "#A2B509", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172179, "uuid": "34b42634-a5be-4a12-9612-212d51e8a930", "value": "T1D9E6331B7D9876EE27F508F630119C1E471A126030BEB5EA567F3B9D6E4B8A07C21372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172179, "uuid": "6f12a02e-8648-4a39-97c6-5cb1d3d652f1", "value": "393216:FKHBtYZohcI/Bk8hYT82kfkL+tK+nnzxX6QRLN:wHYZohTbWY2kfi+tHzxnLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676172179, "uuid": "49cf329f-ec75-4853-b4e9-519ce6747951", "value": 14591200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676172179, "uuid": "534baf98-95f3-4b5b-948c-c0cf393a914a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676172179, "uuid": "10b04cff-52dc-4051-8eb0-8457bc3eca8d", "value": "payload.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69f56f9-aa79-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676167551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167551, "uuid": "2b92868e-cd38-4b3f-b524-a2ea812bffb2", "comment": "Malware payload (RedLineStealer)", "value": "0a4dde37349193b1c3dca3fdfb5a7cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167551, "uuid": "7b22351f-c028-4e9a-b5bb-6d0c7b73cd70", "comment": "Malware payload (RedLineStealer)", "value": "f140cc5082ecb75e13c310e91210e56eefd583d51d8d3e9694b860c498cc10e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167551, "uuid": "0f7537dc-eb50-4d75-ac5d-b3f02e7d367e", "comment": "Malware payload (RedLineStealer)", "value": "9dd0c62b7b946056e7717fdafb00dd904154b6ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676167551, "uuid": "6ff07b5c-fbc3-4f84-811f-1714582f105b", "comment": "Malware payload (RedLineStealer)", "value": "64612e60d35061181fa0794ea603f17b621c50c5000bf0f05783437c455e0368f3f6b470e6fc8a44886e7bb75579520a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167551, "uuid": "1f254500-b202-4805-a99e-218695f34a8a", "value": "T1D4F4120BB7FC9036E9B55B701CF203C31A367E614A38C35B628A689A4C73AB1657571B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167551, "uuid": "1b4d0048-a484-46c8-b6f8-7898e5bfb117", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167551, "uuid": "05f73017-ff76-4783-b494-0a1cdd4092bc", "value": "12288:CMrmy90SqV23qFt2pS0dUHqkeeJGJc+1qUPm9zsKdpFaF+5McNSpG:cy0V23TBdUrl+1r52IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676167551, "uuid": "447e2e07-8aa6-4b7b-a79b-a53dc2b897d3", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676167551, "uuid": "82c13ab7-0d14-47d7-8454-85443b0d170c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676167551, "uuid": "8b262175-7d8c-4042-9e20-74be3997c87c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9815567-aad6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676207473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207473, "uuid": "fbdf222e-d1e8-44f3-947a-8afcf2768bba", "comment": "Malware payload (RedLineStealer)", "value": "c458bcae292a9daf3f12378b00fb58e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207473, "uuid": "26248b43-554f-4a3e-ad2e-edce6b00ebe8", "comment": "Malware payload (RedLineStealer)", "value": "f14d1779017aff6e3bf7fc9119ee7c249963ae76ecbd6063668fadc4606aa844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207473, "uuid": "33c07fd8-6aee-46b8-968d-2c8bfc09108e", "comment": "Malware payload (RedLineStealer)", "value": "0adafa64e4dd666f289fd966ca7094e89227835c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676207473, "uuid": "70df2298-a6c2-4cbc-9e07-acae44746f04", "comment": "Malware payload (RedLineStealer)", "value": "0599dfa8a6d0144ec053a857e9137a7f6d4b0fd11a22a0aea7259fdc0865039447f8509954dd2d1cc5c293ef08fbfea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207473, "uuid": "53631e31-ecad-4d6a-9879-83ae93c11c8d", "value": "T169F41207ABE88473E8F4977108F613C31A357DB05A38824B678BAD5E18717B0BA35767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207473, "uuid": "53a5dcb1-80a5-4192-9728-16663b58af10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207473, "uuid": "7b736ade-17c8-4268-bd9b-0d14224f12b2", "value": "12288:5MrWy90sCetxylqGEqncq5XIMzeJQmxk8Fyqg5gZ7J0T1wb/zm:rySqylqGqq5XIbQkYHeZ90Bwby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676207473, "uuid": "e5cc85ef-bc4b-40de-a36d-11157a9e076b", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676207473, "uuid": "b0705101-b198-4691-81e1-e9ad815471b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676207473, "uuid": "e50bfe34-9cf0-4ec3-b124-2caf781583df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3506cd1c-aac0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676197801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197801, "uuid": "cf352235-dfc5-4374-8883-d0b260fda4f6", "comment": "Malware payload (Smoke Loader)", "value": "c58477c73d8c59dce65f720693e738d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197801, "uuid": "74ad2249-ff2d-4444-ac76-ad0c1dd3d1bc", "comment": "Malware payload (Smoke Loader)", "value": "f1dd6dbb8356592194cf1f3a5e48327b12a37cae6f7a72cf40e99b3d32a13d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197801, "uuid": "cdfa57b5-4a56-4d3d-86d5-a21e1c752740", "comment": "Malware payload (Smoke Loader)", "value": "01e35e84b61553a3e2651bc78a952a8ad96d2e10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676197801, "uuid": "30a003cd-2096-49b3-baea-0f444a14b25c", "comment": "Malware payload (Smoke Loader)", "value": "618d5063eba8cf6e83df9087ddbce9adbdd510f00d830018e25f79efc40d0490afa27c984be15df3d1d3695654714296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197801, "uuid": "c028387c-59db-4605-b809-8dcde7ef28ec", "value": "T1F514CF11FAA1CC72C567847C5935DA956A3BBCB26BA1C5CB234807AF0D302E21EF6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197801, "uuid": "91e83ece-9ba4-4462-b0d6-5082463f5206", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197801, "uuid": "0785dfba-c094-4c22-b53c-3372056c9c98", "value": "3072:gbTj+lu0RsoiJkIO7T5It//A3v6Dm56lHZOMcLQ:i/Rpo5RBtqioHAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676197801, "uuid": "cd8b0720-5ba2-44bd-bf42-8f5b8d5c80ae", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676197801, "uuid": "12088bf1-b7ef-4133-9786-313726697d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676197801, "uuid": "f255f4ac-6898-4641-b2de-8528b36f3ce5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a10ae3-aa7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676168519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168519, "uuid": "3ac86a6c-63fa-479f-b0a7-82414369b749", "comment": "Malware payload (AgentTesla)", "value": "5552beb7c57baa9846eaef4bb4c3e568", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168519, "uuid": "4522de70-b89b-45a8-8c2f-a5c8cb869136", "comment": "Malware payload (AgentTesla)", "value": "f2a4e636a95c5a934cd6a27d9e91fd83482db7b2e94a3f61ed6035f8feea19a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168519, "uuid": "25a985e4-9251-4f04-be19-08ed655c6327", "comment": "Malware payload (AgentTesla)", "value": "5bcf9f9979cc48fb5d9c20ae5afe4b137c2b1535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676168519, "uuid": "68fe17d6-cbca-4de0-941d-b1971bc058cf", "comment": "Malware payload (AgentTesla)", "value": "f02b9aa2a533fa229ffa6fcf45e4c90541ec8fd591212f15e3eb1f5df4e33c83efecebd95e04f838ed792c1c2ea1fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168519, "uuid": "58faeb91-a411-441f-a510-1b6f9277b892", "value": "T13A64125973F5C577F9B29BB76E311B338FE3D916206493120F085B8979B0A81A80E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168519, "uuid": "a929d1bf-ad7f-4351-a0bf-35edfadeb273", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168519, "uuid": "6691caa7-251e-4115-bba3-9b24b630a5c1", "value": "6144:tYa6E1cKOt/c4j1omcuADDG8eqzf33J4WqcLJr4X9Z+SI:tY2XecuAe7qzPI9ZhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676168519, "uuid": "3608c7fd-1fe4-4d3d-9c2b-b18484b35b1c", "value": 309616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676168519, "uuid": "d2494e6e-06cb-4c67-9d2f-f31f9816258f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676168519, "uuid": "9db2eb42-87dc-4ab7-be91-e7c7159fcec8", "value": "5552beb7c57baa9846eaef4bb4c3e568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff383f20-ab2d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676244956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244956, "uuid": "37b728b8-3856-4512-aa6c-fbec2e968ff3", "comment": "Malware payload", "value": "5aedfe28b732e24924339ee3f3284b5f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244956, "uuid": "1ae019cf-9c16-491c-ab9e-ca7ad33fbb1f", "comment": "Malware payload", "value": "f2b6310df1a9516b4bf437e5b76c0b1a2b8a83cb9c9d34e64d878bb4b91c0733", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244956, "uuid": "e1dd744a-fc40-4e2b-9720-af6df8015f82", "comment": "Malware payload", "value": "34eeb0fdd2310ddb8a7bbd861abf6cbe5fc4f77d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676244956, "uuid": "1be0bfa9-2906-4bc4-9844-93b5aff70492", "comment": "Malware payload", "value": "8a10116eac9b3a50766a7356aee8d6bc8acbb4fdeb8bab0c03025d3357a18d7fb1f1fdec468bf117d5b86c15c7bb3dfd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244956, "uuid": "4fa18a97-7745-4ff2-923c-eec5af192187", "value": "T185A533AC160EB6414FF23B244432FD9048F95BE22728B7878D967BA8D5109DB35BD43B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244956, "uuid": "a90d4116-e6ed-41c1-8a3d-978f0e5c43f2", "value": "49152:8GSFTjQoMZdNu6F4rFZ2Uw7pKrx3nRxJT3tc1Yg74prb/zo/Jmv/+4MN2:rKsosXu6uJZ2T7p43R/T3tcDUpveJmvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676244956, "uuid": "29c2f39f-9485-4bb1-93e9-4a887afd509b", "value": 2157314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676244956, "uuid": "0fc9d0bc-95bb-4a70-a5b6-8ad7560a4cce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676244956, "uuid": "3bd6b329-045d-4cbf-b42f-445668f0149c", "value": "5aedfe28b732e24924339ee3f3284b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bfadae4-ab09-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676229193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229193, "uuid": "756cd40d-b2e3-4826-a84a-0f12797fce8a", "comment": "Malware payload (RedLineStealer)", "value": "4de16ba68c446ed764830e2863b76325", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229193, "uuid": "ef4eba2f-a62b-4071-ae86-235bc7b1586b", "comment": "Malware payload (RedLineStealer)", "value": "f2f1b99fb9aaf113970283eedd3706f617216812b6dfa957af1f6f45a6c4f951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229193, "uuid": "65e44c0f-a874-4574-a0ee-42c29f8d46e7", "comment": "Malware payload (RedLineStealer)", "value": "74a148dd1316bacafdf469c72104f1d327e33db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229193, "uuid": "12c3ce61-5db0-4f2e-86be-353c96d3dab7", "comment": "Malware payload (RedLineStealer)", "value": "1f8289556120335b55eaa4353d3f0855d0f3f9fb1ef365ee156b9cabd1584faed90f938dfaf1a808fa527891c86055c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229193, "uuid": "dd078669-3ff4-49f8-bf06-fa067b2cf8e7", "value": "T12EA4020BFBEC9423D975577018F602C31A357DA16A3843AA638EAC4A1CB35B0B53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229193, "uuid": "252e469b-0243-4668-bb46-2da833fe7375", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229193, "uuid": "946b659e-6363-4192-9386-f1029046f6a7", "value": "6144:Kwy+bnr+Dp0yN90QEuesGoADrVNIr2/iR2YsEFxhu+IY1pv/olmQ83/C559QfBz/:cMrPy90hrVjaR2ENuYfolro/E9uQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229193, "uuid": "2ac001c3-6f9f-4ea8-ac45-8caf39c8dfb0", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229193, "uuid": "e37a3cb8-4638-4f62-9408-572f876fdea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229193, "uuid": "9ec155f7-b848-4854-a497-517547d06d52", "value": "4de16ba68c446ed764830e2863b76325.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1738c7b-aa8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676176213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176213, "uuid": "c1ecee2b-5de3-4e79-a2f3-4507d0cd05cb", "comment": "Malware payload (Smoke Loader)", "value": "75cccc8d40142cb827d4ba16b54e9f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176213, "uuid": "cb35869e-3091-4719-8f12-8c166f9e4e69", "comment": "Malware payload (Smoke Loader)", "value": "f332476a37fa86870eb0563e638376f6bc3e17956c7839aecb133596548e743b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176213, "uuid": "6c896ea5-0cf3-4680-8d3e-a3ef4ae15f5a", "comment": "Malware payload (Smoke Loader)", "value": "2a304c8b40446e883dd119b9c7c520476f3f716b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676176213, "uuid": "fc00e73f-cbdf-456e-839d-485bf2516a9a", "comment": "Malware payload (Smoke Loader)", "value": "16d1b348988d48e316da7b7f8ebbae3b27cbc00a67c722b89a2ef8dac98d677df2b969ae310198d93e93341c833e679c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176213, "uuid": "da7de917-2b29-4b8e-b001-02b19bbba264", "value": "T11214DF1076928173C55746B61A21D6806A7FBCF28B61C1CB3349166F1EF33D28E39FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176213, "uuid": "afc70e6c-82e4-4c5d-be0d-67c9f46948ee", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176213, "uuid": "f3a65f07-fc7b-4bec-ab3a-bbef91e916a7", "value": "3072:fjqKA+0Jydc25CBPg/PimCoNI4T8bXcr5WcjhdhWx1uwTGghbdnv3mG7x9tTZcTs:fG5R0CNoTCoNmgr5Wa6vTddW+9NZcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676176213, "uuid": "9eca4ab6-04ed-4edf-8744-f208eb1ada2b", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676176213, "uuid": "0fd190ba-5f5e-416b-8e29-f072f2a33858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676176213, "uuid": "b99e2b82-299e-49cd-b617-bbb74856e7fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fd25b0-aaee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676217667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217667, "uuid": "2ac9f045-be01-46ee-9b87-8adbd31afb13", "comment": "Malware payload", "value": "f9e3aea9f794c72d035d77eb2514f67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217667, "uuid": "6fc3e88a-90a7-444f-92bd-234d4add9fab", "comment": "Malware payload", "value": "f454332c50b93766314c6577918856338b29ab9dbd39267a8b8e99dbf7ab653e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217667, "uuid": "a0cb5596-b413-4378-8287-8d367fa09b15", "comment": "Malware payload", "value": "aa93e069f1f9b46612fb82f88ebfb4c81688462b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676217667, "uuid": "a7413b82-3f62-48b6-90e3-ce2ba6036ba1", "comment": "Malware payload", "value": "988ef02c8a7fae3852b38689079bbf7d70ef7adcfe3ebabb596ddbff95b21b5ce7fdd7c734b481a54965ecafbe15c521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217667, "uuid": "28be8a09-fb23-4900-9b61-527efb8ebbfa", "value": "T11F14D0123EE1C172C5778A751962DA65A93FB8B2F3A1C5C733489A6F4D303D20E7934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217667, "uuid": "86006c04-83f5-4105-97ab-33eb7c657492", "value": "66371b98ea4d8c3d9668fd350065be37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217667, "uuid": "886ddadd-f6d7-474b-b411-7c2faacce1cd", "value": "3072:V7ry+rG5505iUI57lrw2ms9nXKpD9mZDFlmr0onCyU6c8B67I9kzF8:xOLL9zBrXsDYl2CTj867", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676217667, "uuid": "ad42dc95-f002-452f-bc29-23fa47a67551", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676217667, "uuid": "6060d025-f3fe-4879-b82e-8cddf24f2df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676217667, "uuid": "86ee35ce-7223-443e-add9-fc28b742f228", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512002f5-aafb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676223189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223189, "uuid": "4f4c1c6c-4fee-43db-8c89-965cf8c7aabb", "comment": "Malware payload (RedLineStealer)", "value": "eefa03fbdf64ea6ce518e42c05b147c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223189, "uuid": "e0e2349c-8c78-47c4-80ca-844e68b89d2b", "comment": "Malware payload (RedLineStealer)", "value": "f45b161330c2674524d50c230275ae033c2532f98a6defd790c59de76a6aae33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223189, "uuid": "49c89690-ab88-4c91-bbf9-657f42110654", "comment": "Malware payload (RedLineStealer)", "value": "5fe0dab3408d279054b0d418cfcdf80da1d9e25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676223189, "uuid": "bd6f6783-7e91-4b2a-b49a-fd93287903af", "comment": "Malware payload (RedLineStealer)", "value": "3b43cce606c3f29150c65807f348333686cdd92f2be65753c52c9ecbcae30dc8bc73c05476bb67d5a06a9fef17f7209a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223189, "uuid": "0df96ff4-7a05-4eef-81f6-39801002246f", "value": "T1F5F4124FF7E94473E8F49BB049F203D3067A7C505B38426B574EAD6E04729A4A131B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223189, "uuid": "d012d1bd-537b-4e8a-b172-a508818347f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223189, "uuid": "b1b148f5-8121-422f-9688-45c32b17df0a", "value": "12288:hMrJy905J+W7iPEhcunmyLpzctmjPIsNXCKeJn57DI2PeY/YX1jtb8x+:wyI+3PEhcunmc4IEsNXIHPe0Uq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676223189, "uuid": "09d21e1e-89e7-4f92-97ad-e1f5d5f1c4c0", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676223189, "uuid": "6dfe73bf-1821-4062-a2b8-aa4811160f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676223189, "uuid": "e4bafe9d-e727-40bb-ab99-3479d8b19192", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a39a30-aac6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676200401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200401, "uuid": "64121a58-25b3-4b12-992d-08d7577d3d13", "comment": "Malware payload (RedLineStealer)", "value": "dafaf3d5bf7b53fbf1ec74fd1fe8e12c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200401, "uuid": "8a7bcf1a-c9ae-4c36-81c5-4f2f8105c72c", "comment": "Malware payload (RedLineStealer)", "value": "f4ce1be0e03dae503333726f979e090d46ce7fc151aab349e3ddf689a57311ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200401, "uuid": "79230d3a-800d-4f5a-a533-7826a483e001", "comment": "Malware payload (RedLineStealer)", "value": "60d8ebab246965b9475d7bcc0d9446e2edfa82a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676200401, "uuid": "724b8d6b-d204-48b0-bd76-522560c14e7a", "comment": "Malware payload (RedLineStealer)", "value": "5b571dd2b51b5b9638616ccec928e9d66c8d53fe81613d9ab1c0b7f846ef88970d6f0f3f571ab1283280db561582f7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200401, "uuid": "fb26995d-1c99-4419-be34-9c1b0042c5a0", "value": "T1DCF4120BA6EC8422D5B5277119F603D31B367D618B35C35B374AAD2D2C32AE4B234B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200401, "uuid": "31d50e71-8dac-420f-bfe0-44b92e94fb30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200401, "uuid": "642823c4-1114-4ca7-aa35-c9689a4558ba", "value": "12288:kMr5y90zGY8PMzP0INDjnRZRiF/Ti2eJ5Z1jOpWJeCzZjDNBmipSBv+i1:Vy/YzQ8n3MTADhOQpHmgJi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676200401, "uuid": "9e2dc259-55bd-499f-a51d-2a06ae07939e", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676200401, "uuid": "17746829-1761-4df5-b8e8-fb8dbc1eeae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676200401, "uuid": "c4cd7847-4cac-495a-9691-f59d6554a46f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b488fcb9-ab0a-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676229798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229798, "uuid": "414dd4d9-c246-463a-8177-147f74b1980f", "comment": "Malware payload (zgRAT)", "value": "b91d8ec33be96908c7af178205c446a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229798, "uuid": "f69cc238-680d-4c25-b6b5-96c2baf6dd2b", "comment": "Malware payload (zgRAT)", "value": "f4d9fd83682ed1579836cd93c23c26857253a1cea223fe1050be42f3eefd883a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229798, "uuid": "44a9a572-2696-427b-acf4-465bce5bfd4e", "comment": "Malware payload (zgRAT)", "value": "2e2eb4d3f8ceef8ed5a2b4261708a278a1813629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676229798, "uuid": "51bd1609-da6c-4734-8f8c-f0b923b2dcf9", "comment": "Malware payload (zgRAT)", "value": "2f0bf7d3c9349c9c62c71fc0d2db125bcd728300cbcf1b406c778705676a1b78ae1f025c69aacc5a93bfe9015200e3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229798, "uuid": "49a03902-bed4-43c9-a18e-93a562f2a591", "value": "T11295AC321102BF9CD6A72DFEE5C462328CBC6D575F15A134BAB8FAE8227551C9D40CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229798, "uuid": "a19f8a0c-40d9-4f6e-85f1-f87619fa3dcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229798, "uuid": "64208909-1801-42a6-bd41-41200fc74ddb", "value": "24576:AQwFjYWxGwuy6yv3LcBG/GfBf3icfDSsQYqXyqZXC6YXDFKojdMqN5vlOPXcSuYD:K98WoxTOUSuirWmDYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676229798, "uuid": "af2ecf8f-d77a-4450-922c-a4f69f4219c0", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676229798, "uuid": "3f87d6ba-7354-4c71-b989-971544a948e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676229798, "uuid": "788b11f4-f0ce-4045-b994-0e84abda480b", "value": "b91d8ec33be96908c7af178205c446a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd5bf9a-ab0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676230673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230673, "uuid": "bbceba06-784a-43f9-90c0-f52455c47d96", "comment": "Malware payload (RedLineStealer)", "value": "65fa3a37a359d0a5f0ddf566561eaad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230673, "uuid": "88c393ad-5d1d-4c30-a922-d5a7344acad2", "comment": "Malware payload (RedLineStealer)", "value": "f5044826769233d09bd523d1cb74f6cb58b07ca7d49a923b4dd75a2e5f0cf707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230673, "uuid": "54f905f2-1f1b-45dd-9e2f-0d9a7cab3d20", "comment": "Malware payload (RedLineStealer)", "value": "a480e430ccbaf812b0fded95cd1dc01ea4dc1b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676230673, "uuid": "16772508-fafa-4c46-8193-566ed2f898b4", "comment": "Malware payload (RedLineStealer)", "value": "77f7d89a57320f0b656a30d4659650425104788a080906e3d017dd87c0f015a9ffc52988707c173e9cef699be8dc15fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230673, "uuid": "6e06f328-6ca0-4410-a275-f989bbc85021", "value": "T159F4120BF7E94422ECB067B05CF602C31A35BE12A728535F168E5D6D09726F8A5317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230673, "uuid": "511d2c6f-bf98-40fe-9f13-d8d36babdd53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230673, "uuid": "0833c3e9-6007-4384-9e3e-5bad64710b4d", "value": "12288:rMrIy90abbNu6cAzhQ4FpLKcMotLdeJGIqpPOUep5wv1fVqzXpf9t:jyJbpu6rzhzFpLjqGIuOTwvvqDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676230673, "uuid": "d6079b21-52ce-4f61-a358-34cca12af961", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676230673, "uuid": "c8f1387f-170a-4b4c-a404-76c2ebb38fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676230673, "uuid": "4b1c1cc4-be68-445d-9d5c-8b4106761ed3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e7f7e6-aa77-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676166602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166602, "uuid": "a6a9f8a6-a5ab-4e4d-bf2e-29c9238422ff", "comment": "Malware payload (Amadey)", "value": "39d07b1f75f722e112478052bf23f842", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166602, "uuid": "4a607222-dcb4-4dc1-bbe9-20701d566790", "comment": "Malware payload (Amadey)", "value": "f5207a962eb6f5c93b49190fdfd8780da04684f82170b04e191dd11b7f47a46f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166602, "uuid": "43c37718-14c4-4640-a2a4-6c3e8047fbd7", "comment": "Malware payload (Amadey)", "value": "bdfcbb4e373a4a577feb2e186684eadd5ee5b743", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676166602, "uuid": "72b2a91d-b7dc-428c-8ebb-165aa42602f5", "comment": "Malware payload (Amadey)", "value": "2eb44e507f83abd62be1b3fe73f1534d04a764b09f5d9041a8363cea2dc6688e83af32f11d488e3ee4d029fb95655dd5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166602, "uuid": "311dc036-1a24-44ad-a276-50439244c30f", "value": "T12CF41247F6D89031E9B047B018F603C326377E625B3586CF678BAC5A1C72AA065357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166602, "uuid": "e06ae896-21bf-456d-95bf-17ce8ae7d5f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166602, "uuid": "7779067d-d081-4d14-8390-2ff07b21cf75", "value": "12288:rMr6y90dtM/oufUcS5vKo+XQLAJ2eJ2SeLsMSWUyzWfHrp+yC8:Ryya/oufUZ+XWA1ksM+waIyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676166602, "uuid": "8bce2058-6b87-4bbf-bfe0-1d5b092f34e5", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676166602, "uuid": "4f07b057-5c8d-4c1c-ae82-7ea20ba661c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676166602, "uuid": "8785b8dc-5d79-45e0-a0ae-6e3e08f66802", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef14644-aab3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676192235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192235, "uuid": "1ffc2c23-eda7-4886-b899-43a409388a0f", "comment": "Malware payload (AgentTesla)", "value": "44c2ea6ae2cc120c8c225ff4f49a6f6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192235, "uuid": "121d40f6-5143-4605-8e1e-11c676bcf774", "comment": "Malware payload (AgentTesla)", "value": "f58adc16af76d781317780d00afa4c9b69a4f85f716b2f4968a3b964a1327184", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192235, "uuid": "b2857890-67af-48b5-bd57-5e9536267805", "comment": "Malware payload (AgentTesla)", "value": "b14d0e6987c5f389f55e014102cb5b97a41393ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676192235, "uuid": "52f29f90-0960-453e-9829-8841193ee4a6", "comment": "Malware payload (AgentTesla)", "value": "56476a6da156958a0d130ea9a0833e3ac62839d84bdf1b3180afe043fc6944c09fb3dba3026250665511c3f42b172988", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192235, "uuid": "5feeaa63-1916-43c8-9c48-65ce70dbd130", "value": "T11005E53D297657D6C338F93186E18420B6EEA1823713F96ADDE61AC14F022C2BDCE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192235, "uuid": "0c24552e-2919-4c3d-a2f6-cead3e839f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192235, "uuid": "37cedcb6-fee3-4d05-a846-7b64e9d8021d", "value": "24576:1GrjseHKNTn7tunA+/kS2lMfmBm8rGtsAEVLNiLM04nAQ:1qOxAEVLNiLx4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676192235, "uuid": "6280472e-8e80-4a57-b463-33461a61183b", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676192235, "uuid": "7fcfa39a-ce66-418f-966c-b417fcc1ccf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676192235, "uuid": "5b3283aa-d155-49ca-8356-8f18ecf62900", "value": "SOA JAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0865383e-aaa7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676186989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186989, "uuid": "9689b6ac-e673-46f8-86e4-655784135955", "comment": "Malware payload (RedLineStealer)", "value": "eb77ca9f9d23593f6c9ca33ec6343944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186989, "uuid": "0e8c3e86-37b3-49af-8919-2a0cbc100e0a", "comment": "Malware payload (RedLineStealer)", "value": "f6d4a6f90ce98d7452dca549eb02c36510f9f1847da648f0697adc192e674198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186989, "uuid": "45448ad3-17eb-418c-a335-e3ce5d855c12", "comment": "Malware payload (RedLineStealer)", "value": "3c5400f8b6056c9a377fee3d92ec8fd944572c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676186989, "uuid": "e0d2ca67-ad58-4c79-ae10-2893a1455a19", "comment": "Malware payload (RedLineStealer)", "value": "ad07937bcd4ac6045ef05615b5c9d7cf1e565fd0dc85a49e1310181460d17f33bae11d3f087abba8af2281afbfa933d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186989, "uuid": "a6c603ce-42a5-424c-bd48-72c83dbbb545", "value": "T11CF4120BBAEC4122E8B0237028F703D316367E65563493AB278F6D5A58737A1B275377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186989, "uuid": "4e583326-289c-4a3b-9b35-aa68034b6b10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186989, "uuid": "d07d720e-752c-497f-8123-cc90ffe728a3", "value": "12288:oMrty90aIXLvedzO4FFtXAGzG1zRpbjia17FwNvkeJ+wFAQ64Km7fwPKrDjBBZQ:1yGvwtFuGS1DaD+wOpNm7fBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676186989, "uuid": "3512b08d-6b38-4a47-b883-a8d13aed5214", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676186989, "uuid": "dcc4c6b5-6def-46d9-b970-26d937ca25ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676186989, "uuid": "49caf15b-6b5b-4c9b-a185-f8c718401389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c8076c-aadd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676210448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210448, "uuid": "d5d903fd-65c5-4959-b88d-35326e7b56a1", "comment": "Malware payload", "value": "ef0399c5e26310c173d11e54e3f428d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210448, "uuid": "d5e03a8c-ecb4-47af-99b0-aaf61e186afa", "comment": "Malware payload", "value": "f82e6cbf4c9bd5ae4be50d61f3f193817534d923941c53fd4cc9ed76e4d9d185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210448, "uuid": "f73a18bb-e3e4-44f9-8a4a-b175e4bca201", "comment": "Malware payload", "value": "c6ed5880812b2a40e2d1ab343f8fef90c3deb4ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676210448, "uuid": "2d5f57d2-6136-472b-b1d4-9ad7ff06e35b", "comment": "Malware payload", "value": "ee46acae1530d5904579b87698f90ce4932b2601fa978cb29c4275175ec54ac34ee46315373f6d469f164b47a63d5675", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210448, "uuid": "cf1decb7-e52b-44eb-b844-70a5e405f78c", "value": "T1F05401213AA1C076F6B788745920C6A0B66FB8B56764C6D333841E6F2E303D14E7A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210448, "uuid": "2b350b92-3b8c-4e2a-8e34-0d49cce716ea", "value": "ea0c0f223b6ece290ece4f678a133da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210448, "uuid": "68c5c9bc-4257-46b0-a06a-7702625ea374", "value": "6144:paLUBEH7+0ZlsVNjh0Gnw4tOZuGElUNCNTT7:p6lzgNjhxn+ZzE5lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676210448, "uuid": "d1e670da-ed15-45f1-9c0a-01cb21c87294", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676210448, "uuid": "b1993a05-bc6e-4a69-825e-1f72d3c9e1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676210448, "uuid": "2400b4a0-71e3-4b98-89c0-91ec0b984a49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe082a-ab13-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676233401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233401, "uuid": "deae0170-ce02-4f49-b848-f0c2ea5f0f40", "comment": "Malware payload (RedLineStealer)", "value": "1b301825c986b285eb0fca57bfdde7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233401, "uuid": "77ff5d6e-94ef-4b60-a05e-2b2a0b860b26", "comment": "Malware payload (RedLineStealer)", "value": "f8ebffdc02737553deeadfe7fdba5bce67d611ff6ce9628c484f91ca4de82250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233401, "uuid": "13bb1d12-5483-4173-a4ec-823b2bb5603c", "comment": "Malware payload (RedLineStealer)", "value": "bbc7ff4de7210c6f51a2056f8fb7455a880d475e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676233401, "uuid": "3f6dfddf-e6d1-4811-9cb1-26477081e5e4", "comment": "Malware payload (RedLineStealer)", "value": "c933254723924dc90d90f0f2889f345ea5eff008cd8d237aa87aa81e1eaa3866484e1307f0107fd29cbd92c4c0572442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233401, "uuid": "cdb0182f-507e-48fa-979c-7fb4b5baba16", "value": "T14974A61F74BB7B5CE19566B53994EE88D8E3742887220E66F5E0851E7B3F280CD270C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233401, "uuid": "150517e3-4b26-424f-b3ec-34ffc3061d96", "value": "c0a0dc5efcf313a25eeff245ebb1015c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233401, "uuid": "4ba87df7-2aa6-4234-893a-955e4c95caba", "value": "6144:OklzvLnjIOQuwUbVyiGeUQCU1ExJpPixWAixWAixWAixWAi4wWWLP:yOEEpBrExJpPixWAixWAixWAixWAi4z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676233401, "uuid": "f8eaac30-fe7b-4c2c-ad5e-18ec975ea6e5", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676233401, "uuid": "14a5dc08-d105-44d1-97ee-469cb23482c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676233401, "uuid": "f9b47780-35b4-43c1-832b-da297425b0bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54e163c-ab1c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676237611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237611, "uuid": "da09b8d2-dc24-47eb-8397-2db438feb966", "comment": "Malware payload", "value": "16f2926f97e02fcc94fdd9515f1d8655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237611, "uuid": "e47b0d07-53c7-441d-8ea7-ee71a0c7eed2", "comment": "Malware payload", "value": "f909d23b3519803e79d1662c5a51cc88de605cb6e4e3a462e6cecec9182f8793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237611, "uuid": "4a20600c-cc25-40c4-b4a9-f6c3474613cb", "comment": "Malware payload", "value": "263441d60cf349f8cfd957c670dffd645fc61e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676237611, "uuid": "9f023c79-cae5-4af1-8e30-8ee8b1e404e6", "comment": "Malware payload", "value": "25f7996150d471a837d5c30a3d3814bff871acb17c6d810a3d3bc027708f0e645dca3fbd44a4bad9ed78b05682390bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237611, "uuid": "38305277-8cea-426c-b60b-cd3d4b1e9725", "value": "T15114CF2176E5C07ED05B85B86931DA946A3FB873A7A5C1CB331417AF0E323D18E79346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237611, "uuid": "9a3ee78a-a53c-43a4-84d1-351cdc874ad2", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237611, "uuid": "48bc0c4d-76f8-4a0f-9337-14e6cfe8a75d", "value": "3072:6BDH+M1CU5kI3hF6KfSbC8Vp9MSIRXjCkfyWONmzdzQV4l1Bfl:SrR1CFIxF6Kam8Vp9RIZVnSmzXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676237611, "uuid": "e2d07dc3-0bb7-416b-bd03-90acca5846a4", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676237611, "uuid": "66ca316a-641d-4cdd-adc2-e68323cdbf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676237611, "uuid": "950b7d5d-9bfd-4a30-a56b-a59f4a79d89c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fb59ec-aa82-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676171233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676171233, "uuid": "20190142-f747-4fcb-894c-7751816c0547", "comment": "Malware payload (RedLineStealer)", "value": "e27a40d72deb50cc770804eafec86ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676171233, "uuid": "ebb51de6-0fba-478a-a9f8-3c1775569e22", "comment": "Malware payload (RedLineStealer)", "value": "fa113da8bc8a42bc5198e589400b3e3c10edebd1933313efdee59a7f377dbabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676171233, "uuid": "a54bc6d4-c624-4aca-af6e-a10790292d4d", "comment": "Malware payload (RedLineStealer)", "value": "28a72e688f8677f7e549938dfd7dae5673393634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676171233, "uuid": "5c470b74-4805-448f-a1ac-990bef457a4d", "comment": "Malware payload (RedLineStealer)", "value": "bfa350dcd0988bb92e4ae7c72844638ca13e831a93011f0c9c37bf2c9fb6cc9d2e893b90f3fa76544f407507b423badd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676171233, "uuid": "ef006021-0234-4539-91af-7ed51d35283e", "value": "T112F4124BB6ED9023E4F557715DF602D30A36FE605B78838B238F6C9618326749139B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676171233, "uuid": "4c6c5187-543a-4c18-b70d-6509fa716964", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676171233, "uuid": "20f0a6f5-ae43-4c75-9316-f021442b0f5b", "value": "12288:UMrzy90NGSIcIFDKWYuzFiAsQs0SpeJZ6oY/KxANJ0uJdcjS:PySDKFDKWYuJrjdCJ0uJd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676171233, "uuid": "f224e0ac-8ff8-4910-8f47-ba12996796d8", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676171233, "uuid": "314a9067-84d6-4eb2-aeaf-23042bfbffb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676171233, "uuid": "ee5701ed-b5e9-47ab-af05-cda5be13e11d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6b662d-ab1f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676238671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238671, "uuid": "e848e8c3-777e-4fbf-9980-f2c31967dc8b", "comment": "Malware payload", "value": "59a0425e713c9b91b222230f9f7b3007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238671, "uuid": "b7c1b172-7c30-4431-a7fc-1b26f7d6df13", "comment": "Malware payload", "value": "fb03e01675bd06a0bc734a7589bb6d756047f24671a207cc086dad90c1c185b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238671, "uuid": "54f3ce86-56d5-4f2e-889c-68a33c73e033", "comment": "Malware payload", "value": "b4f07011fd324dbbc9dc575d2cb2d2e329ccedbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676238671, "uuid": "6f447211-e91b-41e1-886f-699c3032255c", "comment": "Malware payload", "value": "b78e331ea558196f641466e654ee032ff61488fc963aeb842fb5141b40f87fb80101d2158139f0f1b3c4941e52f5a68f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238671, "uuid": "ec1430f8-3e59-420b-a9e7-fff5ac64cb96", "value": "T1B7F41217AAEC8063E8B1477019F603D32D3A7CA12B78869B574F6D494C326B162353BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238671, "uuid": "807e991a-dc38-42fa-9da9-9df6c3a8cfe6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238671, "uuid": "0ad56abf-486b-488b-b17c-620a7de6165c", "value": "12288:5Mrly90hcplS4uT+EUIYxT48eJvhsHxzPIRMTYk:AyScOSIfCH1Ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676238671, "uuid": "5df9f15b-92af-4843-ac98-f3cf14b0ffdc", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676238671, "uuid": "e24f2b14-9caa-486b-9de3-7e46cbbdacdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676238671, "uuid": "ad976c33-c848-4a1a-b0ca-2c8eb018b073", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e0e995-aab7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676194051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194051, "uuid": "bf2fdb6c-5721-4d08-a4ac-806f4b26b0e7", "comment": "Malware payload (Smoke Loader)", "value": "805582ded27d6706998bbacf190bfd85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194051, "uuid": "95cdfa1d-55fa-4f65-a91d-b6590d62da6e", "comment": "Malware payload (Smoke Loader)", "value": "fb476b8ef22beb0d568937ff3fb7a93310e9b55f6dae198fd31f7d2b91e13462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194051, "uuid": "638fae21-6b10-46e4-81ac-49bbae94c199", "comment": "Malware payload (Smoke Loader)", "value": "ab8b5385f301ab7a133866756f3f78e5ac2f3ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676194051, "uuid": "a29e19f1-0075-4936-a05f-0332bcb10b44", "comment": "Malware payload (Smoke Loader)", "value": "0d3ddc06c574d1b1bca135013e2279247fdfdf7f622a6efd82d5fe1d95559c7bb88a6cdff5a9a4969520a5e2189d3266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194051, "uuid": "90ed92d9-736d-433b-b4da-a09030362d37", "value": "T10614CF227A91C072D19786B21831DBE46A6BBC32B7A2ECD73354166F1E307C14E7A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194051, "uuid": "d7644dc7-46f9-4c62-abea-1263b7bc803d", "value": "cb88fc21f0a7aa72c882b8c1994959da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194051, "uuid": "9c1ab0e9-1fe5-4849-8d7c-1996c81a1349", "value": "3072:8bfq+FASTRsPJYStgBbE1dH6F37ZN3xWEk5VxkroCG3alJ5860tCB:mC3aStT7oncD5VWo73alX8rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676194051, "uuid": "35ca7422-8bf0-4733-91ed-f043fc29091d", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676194051, "uuid": "ab42a4ec-c99a-4551-aadd-b3f486d17888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676194051, "uuid": "170821a3-5515-462e-a594-b8a64c0f7945", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86685cc-aaaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676188627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188627, "uuid": "fb89eb66-93a6-4bcd-8079-893f79ea6373", "comment": "Malware payload (Smoke Loader)", "value": "81205db3f1bdef679efed54ec375af17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188627, "uuid": "b426658b-970e-4116-a3a6-119eb97f0f07", "comment": "Malware payload (Smoke Loader)", "value": "fbde93fdd2211b0f6c4ffbff9821af32b6b9f83e48311223a44ed73c83004665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188627, "uuid": "68be39ad-be34-4326-89ca-a5f6ab3fa8c7", "comment": "Malware payload (Smoke Loader)", "value": "5244f0862a7c0fb6fad6307855855ac0f7ba1804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676188627, "uuid": "2066e680-1ff2-483f-9dde-b0744c841605", "comment": "Malware payload (Smoke Loader)", "value": "7ff6ea138eaf2d9aec3021bd6b4f33da80b9996f47dfd42ab272b251d7f9104ed0052c2e8c2f84092dac97dba3fcbe8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188627, "uuid": "81812adb-ca03-4cff-adc8-a9a62fc7e292", "value": "T14214DF122AA28073C9334AB15B2DCAD47B7FB8B057B5CAD73309069E1E303D15E7539A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188627, "uuid": "6eae2df1-8429-481f-b400-969943526c7e", "value": "436b8e1a5416018622ed4c6d96d64f2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188627, "uuid": "b99157bf-071b-47ae-b883-471d2a445ad8", "value": "3072:o8jqw7+0JG8v5C1kvGECmGmAcQl88OthfdcE5XqcZe1PQs7TJDY:1GoR4eJCFmWlEG+YaITJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676188627, "uuid": "bc2b6846-5835-4bee-8d31-6959a9015fa4", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676188627, "uuid": "f881c238-9342-43c1-8eb6-efb2c585615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676188627, "uuid": "38e73ff6-b129-4ff6-9b4d-5254baad1036", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82ad165-ab20-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676239226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239226, "uuid": "4c7f550a-813a-4148-81d2-500221a29a2f", "comment": "Malware payload", "value": "d922b777bef36844f516fc030a34b9de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239226, "uuid": "4a1af8a7-bd86-41dc-b137-33a5eb862d4b", "comment": "Malware payload", "value": "fcdf68312bde67027973c64f21d8af406b8fcd8730c80e3c01d64e654b795817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239226, "uuid": "62546152-830b-4c6d-91b2-2e0f36c0c084", "comment": "Malware payload", "value": "04b077c16e43f86b58a0d06db6f75dab3efc9768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676239226, "uuid": "6fab9cd2-4290-49e7-a7e8-e82adae1b9b3", "comment": "Malware payload", "value": "913cd9f5f59bc295dc1f73b705a350f7a7f95fde1098398f77367721b10336bbf3319137219b28d1e212ffb4022006df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239226, "uuid": "df69ab59-0150-421b-9850-9671a047b8da", "value": "T16254F21179A2C072E01B86321821DD94EA6FFCB2FBA589D72308576FDD703E19E753A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239226, "uuid": "4c3db4f4-4b03-4dab-9a7b-10a9523f337e", "value": "4fd97bcd302d74255f80d3b6ed694f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239226, "uuid": "0f4e7c8e-543f-4f90-b829-2f1e88b97d46", "value": "6144:R6RtHv28X2eKBkqoAdRhcEnozzzmTjFpcRDqZP:R0BXLKBbf/hccozzzejvSqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676239226, "uuid": "5049f581-ef35-4d21-a333-c3d8e1e99af0", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676239226, "uuid": "1ef0f9eb-b26c-49cb-98e1-6d7d63bed3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676239226, "uuid": "f0fef91d-1520-47b0-a8f0-4f4e4a3612ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bd52cd-aae3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676213157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213157, "uuid": "41183348-ef16-4c14-bfc3-cd9477da8f47", "comment": "Malware payload (Amadey)", "value": "67587bf2a1c0e409ecabbd598159afbc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213157, "uuid": "d4b5eaeb-46ef-4402-931c-9d1490d632c8", "comment": "Malware payload (Amadey)", "value": "feb75ffcc4337f81bdcb6729465eb5cf6a90c537efd22129db39db472b6013e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213157, "uuid": "55071e48-86f6-4c88-8d49-0331787d3ae5", "comment": "Malware payload (Amadey)", "value": "9b856c7eba296908e137b6c6f61bc3462dd6c252", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676213157, "uuid": "9c942b71-9f5f-462f-b888-b9bd07dcafae", "comment": "Malware payload (Amadey)", "value": "5bd3c80d73f9f26f3214b938870d88fafeaa9a3ee6185e1f8ea28e90679c5980cf75310e454d4ea69c947819c580de20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213157, "uuid": "d4c2099e-9a0d-4e4d-925c-a6baccaace19", "value": "T1CBF41207ABD94133F9B8177129F306E32B757E604A7482AB678B6C5A0871B60F635337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213157, "uuid": "d7c9f8dd-4389-4a77-9be3-b332dbd1cd1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213157, "uuid": "b2b33100-f8e9-4d61-9cb0-1874652e8d83", "value": "12288:TMrgy907vZPnzGDkxXpGVbyeJZPpYgeSbAWPgaI+84aKug0N:vyeZPnrVqZPygfrga2PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676213157, "uuid": "4110d313-af21-4394-bf5a-a7479a6c3200", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676213157, "uuid": "5e27a501-4378-4d4d-9f68-05f1ffe21061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676213157, "uuid": "c9630d65-55a3-45cd-8705-dfb9e7f13977", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a310bf98-aa6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676163197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163197, "uuid": "f1f32fc5-b418-4a4a-9e58-4c4a04614b02", "comment": "Malware payload (Loki)", "value": "9431f0d6a03e2ebbdc86d4cbd0a08e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163197, "uuid": "cf8e4c44-b34b-4eac-9899-0299eb66802f", "comment": "Malware payload (Loki)", "value": "ff2b0657fce8d3e04b35421d7012331fddc4d4bcfa685b04ffd84c3a77395205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163197, "uuid": "e1c97f6f-e03a-4b5f-915f-f9e9775be918", "comment": "Malware payload (Loki)", "value": "997134f2753aebca3ccb0ade387de81c6adc063d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676163197, "uuid": "73c6c1ce-fe4f-4bea-a86b-91ff9244c2b3", "comment": "Malware payload (Loki)", "value": "d7ee355e9da55b8df56deb25f40d7894d23c02ce7c795d6cc3b922572f8376695fc5344cc1ef881868155b03e57c5b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163197, "uuid": "bd6ab3d8-7fc1-4187-98d8-b31a140ecbbb", "value": "T1FBD4016C8368CBF6DAA442FF45F154041FB125A6F16EEB0C0FAFE0ED888630155257AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163197, "uuid": "0fd046f6-f18f-4e3c-a46e-d7d8cbb3d9a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163197, "uuid": "ded58473-a416-4364-b6d0-a082ee4164e6", "value": "12288:LSQ23TdZQ/FcP5qsWnEkq6GAWeh3ih9HdA:Ej/rPEsWnLqyBYTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676163197, "uuid": "78ca0b4e-cfb7-4a6e-a048-07bfe721a57e", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676163197, "uuid": "07ea5f48-697d-47a9-a225-f4802c45e072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676163197, "uuid": "33daa4fa-5fe4-4cfa-a1aa-dca873238e1c", "value": "CN-Shpment 1871 - SHP0630613 - 06LCON1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }