{ "Event": { "published": true, "date": "2023-08-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-27", "timestamp": 1693180982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "60185fc5-0999-4ec4-9e79-b41af8b86e43", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3907f33-4513-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693166195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166195, "uuid": "ae1aaff8-2a76-47ad-8901-3549362b1732", "comment": "Malware payload (RedLineStealer)", "value": "f3ad4fb3d67b8f8cbcdd926c5388b96f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166195, "uuid": "3f964a46-aa8e-4bf5-bc1e-88489da0e113", "comment": "Malware payload (RedLineStealer)", "value": "005d6ab4652001479877e0162d429a70dec46a172c0dffd77988569cb4d34d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166195, "uuid": "55001bba-08b0-4acf-9f6d-16869f5d5a62", "comment": "Malware payload (RedLineStealer)", "value": "6d46ef1a94ce905aa7054e6eec56fa3ae398bcd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166195, "uuid": "cff773f3-a3e2-46da-a721-8203366526c2", "comment": "Malware payload (RedLineStealer)", "value": "2666e81db7f597f36c0aaf176bda2c013932e7af139e7ac6afa1a89a88b30f6df1992f00b4d190b27fe2314da2134ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166195, "uuid": "6f1f136a-6667-4222-9142-20bc56e1b039", "value": "T19AE41212B6E84133E9F12B3424FB57C71335BDD29D7893671690A86E0DB2291A531B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166195, "uuid": "17d1d6d5-f7db-41b8-930e-7d08446a89b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166195, "uuid": "d8e356dd-970b-4e6f-9bd5-d06651d058ea", "value": "12288:zMr1y90aawc9qdNrjDQHxXFvmLVnt8sXnB6XTVOH7PZyERR:ay7pdRDQHd6jNB6TVwByw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693166195, "uuid": "68e8b68c-324c-463b-a682-1e5d7cb1ba06", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693166195, "uuid": "f4c161d4-7c8b-476b-9c21-bb22209d6135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166195, "uuid": "9930ee64-266a-4c9e-be9d-a49aa3a508e5", "value": "f3ad4fb3d67b8f8cbcdd926c5388b96f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2308620d-4513-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693165898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165898, "uuid": "329e7bdf-79fc-424e-b83b-319203abba98", "comment": "Malware payload (Amadey)", "value": "f5cd76db82d838f526ceec934573b3ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165898, "uuid": "b279d5be-b2b9-4440-a9d8-167250edbae9", "comment": "Malware payload (Amadey)", "value": "011858af6c9e47c477f3acb091ddb7c81a1f7ba6686a5d0f1efa805c247726d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165898, "uuid": "737ee062-4ebd-485d-ad15-51e8522c5c37", "comment": "Malware payload (Amadey)", "value": "5db3ea8e3228e524086650b3b79b3f82a5aef301", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165898, "uuid": "25bcd729-4c11-48a5-ad03-023dd1b882f5", "comment": "Malware payload (Amadey)", "value": "5c9f37ce8d76e480fbe6ccbeb4354df4d240c2a07065b81b74601db73ccf01136f522695ce08947d4ffcf56b7dc33582", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165898, "uuid": "eec3f4d9-e490-4be1-80bf-ca8f07472ae3", "value": "T1ED652342ABEC542BDDB51B784CF223876D37BC51982CC7673B41AD9E0C32584A4B636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165898, "uuid": "9dceebb5-1039-420e-a791-edb444b9fefd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165898, "uuid": "7571644a-4f3b-48c2-80c1-cceecbf99b11", "value": "24576:2ywK4N8NzglE9wfADvOFPKIDgP+CqpwNXD7M2R4leLf6qkm+xRxU4M3HJYhBaVQy:FFFEEWASBKIDgPhVT7FLy1m6RxU4iHJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693165898, "uuid": "a11e0756-1410-4b4c-9bce-5ae31de7ff92", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693165898, "uuid": "1273bb89-ebc6-48a6-b90b-e392f5ec2726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165898, "uuid": "84acf7af-2acc-474c-8d0f-59830c9b6166", "value": "f5cd76db82d838f526ceec934573b3ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9305fd22-4486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693105527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105527, "uuid": "619b23bc-4825-4da7-8b58-f4186f68e132", "comment": "Malware payload (Amadey)", "value": "ce5cb7c706098dd7b911f4d4cf26f674", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105527, "uuid": "db394a0e-9046-44ba-b519-f0b5db0231c4", "comment": "Malware payload (Amadey)", "value": "0186a161747fce2c87cc2272d77460431ebbd06e7b508427e96197c0e3bee86f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105527, "uuid": "04cfa8ad-5953-49a9-915a-24d2732eb736", "comment": "Malware payload (Amadey)", "value": "6676b0a029686938db1fe7843c83cd5389e3799c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105527, "uuid": "0903162e-3428-4680-91df-f2faa8d2a28f", "comment": "Malware payload (Amadey)", "value": "250b2e852a11f1f87b79cab5f3ffca1669add5b7b9b386e4e360f7b57bfbf381a8286f458f78a3f182543206fe8cda3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105527, "uuid": "13b8645a-9f20-4e69-9101-87a494302ff4", "value": "T1EA051253EBEC9276DCB627B01CFA12C30A3ABDB16D7901576780E88A1CB3554A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105527, "uuid": "957c8940-e652-42dd-be31-a9a84d8873c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105527, "uuid": "19eda340-ac24-4c62-9846-130d4d41886d", "value": "12288:cMrAy90mBG6scR90ByHdXAUDyox3CVsHi0Z4xHx/2/FzXHGPs4duNiO4EBmxmMZ5:synJfRbXAAyoxHi0ZE4dSUv4EBmP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105527, "uuid": "861ce518-c979-4d36-9ef0-102ceaa9623a", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105527, "uuid": "dfa5a49f-e736-4284-b916-8c9334df6c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105527, "uuid": "dd4e068b-3437-4318-b332-06ab398bb59b", "value": "ce5cb7c706098dd7b911f4d4cf26f674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da49c2aa-44af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693123256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123256, "uuid": "c9620d90-cd7c-412f-ab5a-3292374fb279", "comment": "Malware payload (Amadey)", "value": "809292dd3c00e1659b103a1de8ff253a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123256, "uuid": "a28e2a85-6f9b-45bd-b4e2-cf34b10824fb", "comment": "Malware payload (Amadey)", "value": "0243201e709bb9b159bd6f89e83debb1eee7d395cab746813bb42ec72190bc75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123256, "uuid": "d456a31f-6bb3-41b6-87a2-faff89ac3b7b", "comment": "Malware payload (Amadey)", "value": "462fd63684c69baae6447a9d3161723175a4b56e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123256, "uuid": "bc4f3e5c-6f7f-4202-823a-89b3361d3b20", "comment": "Malware payload (Amadey)", "value": "58fb0dbabaf83910faf043d53c849b25337e1752fd24756ddb489b211353d8c2afdd39866ba09ba4b8154fadbb3f5306", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123256, "uuid": "4e18099f-de4d-4bd9-afcc-c2219fd3b1b6", "value": "T160652302E9D88455F8B85B7044FA1B471F343CB2E9F443AB2B8295BB0E31BD5A1357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123256, "uuid": "df210fc0-ef50-4798-9cd6-1d123e9e1b63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123256, "uuid": "d79f6b68-1af9-432c-871b-28e86daf60df", "value": "24576:PywJ+DPmto+JJIaj1KNNgRsiXA+qFpk2OFpiv3abeeyrIj8zt+Ci7tId5nPtMCzX:as+r5yNJKNNgyddozFpiv3i0UQ16QPtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693123256, "uuid": "c9ae0d04-0766-4dc9-aaba-bb696ce86328", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693123256, "uuid": "d9c65e15-369b-424d-bf9e-e9e67e0b63a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123256, "uuid": "50e4ca62-9d35-4814-8946-d828dcdc0d3d", "value": "809292dd3c00e1659b103a1de8ff253a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54144a9c-44eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693148801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148801, "uuid": "9f249b34-12dd-4bb8-841d-1aed396a7eaa", "comment": "Malware payload (RedLineStealer)", "value": "4fb5df809dd5d2956345cd5e322ebca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148801, "uuid": "cd078429-896c-453d-ba7c-84f92dacd20d", "comment": "Malware payload (RedLineStealer)", "value": "033ce6618294034498cbe7effa50efb534a0470bf59202133262b93ad6152c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148801, "uuid": "31e0a136-4c54-444a-b65d-c8164a39cbc9", "comment": "Malware payload (RedLineStealer)", "value": "6339c10c62faeaa3c7f9af553f2a52836a22be31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148801, "uuid": "e6353f77-15a0-4ee2-8792-d530712f1865", "comment": "Malware payload (RedLineStealer)", "value": "e4b1e131317ad304fc88e7b80e92643ce7b2e3d63eaec4ebff758de757a82e7daddca65929439bce88e8f71b18ed1ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148801, "uuid": "370bd076-178f-4c3f-9a32-018fb539a0f4", "value": "T142E41253ABDA10B3D9B19B7094F613E707317CA19A7843276345EC2B0C73696687A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148801, "uuid": "78d28a2a-7e6d-4c36-bd6b-85363630a4d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148801, "uuid": "24c2feb9-c6c9-4d24-a40f-1e0ad6bff203", "value": "12288:AMrSy90Va5D9byiJMG/iKzbFrHKH/UUAVqrBEBbz0hQcc/TVbXC7RssHOS4UNO:iyuC4cPBzbFzKH/UzVqrB60irZ/sHOSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148801, "uuid": "2ef2519d-13eb-4734-8934-7cdcf6ac7267", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148801, "uuid": "d27debed-a302-46ea-9e2e-d0b34fa03cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148801, "uuid": "d0999f76-5881-41bb-b57f-5aefc980a0dc", "value": "033ce6618294034498cbe7effa50efb534a0470bf5920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea386ac-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693126243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126243, "uuid": "161e7dc2-04fe-47f0-9b6c-04b757274668", "comment": "Malware payload (Formbook)", "value": "7a200703b43fa4a8657e46d67e8ee8e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126243, "uuid": "0cc8e8fe-c678-4fad-88d7-0f2c7656d22d", "comment": "Malware payload (Formbook)", "value": "0361bde7da9104b4a09db39ac90c1af16e0aa137f4f33c57c9844066ce7c6d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126243, "uuid": "d0723068-21e7-4459-922a-f57428933938", "comment": "Malware payload (Formbook)", "value": "d35eedf117ee69c99889796e9b38a5bdd0e1d57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126243, "uuid": "593f3bfb-fa76-4c83-ba18-1619881dc0f1", "comment": "Malware payload (Formbook)", "value": "1c82c8e305468503f51955c989f4f564e657e7db711e77df0e1d06ccd477abf821b475bc0c19f1e933f44f88a6c119a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126243, "uuid": "49742148-1370-4865-be20-f7864f17b5c5", "value": "T1F1E4BE4EB3604297F0182B79CA7D6E1902601C7C75D2EBD4BDA57B1BBDE2BA6143301B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126243, "uuid": "be284f5b-0e55-47ef-85a4-d07491e184aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126243, "uuid": "a45aa526-2bc0-4820-93dc-9db7e449d276", "value": "12288:5Ap3sWJp0FMeEwX0KjEkby7CwD4k59ojy2GMoRa/VhssocP4uVRF:5XFFYwkKYyYP5ESwVK5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126243, "uuid": "bede677d-8663-4cbc-810c-7570c84eca01", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126243, "uuid": "25edeb70-61da-459b-be5f-425fbf5ca7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126243, "uuid": "8557491f-ad49-444e-84a2-2df2cc1cbda5", "value": "BKBMO989768223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d9cf4b-44c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693133776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133776, "uuid": "fd9702d1-7583-4714-bee5-28b360abc787", "comment": "Malware payload (RedLineStealer)", "value": "4dfb3fe1233558d8626fa03bcda1ffce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133776, "uuid": "338bef6b-f5ab-48f8-94ef-6103f793a5dd", "comment": "Malware payload (RedLineStealer)", "value": "03b32d68b98cb38f76a8591a2e0bdd796118ebaa846fed8571059d187c28c63e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133776, "uuid": "59bc7458-784d-46a4-9e0a-0715cadfb780", "comment": "Malware payload (RedLineStealer)", "value": "7176c94716cdcbf5ee92a4c8b3820e8053bfe0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133776, "uuid": "ae9f942c-cbc0-43bc-ac17-2b2c593bb054", "comment": "Malware payload (RedLineStealer)", "value": "e772d7931f09cc7faa9553bb2f84aa78628c1e15b99d400d4a5498090fc83f36dfd2051277cb0fed4c589ca6c5683ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133776, "uuid": "f795920b-aaa4-4855-baa3-aa1f4859b2f9", "value": "T164052316EBC85972CCF577B05CF602971A38BEA1AD7C822F67119C0A0CB3694693375B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133776, "uuid": "2e384c55-66e9-40be-be80-5145e92b8377", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133776, "uuid": "c7bdf3a1-eae5-43c8-a001-e13e33a8f882", "value": "24576:iyxOenPlAGrFIhdgB29jlAlTnj9N16OW2Rw/A:JPPlAGC9jlAlTEj2S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133776, "uuid": "4354584f-015e-4a65-babe-5f42c7a2cd7b", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133776, "uuid": "0a35eede-16b3-4d3c-8d92-9fdff1cae5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133776, "uuid": "04288cdc-2f1f-4b20-8bad-329eef88d35b", "value": "4dfb3fe1233558d8626fa03bcda1ffce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8079671f-4512-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693165626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165626, "uuid": "669dc266-a87c-49fa-a991-7a098d1f1acf", "comment": "Malware payload (njrat)", "value": "18b7b51ab055f7af12a53b1d2dd63f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165626, "uuid": "414e7ee4-84e5-43a4-898f-980ea9e56fad", "comment": "Malware payload (njrat)", "value": "04b83cfb61645ef6aed2768b17841cad50bc34d31ac4c8311fae8a6038b23cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165626, "uuid": "835e9087-3596-4c77-9c79-25d1e8bdc7fe", "comment": "Malware payload (njrat)", "value": "c287aaccf3d40d08fce75a85932a6f8dcdc72565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165626, "uuid": "1200747a-512d-4234-b7b3-a6d4cdebad7a", "comment": "Malware payload (njrat)", "value": "01206f4c81a8a2ee61a839e196acbf7c2dbf45a02f7e1d624f46dd379b6ee76fd71bfc22e4dd80069518a3431d681cf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165626, "uuid": "c3595c3a-c005-4244-872c-a0cec2dc9810", "value": "T1EA032A4D7FE18168C5FD097B06B2D41207BAE04F6E23D90E9EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165626, "uuid": "e45762f3-e85a-467b-a308-5af5dc0d927d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165626, "uuid": "1ba52313-c305-497d-b5a8-280f19e411cc", "value": "384:Z3Gwkfsgwi+Jx3+j/NSyszkoAXVs3G6aBrAF+rMRTyN/0L+EcoinblneHQM3epzk:Npkk/CNhszkoA+26OrM+rMRa8Nu+ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693165626, "uuid": "bb5d35c6-493d-4d10-8f8f-3d3cefcb863d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693165626, "uuid": "40b0209f-3fc8-4b71-8a75-31f80568fdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165626, "uuid": "0f25c7b1-e418-4e85-a0bf-e82261ec84da", "value": "18b7b51ab055f7af12a53b1d2dd63f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c18c3b-446f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693095524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693095524, "uuid": "6d37438c-7e25-4999-9765-f0007cb895b7", "comment": "Malware payload", "value": "c3a84146c32893be4d862ccd2e62abb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693095524, "uuid": "f64efc94-6810-4d9d-b608-913073c51b4e", "comment": "Malware payload", "value": "053d5e1e96bf6c648c1bf0cdef60e4d640628e19ef5ea405e53cacc663477ad7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693095524, "uuid": "46fe3cc4-2df1-45cf-a409-88a11a1fb6fd", "comment": "Malware payload", "value": "2c3710038b5968d42d8e3f71bc50497c7d4e0a57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693095524, "uuid": "3bb5e7c6-e7b0-43c7-8fec-5b1ab039a8e3", "comment": "Malware payload", "value": "f381a54caf95e68916c73b5568fd44f9d9ab86a195528859ae0d05b1317453a520a339ed3db416bb8060d0e6deaf8e78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693095524, "uuid": "1bb3e9ff-06f0-4b09-9257-81eb157d9060", "value": "T192A52271E50AFD359AA68035F33EFD24FB025AA14B1AAC5F5373F1A40B51241FA2B709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693095524, "uuid": "029bdea0-ee64-43b0-9248-7edc4d6df5e9", "value": "24576:nzCxwDZepeCDBMS6wdw12YB1mfXo4UB43osGB0t/VYFXglRBFhnI9X27e07oxpN6:YtvYdX+ZVYBaRh8GKmoDGE0tmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693095524, "uuid": "593e1f7f-3b5c-4e7a-90d8-ced65b167cfc", "value": 2079404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693095524, "uuid": "c34aa37e-1384-4138-88f5-30c6388ef0df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693095524, "uuid": "7a3aa7b1-8a2a-4b47-96ef-a1164407d39a", "value": "@Shun2463.txt_.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350acb15-452a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693175807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175807, "uuid": "b7d8c0a6-3d34-45e9-ae19-5019790db5fd", "comment": "Malware payload (RedLineStealer)", "value": "9d5f44519974c49f254df5fc21d2b94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175807, "uuid": "2715a715-e0a1-47fa-af42-b060b2be3328", "comment": "Malware payload (RedLineStealer)", "value": "053f58726d18d42b506260743a85ad3bd93a67642cca6da3b5e7812a2464a80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175807, "uuid": "d703b13a-6b93-4140-86d8-0e14502627d6", "comment": "Malware payload (RedLineStealer)", "value": "1e94e8a368f63cd1207020b5a85f32da93ae0867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175807, "uuid": "d36f673a-6195-4bb3-92af-2aae2d6950a7", "comment": "Malware payload (RedLineStealer)", "value": "7a0e8fb4b860dc8c99e81647f4ac75e2b1e6b733bceafb5ad9f7800f778b6fea7025c65a97430b8b843ea51fffce9be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175807, "uuid": "66845879-ed1c-4bbf-a247-8f12abc3ef96", "value": "T1E6152213ABE95033E9B91B7118F703930B377C915869DB0636A5A82F0C73A91793672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175807, "uuid": "15496522-352c-43d2-812a-27cf0e5fd18a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175807, "uuid": "047a1730-d3b8-42eb-ab5b-0e1842351cab", "value": "24576:UyqB39suruzRsa16pJG4CoCHK5ULL1fYZAX5PcvQ8L2n0MiE:jdzRhL4TCDNF5ujLwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175807, "uuid": "d961f266-79f8-4acd-aba9-e343b7c50b15", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175807, "uuid": "4f83425d-1e68-4dd0-83db-4ea113d5cf4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175807, "uuid": "5ba21d96-a772-4619-92dd-561aa5e00e13", "value": "9d5f44519974c49f254df5fc21d2b94e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c280e4-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121370, "uuid": "a080a490-fb51-4868-8c47-7cf082c01e4f", "comment": "Malware payload (Mirai)", "value": "a468f57dd5228e9d6a69196ae8cd946d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121370, "uuid": "ccbfb306-eb90-4e4a-8aae-c5938772b4de", "comment": "Malware payload (Mirai)", "value": "06495b3d89ca1dea74561aee10684cd95c27bb3d7b160505159dda845c7594a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121370, "uuid": "18706d3a-5ff1-49ea-8498-9e6fa05e80e7", "comment": "Malware payload (Mirai)", "value": "7d0fbf1d99b619ec93de1d0b5417440fd7cf6f87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121370, "uuid": "c5063193-0951-4fb2-981f-8cf1d7d06ac3", "comment": "Malware payload (Mirai)", "value": "18776348cef9057d9bd37dab34ccd99062faae244fc6645f386d49b6810a3aaf5302dbfb85c8121078f47cc8e53f7953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121370, "uuid": "43c4103a-1f2e-4084-8748-4687a55c3300", "value": "T183535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121370, "uuid": "4cebb5a9-e025-478c-bc84-f6e6b3bf0ef1", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E81:N1GjR8EVGOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121370, "uuid": "0f3a85e6-0cac-45df-8065-ecb812556888", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121370, "uuid": "4b02f174-c737-4aa0-8898-b47539208d20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121370, "uuid": "64761ac0-4364-4f33-8bc9-252c9d1d4cb7", "value": "a468f57dd5228e9d6a69196ae8cd946d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e08e3f-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121365, "uuid": "ea9fd4c0-50ac-4c6d-8a3b-b866ef43b9b9", "comment": "Malware payload (Mirai)", "value": "7d29169c0cb6a72bc3619470398b42dd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121365, "uuid": "83ce0c08-1736-460f-93b0-6faa8b60f5e0", "comment": "Malware payload (Mirai)", "value": "0720338dd33db4f0b151afab8c29ffc790ecc3fedcf2e8f21496b800c8957da2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121365, "uuid": "68bc0d5d-1096-424c-815c-596fb370427b", "comment": "Malware payload (Mirai)", "value": "7a341cd03a6f859ea6edea0b5747546085d7de4f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121365, "uuid": "0ec1f131-e406-4a67-9cd5-dce53513c7c9", "comment": "Malware payload (Mirai)", "value": "d35405ff80d4b4412ca0ebfb84374c9b3058e5d401ff7ea05206fb797a9f30c338773a3931877e41cf620b781ac884b1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121365, "uuid": "24f4b268-9659-4901-9692-71cb53351f44", "value": "T1A6D2D0A984E7F1B8D0A6A6B9003D06C5FDB67216D22607B709E87476DE170C90E30DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121365, "uuid": "62eeeced-b1ae-417f-9342-b657223103db", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBnSRSx0sS:kYJdJZiy1aBnQfTqBnptS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121365, "uuid": "b553fe8c-1d06-486a-9300-286a2edd3375", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121365, "uuid": "f1255f0e-d80d-4cbe-8a6c-8d1e61c9bdea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121365, "uuid": "a5f77b6a-6d56-4c7e-895f-f9bccc48e31b", "value": "7d29169c0cb6a72bc3619470398b42dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf25a23-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175096, "uuid": "aca3e086-94c9-45fa-a845-915b9b72534a", "comment": "Malware payload (Mirai)", "value": "3333e8e3059ac86a05139c033a9311b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175096, "uuid": "4a3f2c95-4cdb-49a5-a85a-623a0db3e330", "comment": "Malware payload (Mirai)", "value": "076931ac662d5be6d4f0c54167dbc30b30a6a7311112ebaf5460c16faf05ea14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175096, "uuid": "577c6110-a3e5-44cd-b310-ea6e5cd5fd66", "comment": "Malware payload (Mirai)", "value": "528b0f4f5e2c4148a49dda24db37cdd6c87647d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175096, "uuid": "8f4f99ce-719f-4312-968b-1f52bc9059bb", "comment": "Malware payload (Mirai)", "value": "e6f0ab634f90cec3c783cd646f98087e5d53685f50593f358a7a5071594ab07196f186b781d60eb7377e913068eb5f91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175096, "uuid": "c5b985a1-e6c6-460f-a527-91a07e6d95ac", "value": "T1D6D2D0ACDA56FFA9C94CA47C09DE02726E8434C37B9D4A8E0712448D3A7EB4BFC1D521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175096, "uuid": "a03d7148-6a47-4fec-beae-e7a44c2e5b6e", "value": "768:11uUtLrVDsAp6tLkFqok//xDMfcAKJbiWUy:1bDs06t4fYpwMmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175096, "uuid": "a2521d09-9840-4556-b9e4-c57b20875141", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175096, "uuid": "1b34f345-8647-45cb-a9b7-a1da6f2e4175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175096, "uuid": "e3301721-d8b5-45cf-bcae-d6209c25f705", "value": "3333e8e3059ac86a05139c033a9311b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b95661-44e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693144294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144294, "uuid": "f0381f2d-a0c5-4f0b-807b-274a8568ea60", "comment": "Malware payload (RedLineStealer)", "value": "2daeeeafcfc0cda3f42a7c95c10b4490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144294, "uuid": "e2467e8b-4f34-4d7c-9b10-dd468fef04dd", "comment": "Malware payload (RedLineStealer)", "value": "076bd425a6b94c8ba5e617fff6a2ef1aa16599dd55fdb042ddd44a30752aa016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144294, "uuid": "38b562ff-6154-4944-baf8-462939be0c97", "comment": "Malware payload (RedLineStealer)", "value": "2511d44e171391bbe71412482ed4e3ecce633c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144294, "uuid": "7440ee94-91ea-4e6f-b9ca-4b691046dfe9", "comment": "Malware payload (RedLineStealer)", "value": "4a5ece9d050c1cd31133090daa2330d7e510bfca866b3ef4a0847bf36ee0a1a1c44906d6f2501f58f51c7206add73c44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144294, "uuid": "2ba2cd3d-0cea-459d-b14b-219acd0ceee9", "value": "T120152367ABCD4472E8B4537048F652831D34BDB19878C36E279AFC4E19F3A54A432B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144294, "uuid": "3bfc5b6f-6cff-479c-8140-0e951c0be55f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144294, "uuid": "0d6e9c29-ef94-478b-8dfd-728ec5cbbd26", "value": "12288:EMr3y90w8ejifNmUJiT1+QqB98DabdHfEM6PNZnxBVZWtQhZxwGArIFN8QXAr/Tt:DyV8FNb78DEEM6PtMQhsGAE8U+DOlRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693144294, "uuid": "9717f794-54e2-4bd9-89df-2a80769267c5", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693144294, "uuid": "81a87650-f4cb-4f59-a767-977bd9446d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144294, "uuid": "993b5dd7-74c5-4755-a034-1aac3135d350", "value": "2daeeeafcfc0cda3f42a7c95c10b4490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8937645-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110342, "uuid": "9c4d2d9e-c381-4711-9b88-740f921dbd52", "comment": "Malware payload (RedLineStealer)", "value": "b1b5d23e27d1ae6c51aa6462a5a9d6de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110342, "uuid": "395a7765-9c61-4c80-834a-a7026450f495", "comment": "Malware payload (RedLineStealer)", "value": "0831953010fe0abafbfb2500fff8db6a9d0f9d18908e6690371c611c43995b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110342, "uuid": "f87400cd-f82c-4068-8a16-5407d33bf28a", "comment": "Malware payload (RedLineStealer)", "value": "4a1cad928429e52c0550aebfdc79d1602ce19399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110342, "uuid": "3f201580-16ef-4f06-8862-307b45981492", "comment": "Malware payload (RedLineStealer)", "value": "cd8ab5c3991496266696b04cf1c91541aead3c9565a44bb4cc7ab098bfcc99c65341b2212e4b954f9ccf87766b50ed17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110342, "uuid": "186fb205-0514-4348-8add-b7dddce4d8c6", "value": "T111652357BEC91035CCB92BB058FE27870A717DA27979032B2791D85A48523C8F2763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110342, "uuid": "ca685095-1022-42d4-b3af-d6b3a90ecf01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110342, "uuid": "0c47362e-3f08-4405-92ed-c26245e8c432", "value": "24576:GyXK/SJo9xG+NYyVoA2i0KCZXyK5nvAvcBHy1jPSqYjzajJnfz6p4rAd/f/Tc:VXm9BNUnKCZXyK5vAvCHy10jzyJ76irU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110342, "uuid": "b81385ad-751b-4008-81b0-440ba4c9e37d", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110342, "uuid": "14f25cc8-c5cf-470f-a8b1-bcb84651aa5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110342, "uuid": "abe44e3f-1bf8-4e45-8866-747755864e91", "value": "0831953010fe0abafbfb2500fff8db6a9d0f9d18908e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c00092-44f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693152003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152003, "uuid": "16d10bf2-932f-45af-ac76-cdc6542692ea", "comment": "Malware payload (Mirai)", "value": "9ed2f621deb625893bfcdc3665a62264", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152003, "uuid": "14570536-cf59-4e0e-9e48-9139603c0e3a", "comment": "Malware payload (Mirai)", "value": "08eff21810e46fb0989bb39a6cdd812f32e064f2f038e7a0a6411e79e356b7eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152003, "uuid": "5d3e8ce1-c2a6-4534-848b-d4af487e900a", "comment": "Malware payload (Mirai)", "value": "d54540916fcfee0cc8d6025193fa467fd79df93c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152003, "uuid": "3eea723b-09f1-4859-9790-3ff3f1ee0d5f", "comment": "Malware payload (Mirai)", "value": "7330b7954dc8e52110883466effc69666fe9ef8a1e9763cbde838423515d3b686998f7603b7fb0d72ae2c9f669efdbd6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152003, "uuid": "2844d7c6-ec1f-4cd7-abdc-0a5902ab3bf9", "value": "T1A6230271490E8EF124303C76EB95D793BAE12975C66730139A290B3C2FB5B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152003, "uuid": "bb14c9a4-175c-488e-b73f-c0472dd7be9f", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3WK99q3UELbUXfi6nVMQHI4vcGpvl:DECFd+A6YHAxWKQLRQZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693152003, "uuid": "40606b83-22fc-4845-9595-8290fe136097", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693152003, "uuid": "1df1f2aa-4298-44f7-9054-e81c5e7e6613", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152003, "uuid": "b565c40a-af51-4bb2-8e75-a4d218a7a5d9", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ed01fb-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149368, "uuid": "6370dc6d-c560-4ce6-826c-e7dcb69fb0e5", "comment": "Malware payload", "value": "77ef68b5ecd3530396e5d76c872bfa55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149368, "uuid": "59cb7bf9-4cb1-4247-beaa-b6d07e2df5da", "comment": "Malware payload", "value": "099853536f90589ca40545e6908e7a3ea98dca8860095d3b8ee9560cbb8f0232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149368, "uuid": "668eb484-a288-4451-b64a-d985119341cc", "comment": "Malware payload", "value": "dcad244cfe08f31597fdf6682269dce887cd3257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149368, "uuid": "2a832d4d-3468-4daf-b2cd-59896af83988", "comment": "Malware payload", "value": "d6e0cfc950659ca83b3599e866fe2232b67b1d48c776bb350e581661596c4ecc97492ef1d557f0ef43936964dd3b334f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149368, "uuid": "b20bd412-becb-4ea8-898e-0b4510856e72", "value": "T139833A0399A19FB7C196AAB026B745700713E8105B1F2B897239ABF4474F9CEB81F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149368, "uuid": "c6b92e84-7843-4dcc-ae90-f8e3f8a8a13b", "value": "1536:ZGY9jUi/xK1le3dPhlRT16TJCeIBTILDmjHVqYLeRR/8Q:rbY1APhkTJ5IB8mjHVqYqRR/8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149368, "uuid": "171fd5ff-16f7-46fd-90be-07abb29c93c9", "value": 85399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149368, "uuid": "a55f12dc-238e-48fd-bf8e-bb5176442140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149368, "uuid": "01cfbf8a-589c-4837-885f-52226c810835", "value": "77ef68b5ecd3530396e5d76c872bfa55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb76058f-44fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693156303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156303, "uuid": "73f8002c-9fbd-442f-8fce-feada1fde288", "comment": "Malware payload (Amadey)", "value": "077877515cd1d61c2858b2df1b33ba46", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156303, "uuid": "86066b67-bf70-4913-9ff7-0f529e129cfc", "comment": "Malware payload (Amadey)", "value": "099f412d403191db0a716eaa043a9451ab07ca170d57aa17a041c6c1e57cef7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156303, "uuid": "7a71e676-c0e9-4a8a-aadc-1e21637009f1", "comment": "Malware payload (Amadey)", "value": "593294b2120df705820907983a21a5e25dc3c6d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156303, "uuid": "271fc590-6236-4c4c-97d0-f20b4da225fd", "comment": "Malware payload (Amadey)", "value": "f507991d6e6ed0914ba502c430b19aef003aab7fdd66a4f5a10d72314090a056b13f61b2943d4881c7cfc1d74ac2cf90", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156303, "uuid": "a23d2262-a257-4f95-ab22-19d08e5ea97d", "value": "T16B23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156303, "uuid": "5edf762e-9d31-410f-ab98-f042b28b5ac9", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693156303, "uuid": "13e9d5ed-4343-43cc-bf7a-87b10e5e1681", "value": 49197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693156303, "uuid": "a4aa7fbb-6f5b-494e-8017-00918be71711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156303, "uuid": "abf443c5-7b29-44e3-a2c4-558518c5aa29", "value": "077877515cd1d61c2858b2df1b33ba46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f4c45c-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693178058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178058, "uuid": "f706a3bc-a6b6-405a-8573-2a0d191de848", "comment": "Malware payload (Mirai)", "value": "8521fffa3816e0c7033a3b4e3d963807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178058, "uuid": "64c886ff-d047-4042-b141-be8b2ee50187", "comment": "Malware payload (Mirai)", "value": "09b1df04f09dbf22e53c147a415ca0efad63c40710df0fbd1179e767b304e912", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178058, "uuid": "b7570cef-4a24-418c-9f2b-37fff7f06d03", "comment": "Malware payload (Mirai)", "value": "95dcbd4119f823401a759db4199935656cc7b4b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178058, "uuid": "f583cd80-bb97-473b-a7fe-d49819738b2a", "comment": "Malware payload (Mirai)", "value": "4b30282cf2b96313e5698897b045dd739b402a677ee3d4185dce2693183ab8a77de99f23b49510442e7042cbeb0dff93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178058, "uuid": "93bf7b2a-e0cc-4cbe-93ae-f552a8ec0723", "value": "T120F2F9D5B881BA2AC7C145BBEF4F051A3364DB9CD15A7743E82807E4B747D0E8D12B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178058, "uuid": "4f8a0881-f25c-4295-a248-ac47763c4eed", "value": "768:Vk8l4eAgQNKOHKCy6EdgC99yZ/ha0frgQJqyX9If7Wp1Pqlh/fwhFumWIwymbMRa:Vx/q86Ed8Z5gE8CuKB+DHCAsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178058, "uuid": "18e5befc-408e-420f-8a51-0a95df7459b9", "value": 35420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178058, "uuid": "515063be-e14d-4557-8565-ab296104344b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178058, "uuid": "e4adff21-ab6d-4790-9115-d59b7a031442", "value": "8521fffa3816e0c7033a3b4e3d963807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a831617-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693178044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178044, "uuid": "17d181f0-3f56-44be-a674-a82970ca3a73", "comment": "Malware payload (Mirai)", "value": "89ee71f0290006ba905547cb8df080dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178044, "uuid": "45dd52a4-973a-4f57-a954-78044d310356", "comment": "Malware payload (Mirai)", "value": "0ae04a36cd9cd7dc36765bb8dcff3c0b5eb2fbe29d2a5feecf2ee0247de07b8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178044, "uuid": "04f8e858-50d4-4eec-bbd7-630faa024b92", "comment": "Malware payload (Mirai)", "value": "e7d1891ef44352ea264b67f798667048fe272981", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178044, "uuid": "df706e1d-778c-464b-bfa7-8298191e8c85", "comment": "Malware payload (Mirai)", "value": "aabd69213c76bbfda65370458631eaf1492b2c95437468cfab3c90afb908228c00dc8a800cc83e378ab66c1d37e1a682", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178044, "uuid": "f421afff-f1dd-4bdf-a034-c9f730c1f20f", "value": "T1B393F907EF610EFBD86FDD3706A9074535DC444B23B92B7A3674C828B64B64B4AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178044, "uuid": "fd15acfb-a60a-4ec2-a8c0-94e5fa654787", "value": "1536:kHnfOuSQWu3KxRJifZd1/Fr5pBq3EZXfDoFmGUxHfkQ0D5T:kHnWEgRmx5pBoE4Uxe5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178044, "uuid": "d912335d-d222-493c-a393-c4e70b26de0d", "value": 89956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178044, "uuid": "97489a8d-0d9e-4d8b-8638-e9eb8355c429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178044, "uuid": "ae0371b2-0610-4f7e-96a0-8ef3c260b1af", "value": "89ee71f0290006ba905547cb8df080dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2f0eb4-448a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693107073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107073, "uuid": "138e27e9-3bf1-41eb-8738-6b72d02a4124", "comment": "Malware payload", "value": "03d7972d8e56131c78e0905021ef37c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107073, "uuid": "621d1629-26b2-4acb-a838-a1bf44e794a8", "comment": "Malware payload", "value": "0afd2cb09ddd87d1aec7f8d80965f427bb6bb687b6ebbe62a7f30df4710c95f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107073, "uuid": "db3bbf1a-e1ae-410c-9f14-53d93fb68b15", "comment": "Malware payload", "value": "6db23c80e95cfd9b9e58e8eaf9bbfe9190551420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107073, "uuid": "3cc82e2c-6c8e-4f08-9351-737717d4b78f", "comment": "Malware payload", "value": "a632b92b05dc9a19a53c0242ed914c88a17990a22977123c5c1fb6d00e82d619ddebff2692b98fa36c86daae6df3069b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107073, "uuid": "8c549831-2232-4376-832d-423c4805a9a0", "value": "T103D523167AC48931C8791D351AE597B2BB3D3C301F698EDB93A81F1E8F316D06936722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107073, "uuid": "49fa060f-2e6e-4720-83fe-21de301381c4", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107073, "uuid": "104729d0-6659-44cc-9632-23a9668d57f7", "value": "49152:acbz6+6HdkCgpvUqH74KZoETZSBRixrm0ZYO4stBSiQ5r/5HvzQmMa8aP2C/cifj:acbdCqCgF74F6ZCU+BKSj1sfa2CUib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693107073, "uuid": "8c5374a6-b67c-4768-a425-394241d3606d", "value": 2844575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693107073, "uuid": "cb64e944-0c41-411e-8115-7e2e3978a70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107073, "uuid": "c153af9f-bdfc-40c1-a14b-e6f0be9770b6", "value": "SecuriteInfo.com.Win32.InjectorX-gen.18189.32289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff61fbc7-4495-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693112152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112152, "uuid": "8313c766-be5f-408f-8cef-9dbe64941651", "comment": "Malware payload (Amadey)", "value": "3cddcf386d066012febbfe409c20dfa2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112152, "uuid": "76c66f22-5661-4142-a660-35f001190a59", "comment": "Malware payload (Amadey)", "value": "0b7e7a38bb4d55055876360757046582b2a1a8dcbc0b5e26e155d28554c74e9a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112152, "uuid": "f3fd3f7d-c833-4aa0-911a-4b0e874fbf0c", "comment": "Malware payload (Amadey)", "value": "c999becde75b041d532debcd93548d3ab43941ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112152, "uuid": "ab33eae7-f3a3-47fe-9fc2-dd03ffee8651", "comment": "Malware payload (Amadey)", "value": "714fbb59a6f2feff5cea49c49ebe049eeb84c6967b7c98e70e79d7b52e41e98b97dd67f3df789d49ad54f599aabbc5c2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112152, "uuid": "1b5a7a9a-c7bb-4f01-b5c9-16bc338a9c4b", "value": "T1AA23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112152, "uuid": "b70a9cd3-95cd-420a-8dfb-9e7e6dd2b7f0", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693112152, "uuid": "cdc91ca6-4421-43fd-b3c4-690b29ebffbf", "value": 48843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693112152, "uuid": "31605769-e054-409e-b077-7f2a41e82257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112152, "uuid": "0edff0a0-5bcf-4513-ae75-436c3213f3c1", "value": "3cddcf386d066012febbfe409c20dfa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3001a769-451c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169786, "uuid": "ef685c89-151a-4b2a-b01b-c193d1c1e9c9", "comment": "Malware payload (Mirai)", "value": "322fbff1decfcb630db22de9e83e7831", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169786, "uuid": "62057285-2015-45b4-9ea5-1eb60ac32be6", "comment": "Malware payload (Mirai)", "value": "0c3665c2d14da2abfd70b0234eb13d222050958d855656b4c9f247603708db0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169786, "uuid": "bf850851-1c99-4845-ab80-22b855467400", "comment": "Malware payload (Mirai)", "value": "62cdac865221412d5cf6fcdbc216ddd89992eb82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169786, "uuid": "e3c91fcd-6d50-447e-8046-ff73aa26938b", "comment": "Malware payload (Mirai)", "value": "f87df0c85bbccfc9c9918b52f616f5819392ef6517d7ab9de2f4211c8a532f80814a9b9beb48184026c13f0f12323a85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169786, "uuid": "f5cb087c-2c16-4781-a555-0306e46d0a2c", "value": "T140735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169786, "uuid": "cdb1841c-39e0-4501-991e-35471fab24fa", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8i:YwfdNu4cmZvFqI3w7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169786, "uuid": "b7798c4d-bfb2-4e65-9906-c752ebe506f3", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169786, "uuid": "26da9115-ca8c-451f-a2d0-92018cd1b8f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169786, "uuid": "cfda30a8-207c-4915-a0a3-447737a98bea", "value": "322fbff1decfcb630db22de9e83e7831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704bf3ca-44d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693140688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140688, "uuid": "8c4d758e-0fd0-4d05-836f-b2099bc33113", "comment": "Malware payload (RedLineStealer)", "value": "4f8336febdac54e91e5082ee86f5bdb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140688, "uuid": "1155a0d1-e637-491c-957d-f58233b06790", "comment": "Malware payload (RedLineStealer)", "value": "0d14a7893e3872b0effdb59ef56eb45824d992caaa8211ed975581fdd563b096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140688, "uuid": "e029ad5f-da45-487e-a70b-928eca3b9a5b", "comment": "Malware payload (RedLineStealer)", "value": "ac3fd3aed1363c9290f84e6b706c738f47679fee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140688, "uuid": "222bad6d-6e2d-4239-8ff7-31e63a3fbe58", "comment": "Malware payload (RedLineStealer)", "value": "b8488a934e900cafc637add27289abc514f4e779ec513caab787915929def51e92367e3886c435f91139e06c961774b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140688, "uuid": "3a76b273-548d-4ebb-b03c-9111a56f211f", "value": "T17CE41253FED89577C5B21B709DF252831B35BCA28CB853A227C59C8A1CB3690783176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140688, "uuid": "11e82bd2-bb24-4dbb-aeb7-b9fb29ad12f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140688, "uuid": "b7f680f3-2e4a-43ac-879e-3e3503a96e9a", "value": "12288:3Mrwy90LmSg0hB1yr9LPgGASEsOR9LtW+GQuNDKNBNWvkGl:Ty1csPggEs0JtBNil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693140688, "uuid": "30a4ebaa-9fc5-41c5-bde6-fcda549ad7ee", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693140688, "uuid": "8bd92a7d-f720-4a86-8808-c1601182f665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140688, "uuid": "d65cedbb-bfa0-4041-a30c-0f4d77b63a72", "value": "4f8336febdac54e91e5082ee86f5bdb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a3f59e-44bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693128963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128963, "uuid": "a516ae9b-5ad3-4d36-a72c-3e0659135019", "comment": "Malware payload (Amadey)", "value": "add07f12c97957c57e884824145fa450", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128963, "uuid": "6c3b233d-1efd-4060-acd6-39890de79f87", "comment": "Malware payload (Amadey)", "value": "0d8e64c713c628063cbe4f20a1a6b89f02badd694f5f3da1ffd1c362ca147f0b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128963, "uuid": "b484fa7f-0ee6-4733-b165-66eb41273896", "comment": "Malware payload (Amadey)", "value": "ddc90965ad8e2ed899e150451d648d956870f2a0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128963, "uuid": "62e9a15b-23dc-4e41-a8e0-673195327935", "comment": "Malware payload (Amadey)", "value": "d76f070963728f7bc83f44ef568ae66c7e75f350d93de3aef58021d0a3fd54579e50a831cd74bf52047388fb8ee6ff59", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128963, "uuid": "608b416f-f783-4686-9f7c-e46d0e1ca9e7", "value": "T10D652343B6CD4467CDA10B709CFA52836F353C759BA4C26F2B52690E0C73A89E63572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128963, "uuid": "d9e67357-d75a-41a1-8193-8e5aafc5a29a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128963, "uuid": "1e8e2213-568b-4dc1-84a1-9b095c7b9196", "value": "24576:GyOGlBhLuMEog8FOP2y7nVweKf+rnMqVH1PC7V3vhtNY8dLFWawMB2MWsCgUSNhP:VFBhLSo/4JKf+rvo3vCILJB27uNh/Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693128963, "uuid": "c110b31c-333b-4944-9367-a14a381f32be", "value": 1470976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693128963, "uuid": "80a3f054-65bf-485c-b26f-678425b91634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128963, "uuid": "7a131c4e-dc70-4910-b828-7a8058cadd82", "value": "0d8e64c713c628063cbe4f20a1a6b89f02badd694f5f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3224ca-4495-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693111851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111851, "uuid": "97fb14e8-51f2-4403-86b2-787c7329856e", "comment": "Malware payload (Amadey)", "value": "a8f4769fd193b87fe33857188e8b85de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111851, "uuid": "d728d1df-c6f0-4574-bce8-ea97651af0fb", "comment": "Malware payload (Amadey)", "value": "0e4e9dcd4be4a9d9297a438b6a4964aab5ae49eeaf9285f93bc10b58d1d1fd89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111851, "uuid": "7e65c7f8-0857-4b8b-b0b6-b7029a618cf0", "comment": "Malware payload (Amadey)", "value": "a0d348cbcd554105d5541015fa42486917c1889f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111851, "uuid": "b5d51920-fab5-42fe-a986-adf6c68a3619", "comment": "Malware payload (Amadey)", "value": "d304c5ae0244d913a825abe6cda8fe53f7144f11bd3b6c946135b3b213e3f7f93bc47f556ef4221d9505dad2e9a95547", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111851, "uuid": "e0805bfa-48ef-4f5f-8a84-be6b2f701b3d", "value": "T167E41282F7D85472E8761B701CF209C31F39BCB2A97953A73686694A0CB3490D67277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111851, "uuid": "92cff60f-2756-4efd-a513-fbb03bce459e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111851, "uuid": "3bb6c52d-2273-429b-a964-5e1b85fe5723", "value": "12288:nMrty909YX7DXjeKF4iLtfvD5YVPJYkg0rJx+FofgUi12UPUOrB3wP:eyUCbjp6iFDa8k7jq0kUMWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111851, "uuid": "b781dfdd-dd9f-462d-a79f-2365b8dd1b7a", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111851, "uuid": "678b752f-e017-4c99-a593-58763d5df5bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111851, "uuid": "e6fe208f-4c71-460e-be61-1ef28240dc09", "value": "0e4e9dcd4be4a9d9297a438b6a4964aab5ae49eeaf928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c386f1c-44b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CyberGate)", "timestamp": 1693127313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127313, "uuid": "979985d0-5456-411e-aead-81b1a0b5dc97", "comment": "Malware payload (CyberGate)", "value": "039a35282f6bdc426bb5df5990d16daa", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127313, "uuid": "d69ea41c-78ba-4086-af3d-3cffb367a0df", "comment": "Malware payload (CyberGate)", "value": "10214ec31eefe2eabd38262e9a404f781949bd09ff3831ffd3a9d9f9c8a277eb", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127313, "uuid": "172009ae-7caf-44f1-b2f6-2f724fb77c42", "comment": "Malware payload (CyberGate)", "value": "7465d0840358b7683ea6ee6dfcc4049906926046", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127313, "uuid": "bc7125f8-b783-4c7c-a452-57af4e35e470", "comment": "Malware payload (CyberGate)", "value": "a2cbf22b0863d4f43064efe9d581b7ee403778aa48fa518488de25865c677c30785d351684eaa0188ee2e24a3cec7210", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127313, "uuid": "a55ae43d-ecf0-4537-ad94-970b7a5b2d73", "value": "T1623588346DEB112FE173EE797DF43595C99E7B6327065C1E10A3038B4A22B85DE9282C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127313, "uuid": "c0113c19-a900-4246-85d7-1485e92925ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127313, "uuid": "23bf4fc7-5b20-4fec-b4aa-797642758ad4", "value": "12288:povIiGZq/sAEoRzQjsN5iOh6Byf7uWGNBrfcPIRqjWEX5fbEsGfFrwBwqyYrHlD9:pogSdksw9N+6CIOxDM+37fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693127313, "uuid": "76f0a6af-7c2c-43b7-b3ca-da59d9e3f5ee", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693127313, "uuid": "4d99b748-ddec-4994-8a88-4f392133c9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127313, "uuid": "3ba14f9e-157c-4307-80ba-f4dfac910196", "value": "PluginFlash.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd30a138-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693175203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175203, "uuid": "fb7996e9-c38e-4a7a-bdce-2796715802ac", "comment": "Malware payload (Amadey)", "value": "06ae3b3c3b3c310f7cdd4a4e678712c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175203, "uuid": "1fc2d9d3-0a71-455b-a23d-c983de0dbb2d", "comment": "Malware payload (Amadey)", "value": "10d0d92a35eba63a908abd91dcaf0f6edd6dcd7fb5b4f69eb5a34c828622a823", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175203, "uuid": "8255b596-0021-4bfd-a582-e9a35283c71c", "comment": "Malware payload (Amadey)", "value": "c3e415b64f3583d2fb480e88d246a0492f70563c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175203, "uuid": "6be7333a-de8d-44fa-b46b-e2886d7de980", "comment": "Malware payload (Amadey)", "value": "bc73dcadbe3befddd4b8df60365c3e1f36f20bdcc2a70a5ae0ae1d2fd13acbe45bdf591d52021fc3b3eb069a83224627", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175203, "uuid": "4e42b39e-1ef8-474e-bc79-bd2ec23efd3d", "value": "T157652313AEE588A6DEB513B01CF613CB0B36BCA11874030E1796996F48B3695E0F6777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175203, "uuid": "e6cc6799-29cd-4f9a-87b0-dac95c458a10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175203, "uuid": "9311b3bc-8c50-458c-9bbd-600a72c2b92d", "value": "24576:tycv/BUp5UN0aNGwKc4jr36QsVE7qSlIvdPv+XGUikqDSGxQr1mnOiJO7uWtw9c:I8qp5m0/wKc4jr36rZewdPv+2UikLbRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175203, "uuid": "9e0cdd1d-c8b9-49bb-b1b4-74ef7853ee81", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175203, "uuid": "21c3df25-1c03-4bf9-8495-c2730c747786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175203, "uuid": "58300a4d-ec1b-448e-b9df-68a84b00e4d5", "value": "06ae3b3c3b3c310f7cdd4a4e678712c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cedc2f-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693149413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149413, "uuid": "293118bc-cf3d-43fc-bb8f-70c6dfd5102a", "comment": "Malware payload (Smoke Loader)", "value": "d3d867c6722255ebcbc51a11a3a39347", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149413, "uuid": "a850581f-9822-4c69-8d15-bdc0248224f6", "comment": "Malware payload (Smoke Loader)", "value": "10d5acaf335351c394065caea772a79d686fab672649cb94315342fe0a9e4df4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149413, "uuid": "8f6fb282-1b50-483d-9794-1079af82af08", "comment": "Malware payload (Smoke Loader)", "value": "6c4779e317aa06782bd634a3175c2e2884510f6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149413, "uuid": "136ca1b0-13f7-4626-a33a-699baaa2cdc9", "comment": "Malware payload (Smoke Loader)", "value": "c8d1f932620ddeae9ecd852e422b550da415f889cc879e91a5b166b06d456f20f7e29c8906c6e037c616e78016585c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149413, "uuid": "eb3d2739-c9f5-41f6-8a50-2656efac4a7f", "value": "T1CB54CF127590C832E9520535CC6DC6F46A7EBCB688598A873B943F7E6E313D39B2530D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149413, "uuid": "5eef89e3-5af5-4320-b4f5-a0cb71ad643c", "value": "1c820352c29bb515015085b5719cc68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149413, "uuid": "fd987ea7-e6c3-4565-b05a-ef5c346aa20c", "value": "3072:TN+g7/Lo7OGFmNbNJXkywtN2kAyxdovGLsbVgJI+bEKXmXTZutl:BhXeVFaJTwH1AyvoguMX6TIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149413, "uuid": "4b826d9f-dee8-4ad7-85e1-978d5cb92ba8", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149413, "uuid": "63ff2ba6-a527-4a41-8d1d-e3c6c5d4280d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149413, "uuid": "5999f604-93e5-45c1-84ec-5cb98eb83caa", "value": "d3d867c6722255ebcbc51a11a3a39347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dbba97-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169468, "uuid": "d61b9ba5-d68f-4bce-951a-af1cd96ade9f", "comment": "Malware payload (Mirai)", "value": "ad1cc1d0124496fb65b8c8536b5ceca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169468, "uuid": "b3f8d70c-abd5-4b24-ae5d-46bae4823cc4", "comment": "Malware payload (Mirai)", "value": "10f9b3ef8b3cf9e02dce3618b93fd928734ad8617672dd94e7ec8d6ce49df9a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169468, "uuid": "969ebd2d-e6a4-40cb-bae3-0b0263b46b71", "comment": "Malware payload (Mirai)", "value": "145392d4f8692624ba82551a6f46911d98c6e9aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169468, "uuid": "09bed5a7-40b7-4789-806b-19f5a1595ec1", "comment": "Malware payload (Mirai)", "value": "6a947d9114b007f1d4a4bb969d54d83f9127a65fc96875377e6fb4d8a81056f24c8ec8e380a25766acacd5993a6046a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169468, "uuid": "485cc42d-f237-4f8d-afbe-27c95b17b2df", "value": "T1B6D2E188B6D362F68CDDD57EB64F003670DE74A9B6B29373B302D4534726080E651D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169468, "uuid": "f4fbd6a0-d4cd-4a80-997d-5ae11c0aab04", "value": "384:MId/PxEDLd2TwULzm6lowYcEaqsp9qC450LQixBfE4jdlz0lewZ90BKZI98K3NyI:blxKd2FLPxEnspd6IHE4RlY990W88KEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169468, "uuid": "50043779-d996-4e24-ad4f-7ac821805de1", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169468, "uuid": "4a3640dc-3236-4023-98f6-9ed4ec331420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169468, "uuid": "ceed8cff-0cf6-431c-aaff-fdc932bbba38", "value": "ad1cc1d0124496fb65b8c8536b5ceca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd7b3e1-4514-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693166430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166430, "uuid": "a029937b-c358-435a-bf03-47a763f31a53", "comment": "Malware payload", "value": "81af4f2d111cb10c9b5922d02b3751e6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166430, "uuid": "64ae1d98-7367-4d9e-aece-7bfb0c8cc1e9", "comment": "Malware payload", "value": "11c38fc24bf7b29cd6e974670bc11d7f92af124d8b7edcd89482500f4de3d442", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166430, "uuid": "4bd4a191-40d8-4624-b694-01d968851dbd", "comment": "Malware payload", "value": "e45198cfc34576e8067e177249e63a77e9451bea", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166430, "uuid": "24b6cda8-b785-4851-bf38-400d7d42f6a8", "comment": "Malware payload", "value": "f4f19c46debf0a0c2b48a489141b51c7c64e2ef539abd2edd9040c84cf7d03e4dee196ee37fbf55aeb4ed725179197f5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166430, "uuid": "16a95c2f-47ed-4f0c-8670-f0b387671bc7", "value": "T17F923B087BED5466D5DE4BB58AB316520273E2630A33CF4A35EDC00E6FB33844A067D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166430, "uuid": "b33056f0-c735-4d8c-90bf-6ca4c2c173c4", "value": "384:imKUE8ZnjbuboGeLXB8sXoCTTVW/g919tVkkrVa3xQPhYJ+0:imvTZdLx8sXci9ZVwJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693166430, "uuid": "f2fac341-8d2a-480e-a55a-d18d5e959ea3", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693166430, "uuid": "331ffb4d-2187-4be1-90d7-d68907111137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166430, "uuid": "0cab9e87-0654-4674-9c0d-7ee0c6786755", "value": "81af4f2d111cb10c9b5922d02b3751e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ad8886-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693103735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103735, "uuid": "f880b75a-ec59-4e16-b9b2-cc224208ea2c", "comment": "Malware payload (RedLineStealer)", "value": "d91b413bbf0dea23d1bb8c0407d05641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103735, "uuid": "f674c67f-ef85-4fe9-aecb-fde2fe0ec6a8", "comment": "Malware payload (RedLineStealer)", "value": "121c8d43522b3a8159442523676c6f224548921542f068804b08a3138965b162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103735, "uuid": "36907fa2-949d-44d7-b990-a0dfa88a031c", "comment": "Malware payload (RedLineStealer)", "value": "3405dca21e99c6ab1a8efe852416ff081eaf2257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103735, "uuid": "6eed75f0-96b1-44bf-affa-8a4cfe4c183c", "comment": "Malware payload (RedLineStealer)", "value": "03ead425fcfdb9021b64c280752d8982abc1f5b44912855055e1848e964ac7dae7bb873259b53bc5e14b809626a16503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103735, "uuid": "994591a6-1994-490a-bb86-20e472804c20", "value": "T1E7E41352EBE88031ECF51B7019F713971A3BBD905D38432E2786A85D2DB25E4E47272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103735, "uuid": "4e4c0976-2e75-4656-8df0-b6c1de93f3be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103735, "uuid": "913701cc-bac5-4126-90a4-e48e14602e8e", "value": "12288:SMrRy90zBePS/q+EweORsfB6zdZlSiYQB9Dt34vFowisTXJvqaGQmEBhAVV5v2C:jy+e5+EHIzdZJLDtco985vcQFBhUV5OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103735, "uuid": "a24b6c82-49c1-48d8-ad2f-98d9efed94bc", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103735, "uuid": "dce8d6ee-9d5b-496c-b730-d11bc3ed4fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103735, "uuid": "c1eb08a0-63a0-4813-be94-4382248cfa78", "value": "121c8d43522b3a8159442523676c6f224548921542f06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ffbd10-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693132287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132287, "uuid": "dc823f9f-7d63-4cbc-bb36-2d9868d33eb0", "comment": "Malware payload (DCRat)", "value": "aa3adadcec8943da3cc5f57ee2889eac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132287, "uuid": "5a1aa76c-d204-42a9-8518-12560ac87d54", "comment": "Malware payload (DCRat)", "value": "157b3b1069d00217897390c8ac108469bec912aaa58d3f5f35613ca7545ae828", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132287, "uuid": "15351860-a0da-4e82-aad7-762099cb879d", "comment": "Malware payload (DCRat)", "value": "200986aa9b07f19a90e132ab5521a31dffd18fef", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132287, "uuid": "8d3f129c-8c67-4cf6-ae06-9490108de206", "comment": "Malware payload (DCRat)", "value": "4bb49f22ce625dfe4fb71c3d9ba4d0ee181b6f2b622918f0851d2553de6a31057eae5de2d1a896a6f60ec7864826f7ce", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132287, "uuid": "0c793739-d69b-47ca-a7cc-e671524b039e", "value": "T159859D017E40CA52F0181633C2FF5A4847B5AC102AA6E72B7EBE376D55523A77C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132287, "uuid": "4b7b96cc-e52e-441a-bbae-acad0d342e81", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132287, "uuid": "c6adbdef-e09b-4151-ae78-be000d69e61b", "value": "24576:U2G/nvxW3Ww0tD3XxKAq9bS4h7hhqmkzCvGvHjPRc/k2w5aZG3QnvAeHj29LLozM:UbA30D3hK4EhoCe7Puc55sG3AAe8seFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132287, "uuid": "7cdffa35-0bb3-4b64-91d4-eeca469e1467", "value": 1754909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132287, "uuid": "8576f5fd-88d7-4c79-9c71-8f9d2db3a553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132287, "uuid": "4bf804b4-5023-49fd-82d0-f54161f53ce3", "value": "157B3B1069D00217897390C8AC108469BEC912AAA58D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db433071-44b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phoenix)", "timestamp": 1693127123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127123, "uuid": "579c79d6-3502-4fa4-8b43-74e577d19efa", "comment": "Malware payload (Phoenix)", "value": "2c9f626447ae964cea8cc43daf078e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phoenix", "colour": "#1484A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127123, "uuid": "9026e9d7-4ae1-4b4c-b5fa-9722e688b5a9", "comment": "Malware payload (Phoenix)", "value": "1650fa7dfd5cc553776b130e27195d407ab18a356773e0c4b471102764ef25dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phoenix", "colour": "#1484A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127123, "uuid": "9358dbad-9bfc-4697-82b9-9ce8724e4042", "comment": "Malware payload (Phoenix)", "value": "e6f9fed713f822348c289ab37e1e559f6738865e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phoenix", "colour": "#1484A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127123, "uuid": "71db739c-a5a8-46b3-8e2b-c31755b9a95b", "comment": "Malware payload (Phoenix)", "value": "7fd2b98852b8e56934c4463ec6d3e874148979609e220fab6734a4ffaa7f8b011c687432a42eb09c12921f93bb18093f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phoenix", "colour": "#1484A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127123, "uuid": "1ad2a83a-c3fa-4ed9-8d52-d224e9bfa5f0", "value": "T18545BF52A3DDC3A1CB265273BF2977426F7B38310630B45B2F981D7DA961172122DBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127123, "uuid": "6d5e3bcc-3d81-472b-8714-04c39181dc06", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127123, "uuid": "e61f33ca-7966-46a8-943b-e5e226ef377d", "value": "24576:Xu6J33O0c+JY5UZ+XC0kGso6Fa1BNv36j/5n8WY:xu0c++OCvkGs9Fa1eTBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693127123, "uuid": "cd2f1496-e923-4279-9857-fd0db46a032b", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693127123, "uuid": "25920083-0382-47ed-acc3-453ab01f93b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127123, "uuid": "d126d4b8-19bd-456a-8e76-9e341660bc53", "value": "smes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c75a6e-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149341, "uuid": "10ae8f6b-5f8a-4bfe-b386-180619a47b0e", "comment": "Malware payload", "value": "9603a53e85245b92fc67c189bfd0fa5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149341, "uuid": "84ef8155-e0a6-4466-926f-f14054a0d541", "comment": "Malware payload", "value": "1797470618d853a56c0761069cbd947fc42cf96c9f0ee9c39714b67d6d02965f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149341, "uuid": "df568867-33bd-460b-a5d6-e11d1ded9b4a", "comment": "Malware payload", "value": "36a2a2f17b0e05ac2c4c09c4c2ab3bc9b70db09c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149341, "uuid": "926e1fe9-d1fe-40aa-91f2-e5fbac41ae2e", "comment": "Malware payload", "value": "adc837bed01b45d391ee9c16a125f646a0cac17c87e64c12ce00ae1e86c6a14a5b35751f5254f786427c3d86d2aa6fa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149341, "uuid": "2915e5c6-2f91-4bf5-9405-44bab50fb570", "value": "T150834A02A781CAB3D5430AF612A79B210533F93B1A2BEE16F35D7DF49B190C47227B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149341, "uuid": "c1c9e21a-287b-4497-93aa-1db59d58ee88", "value": "1536:GMHTuUAjXUOU/1uDimfQhcCYFCc7y4sVH20mBdDPraZ7mLIWVOCjXZRsFS:GMzuUiXUOUNuGmfvCY0B4CCVOFmUWVOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149341, "uuid": "668513fa-8821-4370-894d-a8bcd49f88ed", "value": 80968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149341, "uuid": "576dbb45-d5b5-41b8-a447-00f1da9fada3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149341, "uuid": "7ff5f06b-4cde-4d7d-9024-81108fd0a658", "value": "9603a53e85245b92fc67c189bfd0fa5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0be203f-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693130166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130166, "uuid": "35b8e0b3-31a6-4f61-9b64-4e7e551588c7", "comment": "Malware payload (Amadey)", "value": "70f0ca2814e1a05ddefea4ea937a94e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130166, "uuid": "3b218de6-ed76-476c-b2a2-0e1397d45c9d", "comment": "Malware payload (Amadey)", "value": "195802f3b7e84e6085a65171fe38cc00cec2cc6c8d160efafd4b87b530e0bd8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130166, "uuid": "a77a6bde-3087-4560-8e02-aa77aa02d455", "comment": "Malware payload (Amadey)", "value": "5af828de7fdfcce98893c5d9e5b8d02e06635aa6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130166, "uuid": "2e3ed054-5ec2-425f-951e-379f2d7c3e0c", "comment": "Malware payload (Amadey)", "value": "ff3845c355cde5f35ad70085d9579107222c009e0a9b1314fd8b7ac54efdd0307606710534ce0ad1ff825543a23f465d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130166, "uuid": "d799f22b-0392-41cf-b69a-36d297cbd96d", "value": "T19F152357A3D8A036E465233119F70AD70B39FDA09DB0635B239A881F0DF2984B57973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130166, "uuid": "9d9a22f3-4fd8-4fca-87e2-9732b797b6a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130166, "uuid": "cbc0999f-2ad1-457b-9c96-2ee5025f3d46", "value": "24576:6yTC8eyu2azn2NryCgO5T+LMaNGDv8UK:B28eDDz+yCgO5T+AQGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130166, "uuid": "1f609d80-2c3e-4112-8e52-7f16ffc3209b", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130166, "uuid": "9b073483-9e02-45a2-bce2-061ff45da877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130166, "uuid": "5b409472-ff52-4658-8017-955287efd10a", "value": "70f0ca2814e1a05ddefea4ea937a94e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6042b0-447a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693100179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100179, "uuid": "ea9b7dfd-27d1-46c7-b6b6-2586f5f2884a", "comment": "Malware payload", "value": "58b519ba0a497aaa858149a1102785db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100179, "uuid": "d4c7c4fe-d062-4fef-9acf-68407faae526", "comment": "Malware payload", "value": "1986299079bfbfedc8a4718d66ecef2e7240857c380fc990ab7200d603012225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100179, "uuid": "76066cd3-15b1-4a72-9972-23cc5c8b962e", "comment": "Malware payload", "value": "b3c37c93bcf13d5788fb06764fde3cb01fcc3a78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100179, "uuid": "4f8af06b-2da0-4a19-a562-1bdab0a8b34d", "comment": "Malware payload", "value": "b7cd23bfcd3fef39f2528db776bd8450e700856c5f312982cb6e0da50374a6f2dcd501e44fc1b017d2ece6b1bbdf67bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100179, "uuid": "8bd4e556-e91b-4761-b4e2-b22586e4f30a", "value": "T16AE53302BBD18877D6722D332FB1A7525A7AF0240B25CACF53A18D9EE7311D16738672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100179, "uuid": "78064e24-1994-473f-ad24-effd0102ff95", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100179, "uuid": "cf35aac2-c4b3-44a0-a923-da96d28bacbb", "value": "98304:kWhSeBfKE/mWb3tDLA7VMvVWREkir6gI94ldY4pG+Db:CqmA9DqaYREkiri94lq6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693100179, "uuid": "b3e1b69b-66a8-44e2-ab0a-c3dab0873f36", "value": 3263456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693100179, "uuid": "1d208633-1015-4c06-afca-4e90a27e5b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100179, "uuid": "17bf781c-f7c0-4429-a366-038d68931c36", "value": "SecuriteInfo.com.Trojan.Ciusky.Gen.6.28487.26296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6397b055-4514-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693166436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166436, "uuid": "d6b2eba1-25d3-4cf3-b311-c71e053d9844", "comment": "Malware payload", "value": "f9391638fc3c6dec9b7319d1c8adeebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166436, "uuid": "f1f14981-3ea4-4287-be85-6cbdef146a12", "comment": "Malware payload", "value": "1a9ad5f2a8a4cc93a5244200d46288948daec3ae9387d5fc66799d52d77a587c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166436, "uuid": "20465ba2-056f-4ec1-b252-8c104849ceca", "comment": "Malware payload", "value": "84e442eee76140490409219f0419dd58d2ea4820", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166436, "uuid": "00833f4e-cdd6-421a-b553-6b11e03e021f", "comment": "Malware payload", "value": "740426e32926fb6d4755bdc168af4ad49669ca71b5fd5ae8beb4dc1ecb49667f7a2077d7484c59a7a79e732aca219e6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166436, "uuid": "61e45e0f-0a8c-4a8c-af17-8fb69d65b7a0", "value": "T1EF63390037D8C975E1AD46B8ACE2691007B6D5779122C70E6CCC84DB5B9FFC65A223EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166436, "uuid": "2a0c1ec0-d6e3-4717-a89d-567d6f964c36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166436, "uuid": "a3558f42-3942-475d-8f96-64b3a5c52b56", "value": "1536:fJWnX1QHsrLhSBjCeeiIVrGbbXw+39wG5/FpqKmY7:fJWnX1QHsrLqjbeXGbbX739J/+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693166436, "uuid": "02861434-52b4-4cef-ac2b-c1e5cb0d9fe3", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693166436, "uuid": "e0ceace0-d179-4033-b2b9-e0677b4d363f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166436, "uuid": "9baeb32b-121c-46cf-904a-1586d445889b", "value": "f9391638fc3c6dec9b7319d1c8adeebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4733535-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1693103865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103865, "uuid": "93f61a06-43a2-4f20-98c1-57975913c8ca", "comment": "Malware payload (Meterpreter)", "value": "27419e4c4e9aeca9f52552fbf0d1ff35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103865, "uuid": "26a4e662-0f97-4db0-aaa6-eff0b1555ac3", "comment": "Malware payload (Meterpreter)", "value": "1bf47f3c5b9f09daad34ae8de2baed440b762fd3c345e5bdfd41214f14cfe4d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103865, "uuid": "2c5e6c3c-9a9f-4e8f-b732-cb480ad0c125", "comment": "Malware payload (Meterpreter)", "value": "861ee9ca5c4467b2260bc9d8ea701103525a2648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103865, "uuid": "7064c2f0-c069-4aa0-8b6b-f46daf76c7c9", "comment": "Malware payload (Meterpreter)", "value": "ad2e74de2695691b64c026457297eb88c87a25ff60b50f7b6604e155b05ac0c3ce14dff199f77f2619b879fcee16990c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103865, "uuid": "228b6c5f-bdf0-40d0-9779-f4b4d0d858c8", "value": "T1F573B046D9C45460C2A6223D26753AB5A870F2FA2722C1D9798CCDF9DFC1C70E3663CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103865, "uuid": "8eea8687-581b-4af5-9fd5-6ac4d701adde", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103865, "uuid": "db5f81c6-902e-42a1-a838-62e8efb35ac9", "value": "1536:Ihxnxq+yw6rQBM8mNLWJ5wCcv0TBceMb+KR0Nc8QsJq39:cxlyw6rQLmQJ5vDBcee0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103865, "uuid": "17124156-a846-4091-b8e7-ca6b8e9d0beb", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103865, "uuid": "29732048-3f87-4614-84b5-84a27f5f4164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103865, "uuid": "83fd6ebf-2d17-4827-996d-c4930ad39ab0", "value": "27419e4c4e9aeca9f52552fbf0d1ff35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d2cc38-44be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693129564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129564, "uuid": "55fdc972-45ac-4400-a601-d732324fae02", "comment": "Malware payload (Amadey)", "value": "a7f330ec37cadb2c755c5ee1ef405e9d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129564, "uuid": "46267601-8d26-43a3-b0f1-69d7e67ca599", "comment": "Malware payload (Amadey)", "value": "1cb88a8ad19b17e7a2918c28262b6b2fa226a32dee97666afd5ecaa1acb6561e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129564, "uuid": "6ebc7da5-e94a-4b6e-81c1-ac89fdb68541", "comment": "Malware payload (Amadey)", "value": "51eb652dc7cdba87c5a182ea333a3eb3fbb5ed0a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129564, "uuid": "6280703a-d832-4a34-a22e-f6d1c2063b86", "comment": "Malware payload (Amadey)", "value": "b9a027acd26aee2a1cebda5343eecfcb88a102774614861533d7ddb423f8cb7f45dbd9222fe45bbf28ca43eea7561b63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129564, "uuid": "6ccfea00-a1d3-47ac-af7f-fc906841b0d0", "value": "T12E23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129564, "uuid": "4ac901fe-75b9-4d80-9a27-1f94e0598f92", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129564, "uuid": "b6debc05-07f2-4572-823e-c81e463edf8e", "value": 48806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129564, "uuid": "b06624c2-d588-4825-973c-4e68f71246a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129564, "uuid": "2d9c6e13-860b-45ca-b57b-b340adcb944f", "value": "a7f330ec37cadb2c755c5ee1ef405e9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f7518-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693147803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147803, "uuid": "66b70c77-8563-487e-82ae-16ad102e9fec", "comment": "Malware payload (Mirai)", "value": "8e6ac0c2105eb9e85f5d3e60bf823151", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147803, "uuid": "1f74e045-304b-48a6-8e06-21ebb6d5375c", "comment": "Malware payload (Mirai)", "value": "1ea865d170af72198497608e7980620a7416ac37ed72b155510a0ec7c3773de1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147803, "uuid": "b2ee2443-76aa-4fc1-85e9-7f94d217f5c9", "comment": "Malware payload (Mirai)", "value": "5b49697205f2962765d31f4b51a160987067765a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147803, "uuid": "1456304f-d4b6-4ac4-b13c-56d8c5b9e026", "comment": "Malware payload (Mirai)", "value": "95e7137ffe19106a8f4852f7efdd6ba5fd36ddf41d38165a269231b9938d413ae8334e7b295fb44ad13629a1cdea8125", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147803, "uuid": "35943af7-399a-4014-a00a-0336ff8333e0", "value": "T1A733E1B652AB9D71C27052FB1529A49E64162378E3E5F00267250470E6CB2F38AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147803, "uuid": "8dcecd0c-f09f-47e3-ad36-e53c5dc926da", "value": "1536:ICoqsGR4eB3g0Vmh1IxIpC8J1QL9VE8amFZP7R3f:loqs2Twh6P8JGLJ9ZP7R3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693147803, "uuid": "c77f35b1-bfe4-4ae2-97b3-bd77b90fc218", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693147803, "uuid": "774282da-13a7-4915-94c8-bb67439a5ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147803, "uuid": "6fd5fe7d-eb19-48ba-a3fd-c633f8820211", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777c59da-4484-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693104622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104622, "uuid": "3f40b8ae-0fe1-4cad-940e-64aa4572c6ca", "comment": "Malware payload (RedLineStealer)", "value": "0dfdd06da8b1a443bc595c621b61644d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104622, "uuid": "a3cacbd4-8c0e-436b-adc4-12dbe4376914", "comment": "Malware payload (RedLineStealer)", "value": "1eb609b1e89c9cba77e8a51d40875c45fbf31c08ccb3024b631fc2d4f41418de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104622, "uuid": "6277dc9d-3400-4686-b918-4c10faa9f3c9", "comment": "Malware payload (RedLineStealer)", "value": "1b2594023cccd55c6b1dad2946264d2101c8e0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104622, "uuid": "060f18bc-b326-4861-8b76-93a9190f6554", "comment": "Malware payload (RedLineStealer)", "value": "c5adb07c38415c7e78bd689425ae716bbd6a3477976410206fe4635c828349e60ec71e37518934961b70946a0d8e506b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104622, "uuid": "d4a40fea-da28-47aa-b13e-82f96e8eb1da", "value": "T1FCF41267B3D94462EDF117B05CFA63D30B3ABC512E7882776B82491F19B3584A931B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104622, "uuid": "458ceab9-e87f-4ba0-b9fa-e877e3d75b64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104622, "uuid": "49eeccef-af78-42f5-8a37-cb2113f6ddec", "value": "12288:VMrDy90vYPszEjj8xtA7H4y2/xNa0uhimHvYpMYINecxhqmRUfjIQFsB3LvcykD:myNPwE836H4yKsi6xMmafjIQFsB7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693104622, "uuid": "cd47e42a-d3a7-4648-b3b7-f21963464fc2", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693104622, "uuid": "ddf5c746-9a89-4b7c-a59d-76b1c7f1a9a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104622, "uuid": "e143f5ae-7b74-43e9-9fd4-0fd4813a5016", "value": "0dfdd06da8b1a443bc595c621b61644d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5aee3a-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693132276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132276, "uuid": "dccd6dda-dc70-4b78-9a6a-87c692414d62", "comment": "Malware payload (Amadey)", "value": "c0c3ecfce390be94ab5e8caa79aae19a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132276, "uuid": "125ead83-a1ca-4470-bdf4-c361513b5351", "comment": "Malware payload (Amadey)", "value": "1f7a8d1e92341974875cd0174c9d3e8dbcd0dcae64a513f553c8b6891d4fa6f6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132276, "uuid": "75c2c683-574c-4397-8643-807a9396588d", "comment": "Malware payload (Amadey)", "value": "0fddd27364e748a84654b2b6885811f5c61adac1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132276, "uuid": "bb78fefc-484a-47c2-a5fa-f06a4eb7b34d", "comment": "Malware payload (Amadey)", "value": "e772397d3fe1dcc1fdadc7c3a00f946e2afd4f34a96ccae876b709fbc9d32c444785dfd6a29e50a4fb2e5dcbf37ea54e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132276, "uuid": "29e66bf4-75f1-4b66-abdd-3c6ef5e68de9", "value": "T137E42243E5D81532EDF9177054F743830B39BC95DE74A9AB268AE91A0CB1BC4A83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132276, "uuid": "39a922c9-de77-442a-a718-1c6d3e196cb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132276, "uuid": "6dfee070-a63d-46c8-b524-2daad6f46636", "value": "12288:GMrYy90KnMyiRGdiTlfKoXI75hlVg51URKPqUHpu9B65MDbeaTG:2yYyiRsG+TDIaKPTHZ5MJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132276, "uuid": "b1d7d04a-701b-4a57-82fe-eb8ff2cfdeb3", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132276, "uuid": "9705ea18-4867-4f11-aaef-174f049ffd4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132276, "uuid": "67433a01-3e12-4133-ad59-784c983bd704", "value": "1f7a8d1e92341974875cd0174c9d3e8dbcd0dcae64a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f8419-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149400, "uuid": "c4e2f58e-1296-4083-82f7-abe9505b7090", "comment": "Malware payload", "value": "4d9ee0efe29b2b23b6e4dd7677712ed7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149400, "uuid": "57938de0-f2c8-4317-b2a1-1d913f99d584", "comment": "Malware payload", "value": "1fa3803a958d4ecfd66c6c182d98f99e3870fdbe36ce25ffb0bbc055cee80f4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149400, "uuid": "d61e5780-30ba-4bc3-8014-aa4c7c4a00e3", "comment": "Malware payload", "value": "d15fa13f8786af0da4b9f335f9805f4d3c3fcc22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149400, "uuid": "47584c52-68c4-4b84-afec-3085d4ff9891", "comment": "Malware payload", "value": "32cf2fda40d884cf5f607e1cf4a3de04d018ef5943adbddb872d81530d8e51ef6fca41e4c7ea156d8e0163c0a6ec0890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149400, "uuid": "35a23f74-97e4-418e-b684-37fba8d838dc", "value": "T15EA31A41ED418727C2D327BAE79F439D7B36566497D73301AA247EB42BC5BC82E3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149400, "uuid": "43ba27aa-f223-447c-b402-ee359dd2cded", "value": "1536:/CirNJcuhcI28okpSzYW9a0BOjFvjs+P4Ai95LUJxsN9GDbmCVrQAFW9LhZKQ:LJRcqiaHjs+PtJxUkbmCVrQAFiLhZKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149400, "uuid": "f53f76dc-df64-4fa7-80d7-f95be52c714c", "value": 104533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149400, "uuid": "7ae2d758-9844-4bd3-abd3-91a447240ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149400, "uuid": "e4703782-3c03-4a6a-a5f0-ba1ebf1934b7", "value": "4d9ee0efe29b2b23b6e4dd7677712ed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a08c7d-44ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693148404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148404, "uuid": "3c0d73da-7bc0-4492-92fb-59a2f67021c3", "comment": "Malware payload (Mirai)", "value": "d55c152d53dd96a97d2fa98a64ad73bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148404, "uuid": "e8edc267-8236-4925-a2b5-d6c5a749aa3c", "comment": "Malware payload (Mirai)", "value": "2078fd236fade0ab38c2ccba99fe34bbce650895cd8cba8c34e0f8487837b2b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148404, "uuid": "39633594-03cb-4adf-938f-90b4ad839e86", "comment": "Malware payload (Mirai)", "value": "7a5e1f932afadeb0055f8a6139ad82db4b1e8bdb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148404, "uuid": "088dd24f-009b-4781-a7d0-b0ee48349793", "comment": "Malware payload (Mirai)", "value": "25705ebf2b7ac9d2fcb51cc12d1830ec9adc102b56b1e16e8d759f557ff5ec9a8465ca6ff463d6ff46db4a5eaefe27eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148404, "uuid": "22d851c3-b2a9-49e7-b1f4-7e26247f2625", "value": "T16F4309C4A4C3F8F6E801147C307AAFB2ADB7E17EB4759D9AD7D81523E901A02D50639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148404, "uuid": "5b3c4b80-985b-45fb-8033-2efeab024e56", "value": "1536:yP/2+OX+hs4pIq/qxSWk/zvwt33U3zo7:O/2+++BAxSWk/TQ33mE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148404, "uuid": "f8c83f5e-64e9-4c0a-8d06-cd95d3ec724d", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148404, "uuid": "8c4028c7-291c-4a29-b308-c4b5fbaa91a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148404, "uuid": "18b99e8e-1ac1-45ec-bc88-397eda4ccb51", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4f8882-4495-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693111853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111853, "uuid": "7ad547d6-ee3f-4433-87b3-8efaf2061db8", "comment": "Malware payload (RedLineStealer)", "value": "1eeefea5cea40172c6bc2fbb367ead64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111853, "uuid": "2f41d0f6-ca1c-4e16-8ad9-07df51ababa7", "comment": "Malware payload (RedLineStealer)", "value": "20a4e6d5390960e2757af27bd2baa194641f7be7092fab9f05cdcca254a05cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111853, "uuid": "3088192a-cd69-4ec1-9712-e4ba8ea28546", "comment": "Malware payload (RedLineStealer)", "value": "e9679f4b6f84fedde38739330caacc43c5aa057b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111853, "uuid": "9220818d-bb40-4297-a309-b29a7601d146", "comment": "Malware payload (RedLineStealer)", "value": "849fd10481f6889c529ea884ce95bdd7debd63d08b4ca525ef16a62eca04bc2ceab2c7dce48928643593fd6fad063296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111853, "uuid": "90c832ce-6d7f-4581-ba2b-e8e7984ce72c", "value": "T113652382BADD8551CC74677094F207830E37B8925D29875B77ABD85A0E33AC0A473B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111853, "uuid": "04271065-413c-42d6-bc57-56be4f84defb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111853, "uuid": "b8caf2ee-2639-40e6-ad48-76a9ab9c27b5", "value": "24576:xymve4aF342/Jzt7fMech7xi8Pqkvwg3elZZBOVFwhlyUMdrZulkUavAuPX38d2J:kmv12ldchVi8Pqkin8/nwk3v5Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111853, "uuid": "ca7a71e8-ec53-4963-a925-dd31c4d753a2", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111853, "uuid": "03573f9c-2288-41d7-a482-18f6fd877d51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111853, "uuid": "708c6d3c-5480-4e1e-9a28-7c61bc0b437f", "value": "20a4e6d5390960e2757af27bd2baa194641f7be7092fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7dfe0e-44f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693152006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152006, "uuid": "cfdf86ea-090b-4696-8aa9-91960a24c2a3", "comment": "Malware payload (Mirai)", "value": "ecf0d4931c8f89e81fa65d3fda8461fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152006, "uuid": "0fd81be5-bce6-45fc-8245-fa2a339a15cf", "comment": "Malware payload (Mirai)", "value": "20dd1b7e1c424310040d2159b109dd4fb5841df7b5cb2bd119d0a0ec1388bd2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152006, "uuid": "ecbfbc2d-210d-4a5a-9714-7e191af92be7", "comment": "Malware payload (Mirai)", "value": "8b9b1ded011fca9737655c2e28cc69962fca3f38", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152006, "uuid": "33f5b3e0-5dab-492a-b748-e130610ed631", "comment": "Malware payload (Mirai)", "value": "d1415a0d32ccdb5ac1d22c7ad2409e6e9f4f7e2974c6d54d5aa7404c2fb22c3c31b413c4f77fae7550861e0fc00bf387", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152006, "uuid": "bf6854ef-3c75-425f-9622-e3b5b6daf6f0", "value": "T168A2E01572632E55E3ED1C3DC96A835BB9A70BFC80F6337639415620C94D24A2E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152006, "uuid": "7589bbcd-e7ce-416e-b45f-44b3c73efd50", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjpowhymdGUop5hm:TvQn4j+ZO5fKAlxtows3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693152006, "uuid": "55c9523d-0d43-491a-a38b-9ad0f14182d5", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693152006, "uuid": "fb4016bc-817c-408d-bf69-72354899cdff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152006, "uuid": "a8480bce-7485-4d43-99e6-4e74ce83a3c9", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a33509b-44ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693148408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148408, "uuid": "d2b47d07-4461-418c-8d38-36756423d2f6", "comment": "Malware payload (Mirai)", "value": "56bab3392974ea48e9b0e584d3973bb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148408, "uuid": "c0758134-b9a2-4793-877a-e5ef8f0d3465", "comment": "Malware payload (Mirai)", "value": "221336e640e57a22069abda41daa69226d4691a1fa89c1bad6909159c6f5a96c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148408, "uuid": "3f2aaa30-479a-4fa7-bdfe-014910b098f9", "comment": "Malware payload (Mirai)", "value": "e2370c4670afa72ad125b14829cad621bad1545a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148408, "uuid": "6b32a074-492f-41d7-ad4b-c95ad5f4b9ed", "comment": "Malware payload (Mirai)", "value": "526fd2b404de19e1749cbe5b0292288e4db88aba33b5ebaef6b36f600b5516c44f7db09ede4707e5b1223f0f625fb411", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148408, "uuid": "0f2a5c08-090e-4dee-9fbf-5119968545da", "value": "T1C253F8C27C81AA25D7C05777FE1F018D3319A798E0EA73438C191BA17A8ED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148408, "uuid": "709e5aac-2776-48d1-9c03-d408d82bd381", "value": "768:RYinm+8+ecZ2NfGIvLHhYkSGVi41RxmHv6zJpq2TevcJK5VQHiLwCVy/Jx+5H8hf:aik0ZTIv9YkbE41KcmcJKLJeZWW9xn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148408, "uuid": "0f4f026b-661d-4665-bf98-dd32b4974f4b", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148408, "uuid": "23031d54-b17c-4765-8e45-0061d67ffa2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148408, "uuid": "eea3caab-4914-446c-968f-74517fb2b4fb", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab804ed7-451e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693170852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170852, "uuid": "ec2bf9ae-9dac-4b1a-be17-e9b957dd3dde", "comment": "Malware payload", "value": "a5f9e2c347a244fb366dd59d1a70f5ab", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170852, "uuid": "6beb6301-ab27-412f-a6fc-3b0a5bb38092", "comment": "Malware payload", "value": "22a548eb8a637b40c6e9320e00d7645d0d64169db4ee780cc16399913ec66121", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170852, "uuid": "fa0ea164-f579-43a9-9cd9-7c78e875875a", "comment": "Malware payload", "value": "71acc45cb99c44308bb58e837d23ee115abbeb7f", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170852, "uuid": "0d0724f7-1492-4709-afc7-83b12c338bc5", "comment": "Malware payload", "value": "c0c695ab1bece13f45fd7e9ae260561fc52243557ebc8739214c09e8289d12bf115c1e382af5dc73b6ddf43a2f498047", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170852, "uuid": "2c9964e2-e5f1-41cd-b1c3-3deb8186d140", "value": "T14693D715F7A650E4D87AD17D8BA2322A79B0381847356BEF87508B620F71FE4EA3D344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170852, "uuid": "aeee88d2-a233-44cc-ad25-c4c8c741cab0", "value": "af7fc98b9ff0ca32d7a2ac2a35acba50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170852, "uuid": "f128a75b-485a-43bb-b739-0d88a4dbf2af", "value": "1536:uMxTUWdWSp1zVnTG/mYSirUZnyGaFx9sqiiLdyN7M2:jkSLz50mYSiWyGathLdyN7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170852, "uuid": "9a4e61bf-8097-48c2-9992-f5ce681ff666", "value": 91040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170852, "uuid": "515df6b5-59fa-4375-9ab3-4a073c8f9926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170852, "uuid": "c5f9df35-3fba-4c13-a72e-d9ecf8641bfa", "value": "Jakx64.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdb8311-44d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693139204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139204, "uuid": "44722528-7ada-456a-ae4c-598944818f3e", "comment": "Malware payload (DCRat)", "value": "c76615b8f581aaaf477d84be98e8ea7c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139204, "uuid": "413c29a8-fd6b-4807-8dbd-301b5b2b8c27", "comment": "Malware payload (DCRat)", "value": "22d63d9860fa09c5f5c6a6900aee81a8f0bdaf0647892d300d949c7116ebc354", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139204, "uuid": "631d90cc-20bc-41e8-b3f2-aa9c523fec01", "comment": "Malware payload (DCRat)", "value": "b5c19a63af315762dee75232fc29862255ef87a9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139204, "uuid": "7a607772-7226-4d5b-91c1-bcce0048f32e", "comment": "Malware payload (DCRat)", "value": "df32e725624081270db85d0f5297777c8b063fb1fe35638445d7020ae5f177bf660a845564af5683f7b2d4bac1372d5e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139204, "uuid": "962cbf06-9b6a-4e35-ae52-cac4115bff1e", "value": "T1A53518223A66DD03C0691637CAEF852417A8FD417B66D71A7E9F3B5E60123A70D0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139204, "uuid": "6cc840e9-2a5b-4b54-84ef-39b5490d9871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139204, "uuid": "79df5ee2-f905-4bde-b2a9-0c2c792c1a68", "value": "24576:foVOdgE22Jlx52AdzNYBO7X6zOTYqVJ7dmnhRVxOWF0+4:1gqx5rgO790e8Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693139204, "uuid": "48433245-f1e3-497d-a0f8-6e53ed9be331", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693139204, "uuid": "0236da86-e1e9-4430-9745-3168ad47a399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139204, "uuid": "0dc38f3e-9b5e-48d4-a526-9ad6de550478", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-22d63d9860fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682d3059-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693178040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178040, "uuid": "2be0a6a2-2ace-49fa-8557-7b125c847629", "comment": "Malware payload (Mirai)", "value": "4b6cf6d313e1c6532450c3e4f20544f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178040, "uuid": "3aa969e7-34e9-4802-9de0-432b7fc79425", "comment": "Malware payload (Mirai)", "value": "236c87e966dc73beb6c6a116e6c802096463cf4cc1a70aeb346d3115c13db524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178040, "uuid": "9077b8bc-0f39-48bf-9d90-fdb7b65677a4", "comment": "Malware payload (Mirai)", "value": "53956cefb4ecbfa5f575cdbc767fb3523448ba75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178040, "uuid": "b27cb1bc-8013-4fa2-a43c-ef9b362b97a1", "comment": "Malware payload (Mirai)", "value": "2ce80da8be0afc20c007d2405464a42c98f94e7789878cc3338773a41fc7b28f34d0fe4a7f90fa31b6d24fee8de7e11c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178040, "uuid": "7e034e6e-7fb6-477c-948c-7522a2e3bfd4", "value": "T1EE93964E6E218FBEF7ACD2344BB74A21A35923D523F186C5D29CD9041F6038D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178040, "uuid": "d4fedbb2-b7f0-4384-83de-2280d1bdc866", "value": "1536:sn8Zyek6mCo67KsejRdKKqQ/e/vk+GtS0IY:s0V7KnRdK9QBtS0IY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178040, "uuid": "1fb93ec3-c707-4103-a0e0-58c71fe3f050", "value": 89956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178040, "uuid": "62a10d6d-50ec-4a83-bb96-02601e2d5a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178040, "uuid": "383f859f-ec28-41d1-947e-9b3c9aecc5ed", "value": "4b6cf6d313e1c6532450c3e4f20544f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac09cfc-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121378, "uuid": "72d4675f-11f0-43c7-98bb-db1533a8aa7b", "comment": "Malware payload (Mirai)", "value": "2dc31d2a3fa16b588d894e39f87fc2b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121378, "uuid": "62d6ca9e-9576-4a65-803a-7e9c5a72fadf", "comment": "Malware payload (Mirai)", "value": "2380a367088e905591b9b4904de1c16fea6be123be9f266e67e598b0c91cd976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121378, "uuid": "77d58e04-269d-4e8c-9d5d-c0c9ae2d8f3a", "comment": "Malware payload (Mirai)", "value": "3de51a7c7e9f26fe96efe82b6d313c91b1069d91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121378, "uuid": "e85afb10-ba9a-4cbe-bda5-aa2836783bf3", "comment": "Malware payload (Mirai)", "value": "9c190fe0643cdcea4fc2cfa13ff5da15a33850ed331693f1612fa37641ca6d4249040f572e49596bc4619a70f0028518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121378, "uuid": "9fb0289b-d8c7-4d58-ae64-26c6a3209929", "value": "T187539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121378, "uuid": "aff8a6b5-0ae4-4be4-b916-2006aa63882c", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121378, "uuid": "398b9177-2981-4776-a32d-0a35cacb6a10", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121378, "uuid": "59b4acb1-3dc5-4452-afac-74f19032ccce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121378, "uuid": "7f738a3d-e9de-4b4c-ac4d-50c8813fec89", "value": "2dc31d2a3fa16b588d894e39f87fc2b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aff982-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169424, "uuid": "cb028e2f-88b8-4380-b4a2-9d71d1424903", "comment": "Malware payload (Mirai)", "value": "d0924601a8bf2e3dc1a05656f028f516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169424, "uuid": "4ee42c40-a54c-4677-978e-296e7b0f540c", "comment": "Malware payload (Mirai)", "value": "246014f06c2ce1e5c173379016351ed809b657de10fb86b6370a91cddc7b1bb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169424, "uuid": "91df4e6d-e549-4e4a-9842-65c90d74c7fd", "comment": "Malware payload (Mirai)", "value": "7a3f0771ff8cdff26a077d24beeeb3b947acc274", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169424, "uuid": "ca085ba9-e75f-4cb7-a085-287d7cf8bf9b", "comment": "Malware payload (Mirai)", "value": "0ff0ebd6cf42a837aab9c940fb119c966e1d5ca9216d17881fe4824a8e354fbf2869027f628c282b1fd5ee5bd3e0a2ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169424, "uuid": "60c998e6-8746-4f80-ae4f-5947f5c928cb", "value": "T11CE2F193D3729052DE782BF1E96A45CA67BD4BACC67730B3160563182E5A0435F3CC83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169424, "uuid": "29861fae-4079-4c29-ab8d-1a776a8691fe", "value": "768:uoiWiO031vpAPbrVWZK3XVGxm9XhZc9q3UEL5Ip:uorm1vpALgUJhnLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169424, "uuid": "d370b5b2-94fa-4682-b054-468784346789", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169424, "uuid": "5075b530-a086-429e-9d50-67df21333786", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169424, "uuid": "4374c299-7b0d-4d34-b0d8-735922032c8f", "value": "d0924601a8bf2e3dc1a05656f028f516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fd6944-44c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693133478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133478, "uuid": "ea487aa2-979a-4026-a252-1d6f4e8fd99f", "comment": "Malware payload (Amadey)", "value": "49c81d4c2e20b5c8c423251d4c027a4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133478, "uuid": "a09b8c74-cd04-404d-aefd-d2494a2d79e8", "comment": "Malware payload (Amadey)", "value": "247982ea06f9bf1d810a0215b35831c0785b8538fb21341f5d9c318069b0625f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133478, "uuid": "f7c5e15b-6067-4c9f-acbf-9d22421a8a9b", "comment": "Malware payload (Amadey)", "value": "ab8495ee421d0eeb4442245a96d56da1d35f555a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133478, "uuid": "eb45bdd3-7755-4ad5-88e0-4bdd67069d6f", "comment": "Malware payload (Amadey)", "value": "c64b5367d78dd2b90b2a9b8c13fb02f5f9ee84421b671f2d7b69337fe6642e6e72240385d4e506c5380c24d6d0400e6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133478, "uuid": "22d5459c-7d70-4ce8-8d8d-6871707d9231", "value": "T109652312B7D49072E9B9273169F30EC30B38FCA498B056A723A8D52B0973555B53AF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133478, "uuid": "c11d2418-217c-442c-80d6-05b5214504ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133478, "uuid": "7c30ceeb-c3f5-4e64-b4d4-9ac6c714c1c5", "value": "24576:pyPoNMlv70nQ5qeZbZdkQMKNPqduMBl7PrVaU/Xgr0CPOvjrLO8uGVz40muWN:cQNWv4nQ5qeVaKNPqgMn75d/y0CPOvjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133478, "uuid": "78c1caea-ba64-4425-bd0f-aafe41ea1570", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133478, "uuid": "99716103-6355-4564-b978-43d249f277a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133478, "uuid": "b7cc5586-0ceb-4037-b493-55af3451f541", "value": "49c81d4c2e20b5c8c423251d4c027a4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479b0b8c-44d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693138902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138902, "uuid": "65ec6b06-da92-47a3-a849-16ffe6dc5680", "comment": "Malware payload (DCRat)", "value": "c697f3001198246fe1a1d2494a0ff2ee", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138902, "uuid": "59542a44-3450-4d4c-bdf4-918f3584c19f", "comment": "Malware payload (DCRat)", "value": "250196616e509add44f0e1dec8e4e1b515ef52df9a6e3f569ee0fe7c80a13914", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138902, "uuid": "50362cc3-55c3-4460-95e3-7a3a2c629485", "comment": "Malware payload (DCRat)", "value": "0505a546298ff2a17d510387a1060ab3f44112e7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138902, "uuid": "fd226aa5-b8f3-4386-9ca9-ab54ccc78c25", "comment": "Malware payload (DCRat)", "value": "58ffbce055b7c4d75ed53122e7c4915e06dd6d8748375e994f0de880b8a10c46fd8b87000fb3471125af9d7e1709e670", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138902, "uuid": "fecc452f-b339-42e7-ad17-cef5de44359a", "value": "T19B655A023E46DD12C0291A37C9EF552447B8BD40BB66DB1E7A9F335D64123AB6D0E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138902, "uuid": "d7d581fd-a0e1-4d95-9804-bf47c84f01c0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138902, "uuid": "dec3c071-72bd-4614-b0ae-d82c9945bfcf", "value": "24576:u2G/nvxW3WieCjbsHd2vNn2LRLpapqDTmRf9KrFnbkW9zdAZeSGhl6C+4Q:ubA3jnvNn2LIqH4S/g9GhwVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693138902, "uuid": "45b8d52b-ad20-47cf-87e3-1186f502eaf6", "value": 1505588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693138902, "uuid": "54ad680d-d56d-4b98-a70f-6f70d05f53ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138902, "uuid": "0d856fda-bdea-486f-8bad-3e97a7668ee2", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-250196616e50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c6ff83-44fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693157172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693157172, "uuid": "94bf2ee0-d707-42b1-a49f-fdeac885cabe", "comment": "Malware payload", "value": "6b49406bd0f703479a31bb64807fae1d", "object_relation": "md5", "Tag": [ { "name": "ITNC", "colour": "#F048E8", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693157172, "uuid": "4f22304a-ad58-4078-a996-f58ef1df1946", "comment": "Malware payload", "value": "258893275df1dae4ff706400618e9a0d5fad9c9fd1b22de820151ab0a3a8c153", "object_relation": "sha256", "Tag": [ { "name": "ITNC", "colour": "#F048E8", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693157172, "uuid": "8c9f8f1e-c92e-478e-b559-21c22ffe0a80", "comment": "Malware payload", "value": "ab6021b8e32443742e7fc207a4ac1ff216f2a890", "object_relation": "sha1", "Tag": [ { "name": "ITNC", "colour": "#F048E8", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693157172, "uuid": "6dbe24da-0837-46fb-9379-c496b541ec8e", "comment": "Malware payload", "value": "d2c69c3cf2c4b6af007e86100fb8fa4fef0df7f10cee6291fdb8711d135a67ee56e080fe7e786c7f7042670ca21ae633", "object_relation": "sha3-384", "Tag": [ { "name": "ITNC", "colour": "#F048E8", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693157172, "uuid": "6c42aa71-08a7-44b8-9023-525fd2a6ff3b", "value": "T117D11A20E0597C8CF863C981A52F3DCC427DF0215AE634D128AC8F45F58AE156FD75AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693157172, "uuid": "9f9fbae5-690e-4091-af0b-f72693f2b3a6", "value": "96:wL80UWTtLwX9frNEe61Z0750E1GycQ4xiVqXDhBTxFTeEjfSXyiKAe:wLd3KNfrGy0wxcQ48V8BDBj6Xl5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693157172, "uuid": "82c0a578-d825-4040-abd3-81309bca7926", "value": 6600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693157172, "uuid": "73915867-b394-4e8e-8c5b-f14909a06f17", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693157172, "uuid": "d78a22a9-ae8c-4852-9c7f-b3b61e248a16", "value": "PayrollActivitySummary.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d31d5e-44e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693144593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144593, "uuid": "46ce5792-6a9a-4be9-9ee3-42e9970fef63", "comment": "Malware payload (RedLineStealer)", "value": "edeea81315ca0743cd30c19f871d7eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144593, "uuid": "5dd8c060-e916-4ce8-9dd7-405a5766e984", "comment": "Malware payload (RedLineStealer)", "value": "25e2d7bc4a2acd35f041fc32ac79a3b916677da53dbcd4cdb248cbff853fdd9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144593, "uuid": "bd420768-e682-41bf-b57b-b2026351209e", "comment": "Malware payload (RedLineStealer)", "value": "007202cccbd611089f177e1566d35eaece7ae9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144593, "uuid": "9d8b9620-0f27-452d-983f-cb994474b67c", "comment": "Malware payload (RedLineStealer)", "value": "b7e35f593db27a508d9f2d151231b506240b2379f0848024a5708808dd0c3af7ba8e3681c51bb0ef368e7cb7a146c706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144593, "uuid": "2b67c42a-1506-4ce9-8b69-2b23aa19d1a2", "value": "T176652311A2D898B7DCF51B7284F603432F35BD918879C3AE27599CBB0833A9854357BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144593, "uuid": "92d4db27-dc25-449c-99f5-0e6ff2d43d27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144593, "uuid": "0bb3397f-e03a-4015-9f9f-868d018cef95", "value": "24576:7yi8DTbgADQaFQtKvXIFfgdrsOhLzAn56h1yD8oeffvmgRfvYybFjGUaOWc4qqw:uia0AEaEKvXIm6Oc5UyDynugRwgU9Oz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693144593, "uuid": "e1fe500c-f2a7-4c7b-94cc-f7417c3617c5", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693144593, "uuid": "465ef1db-62ba-4453-91a5-6b16c6d9aae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144593, "uuid": "a08cdc96-893f-48d4-b7ed-a15cf560b65e", "value": "25e2d7bc4a2acd35f041fc32ac79a3b916677da53dbcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63c1535-4471-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693096647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693096647, "uuid": "c315de10-81a6-44a5-bca2-6a946a29fd7b", "comment": "Malware payload", "value": "2ba95f4fdf002a4f755b6e15e750f442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693096647, "uuid": "39b892b1-4a80-4485-8ee3-3801e9413633", "comment": "Malware payload", "value": "268fa5506d67f76da0e8ea3f220ea2adec5166123a854d5e3b3ffc83c47fe453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693096647, "uuid": "70f31f30-7765-4c4d-a2f5-56263dc46447", "comment": "Malware payload", "value": "9f404c3df6bc3d2c0a5f203c58440e43de088c70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693096647, "uuid": "61e1d178-71eb-4cec-97ba-45d5e25fc171", "comment": "Malware payload", "value": "2dc4b415c587ccffd4ef038b162219c807d4883e302b155a30969d1c0b91893e472fe7ca6283dac2ec33bb7657640513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693096647, "uuid": "412fb643-2111-47e0-9a45-76164143c927", "value": "T144F53301B6C155B1D7510A326BBC2371AA7FF8310B94E7CF97118E69BF318C18A366B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693096647, "uuid": "081ff0f5-29f4-4808-a4a1-30607c7b84c9", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693096647, "uuid": "9abe378e-fd49-4413-a78e-f981e4ab66fe", "value": "98304:xWhl0BfKEevQo4eodyR3EtZ+QWxs3V4UTNVkdUWunjW+Gr:Aoeo02Q7iF4UTT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693096647, "uuid": "1166a57d-c0a6-417f-babf-66cd3adb9e09", "value": 3431877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693096647, "uuid": "b3e05f08-2f26-4765-ba7c-6dd09d27d73f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693096647, "uuid": "8d40e433-8108-401c-b591-48bce19d42c5", "value": "SecuriteInfo.com.Win32.InjectorX-gen.13117.2534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd30b53-44bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693129247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129247, "uuid": "737f669d-8845-416f-a076-1dc633c4af0e", "comment": "Malware payload", "value": "4cb563bf89a0407ba573f86a2f2a2030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129247, "uuid": "e5fdb1bf-3345-452d-b4b4-e5ebc5e89568", "comment": "Malware payload", "value": "272bd53ff4d7eb636fdee25136716e7e1c92db9c6360fcc4550ed2ea3a743619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129247, "uuid": "10b90a90-c739-4117-8903-4a3695256b63", "comment": "Malware payload", "value": "fae56a678e2681621da94a28a2251dacaabe76fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129247, "uuid": "d4ea96ff-6f2b-4089-b62c-b8bd3146b3cc", "comment": "Malware payload", "value": "54f14a9ef73efb3dc1c67f888cf675ebcb2cd65ee627fe4a7860ef4461ce402aa17122e204d04a217c8adb0c39d35dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129247, "uuid": "76fe4ea2-7a5f-4484-9a63-fc502056bfcc", "value": "T163350C813BC890A9E69EF6F9C01156104F611F2B770592880669B9BD597E3C3FC8EE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129247, "uuid": "1b035f75-5c9d-4683-8ba4-96588ec53ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129247, "uuid": "3c5b81fd-1dc4-4d05-bc92-d262b2f744b9", "value": "12288:zRTw5sOwVudNVyGb+Fv2GG+NdSqYRG5N3L:1OiFv2f+N4qMGP3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129247, "uuid": "4d49ac95-93b5-4391-bd65-5292c5213f8e", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129247, "uuid": "fa40c69b-1bc2-407f-8a65-065366778d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129247, "uuid": "206d9405-1e20-407f-a4b8-daab387d70ee", "value": "TaAgente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8503494f-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693169499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169499, "uuid": "7394a71b-b413-4a91-b2ba-e1993bac95b4", "comment": "Malware payload (Amadey)", "value": "03397e3eda4c5f8188312cffc9f68dc0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169499, "uuid": "9fb2f388-5330-41db-b75b-9a55439c712a", "comment": "Malware payload (Amadey)", "value": "28ead85e8b42cf0b921414b3b1dce0ab54c88d17239c2618a9fe0a3915c9c8f7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169499, "uuid": "5164000c-7266-4ffe-85e5-45a13296f5fa", "comment": "Malware payload (Amadey)", "value": "2c153cb185c1c2736fcd93c146b5035f33425fcb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169499, "uuid": "d0d3a5bb-c857-48ff-8e7e-4c5b874f9783", "comment": "Malware payload (Amadey)", "value": "ff956f53b996af132d26080185cc4a439c0ec5bfc8d65842f555afc16e1f35732be17a9aa9995d53d7167de730f97388", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169499, "uuid": "10cc4505-fafb-4fce-a464-cf38b9483c8a", "value": "T12523F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169499, "uuid": "d95af0bb-8518-4d30-acf1-2eabcdebe871", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169499, "uuid": "fb1e3991-4a7e-42d4-8d12-61790f08f43f", "value": 49241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169499, "uuid": "a7391653-0764-4c5f-82f2-e77cee94d8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169499, "uuid": "8c6de98e-a0eb-4424-aa39-1f74368b855d", "value": "03397e3eda4c5f8188312cffc9f68dc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7536f62a-44b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126952, "uuid": "7dffe67a-bc8c-4bb3-971a-fddd0c8986a9", "comment": "Malware payload", "value": "79873ffbe2f1e23b3fe224d3694af583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126952, "uuid": "4c60e886-de2e-4c7b-839f-2b5599279b17", "comment": "Malware payload", "value": "2921d0dce7fbe26192079568dd4bcb064ba16e10aac066f9497ba469ae366a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126952, "uuid": "96011bf5-b22f-4e93-8690-86a061d25069", "comment": "Malware payload", "value": "46dc4cf26e90e3ad26d385d3edb5eb7662099baa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126952, "uuid": "156a6f7a-6e80-4dca-921a-b00c25b1cb10", "comment": "Malware payload", "value": "e99cd9db9c4b4abdd02604865529ade3ddd2cf812efbb0e513247490ed303587c8603ca27cf0fd999f1c93a2a70a13ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126952, "uuid": "a185f2ca-06e5-47f5-8391-d40cbb7ddf11", "value": "T13645409D726072DFC857D472DEA82CA8FA5174BB931F5203A02715ADEA4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126952, "uuid": "158074f4-01bd-4d6c-a527-6efa72210f9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126952, "uuid": "f66e4a3c-c4d4-4091-8646-7341cca75424", "value": "24576:AzdcF4pV85uQF5oeRVXAZfkdTX9W7inPCv2h:X2eubggfkPLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126952, "uuid": "431aa1b8-7940-487c-8fb8-26af31e889ba", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126952, "uuid": "2c87ff1e-437d-439c-a282-2efdb053ed40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126952, "uuid": "430c68ae-6583-4160-9059-26a9b7904b6d", "value": "VLTKNhatRac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b870d1a-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110051, "uuid": "57c76328-3603-474c-aec4-970e9886401b", "comment": "Malware payload (RedLineStealer)", "value": "e299a5d0a90cb32052a9f1434ab2f803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110051, "uuid": "02337367-020a-4b26-8b9a-fa3b2436db84", "comment": "Malware payload (RedLineStealer)", "value": "29913c77694b44244bee55abec72c476a2fde93c0fcb196037249abf231db3b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110051, "uuid": "fc493291-429a-4eca-b073-0ef3ebd9c18a", "comment": "Malware payload (RedLineStealer)", "value": "bdeb2521a6524799982791c27121d2644af457dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110051, "uuid": "7dbfb92f-a7ac-45c5-ac8e-8c0432f664a6", "comment": "Malware payload (RedLineStealer)", "value": "94edb4bcc939832817572cffa845267bfee178c0072bab129c35a15177cd9d57412ea23459f411e0a6c6eff8ce994a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110051, "uuid": "56ba62ff-bf09-4152-b56a-28218d908049", "value": "T14D1523026BDD4132D9F11B7099FB0AD30B3ABDE2AC71936B1652AD994C73390743279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110051, "uuid": "0eb3aafb-70df-41b0-ab8d-529643e0e24a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110051, "uuid": "eeac9edf-2233-485f-8c2e-caf5ac5133be", "value": "24576:5yEutRcxb4I199XbPEk9wHezTpE81vu+BW:spoxb4y9XDEsPzTphv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110051, "uuid": "143d5810-0ffa-4367-8e1e-24b933de9968", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110051, "uuid": "fb1d9b0b-7b55-44ed-8bcb-a754d3962b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110051, "uuid": "2a54c64b-127a-4511-84b6-c6ff5349be90", "value": "e299a5d0a90cb32052a9f1434ab2f803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cf5b79-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693103737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103737, "uuid": "b8cebbad-68ca-4e6a-83be-feffbb79a0d5", "comment": "Malware payload (RedLineStealer)", "value": "385ab3e1bd6f300056179fd99dd7194c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103737, "uuid": "40631688-bdc1-4da2-a146-fcd25c5f8643", "comment": "Malware payload (RedLineStealer)", "value": "2ade8799dd2451aec697d4d43958b4a48ce38e12aec7731163cf929ef60441f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103737, "uuid": "59f40b4e-35c3-4c6a-8737-98a4e75b06b4", "comment": "Malware payload (RedLineStealer)", "value": "02e5950024d337d802edbd638444fe8af6c323fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103737, "uuid": "f9368d17-8972-4f82-ae16-b0feb0109f1a", "comment": "Malware payload (RedLineStealer)", "value": "5cde24eafe916d81d9868f1039a137ab9384f89bea444ce9668d6e78511b9730dce7b9aa41097c9f6c2f5b2986ac1cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103737, "uuid": "0e1a4c94-1133-45bb-97e9-fb852ee452e8", "value": "T1F1E41216A7CD41B6E9B11BB18CF30AC70E34BDA14D7492AE3385A91D18B39D9703277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103737, "uuid": "e92a22bf-ad4e-48ee-bcaf-62ca56a682d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103737, "uuid": "4ea0a6aa-15c9-4b03-a677-3507097e4e6d", "value": "12288:7Mroy90cLw0QJN5XNv+QwazGILdOgNg/sWLbM/Kk1eLnrXHGbeeKvNrb0Ewtn:rylmv4azGI4igkWLw/Kk1eLnr2eeK1r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103737, "uuid": "076a387c-9dd9-485a-b278-d3ab081eaa08", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103737, "uuid": "e8829fe6-6aec-42eb-bcf1-30a8821785cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103737, "uuid": "9457bcd7-b7c2-45f5-9f3c-e4aad8767296", "value": "2ade8799dd2451aec697d4d43958b4a48ce38e12aec77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160bdc16-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110042, "uuid": "91a5ca04-6a2e-4e1c-8f65-5bfb42eac901", "comment": "Malware payload (RedLineStealer)", "value": "2cf78a30b057638a172722777cc197fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110042, "uuid": "e8f225a8-e7aa-487f-a773-6b4b1b4941e2", "comment": "Malware payload (RedLineStealer)", "value": "2d7744165c443a6900ed139eeaee80ecebaf4fd7205add48add186d8a7f5a375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110042, "uuid": "54e86469-d114-4eab-9a81-9939df69b087", "comment": "Malware payload (RedLineStealer)", "value": "308402fa84f40ea18e4649cb0a1c32c2dd9e392e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110042, "uuid": "f9efc46c-7452-423a-9a05-bd6d3bf25ac4", "comment": "Malware payload (RedLineStealer)", "value": "0f08ec728547c3865e667d1baace2336108838de242deb0774586b8928e83682d8736469ca4615560c97246d5bec9930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110042, "uuid": "7d0c6750-aa09-4960-b50e-2bd5a59db42d", "value": "T164E41282E6D59432DCFA1BB468FA17D30F397CA09C3847AB1784695A0D725C0E4B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110042, "uuid": "d21540b8-fa50-4a70-bdd5-9257065082c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110042, "uuid": "4bd9a1c1-d4f3-4db6-93eb-61b2fb151702", "value": "12288:IMrzy90+h3XkjUch3lEXRWI+g9zEWV3lcKLxkWk9C3YxbKLeqaB68u:LyhanhKXkLg9BVVckxkWk9pxbKaNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110042, "uuid": "6445fc5e-7362-43f7-b831-754dd3dad8eb", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110042, "uuid": "defcb38a-216b-4dad-aa9b-fef72b5775ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110042, "uuid": "7e02abb4-ed59-475d-b802-51bdfdb377ed", "value": "2d7744165c443a6900ed139eeaee80ecebaf4fd7205ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac5412c-44b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693126559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126559, "uuid": "0afcce66-83bd-4077-8094-ec59f7a076b8", "comment": "Malware payload (RedLineStealer)", "value": "5d0b059761c6fedeb045c6577daed922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126559, "uuid": "ac446d17-740d-40eb-9e2a-72c39900e936", "comment": "Malware payload (RedLineStealer)", "value": "2da24f5ed9daf55fd224ab5d7aaf370ccbfd98079884a0128d8780f7eb0ae2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126559, "uuid": "9526e1a2-ede0-4d29-8ba4-080b4a7ec4b7", "comment": "Malware payload (RedLineStealer)", "value": "2b03c15f971908a604f9c7c2367e45db5add2556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126559, "uuid": "b2ed89f1-1e1e-4c95-8445-fa6002fe3428", "comment": "Malware payload (RedLineStealer)", "value": "b5109a61ad432bc75b8e88b02dad7fe9278a98e0cc145b7c39b741beaa9d5af6e3d45b3c9a34769db38807be6ace8548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126559, "uuid": "5a17497c-2781-49ee-a8f3-465dbd8fd11d", "value": "T158652346EFDC5021EDB18B706CB907830A357DB38DB84A5B3A96589E04733BDE531B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126559, "uuid": "63c2f15b-dcb7-4eda-ba3d-f5119b7ecf51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126559, "uuid": "8b4ac77d-44ab-405e-b5e9-5243d4b6df71", "value": "24576:7ywpbUvIfT74/7rDM62bKaQN6qnB7+GGTkZNkBBbL4nKFyP7ikjOUeqSxrQN7SR6:uibU+74zMNKaQN6qBaNTkZoV4KFyP7iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126559, "uuid": "a776c68a-9a03-4a3a-a1fa-a94761d4191d", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126559, "uuid": "156c1d3c-9b48-46da-b343-f54406b5b1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126559, "uuid": "be74150d-94a0-4962-b2a1-d04dc9fe6cd2", "value": "5d0b059761c6fedeb045c6577daed922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df536b87-4505-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693160201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160201, "uuid": "1898b1e1-ef9c-4490-8392-0562e0f5d416", "comment": "Malware payload (Amadey)", "value": "35b129dd353102385bff015c89e176db", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160201, "uuid": "e8e7cae8-6403-4580-bf26-ad72525832ed", "comment": "Malware payload (Amadey)", "value": "2fcc46e4b141918a70dd0c95ea77c5dc7dfff06ccfb2a829403020bbcba3ecf4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160201, "uuid": "74712186-9887-42f6-ab41-b0a82c5b537b", "comment": "Malware payload (Amadey)", "value": "186efaa537ff5487d4e1ce2d8837e0e4606ec2c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160201, "uuid": "4a782850-b8cf-4012-9882-052336b72680", "comment": "Malware payload (Amadey)", "value": "750d6be01638562f8208130601cd4ba6aa33858fb5645564c949c065b72c338b85f44cfe38b2a8cb62118fa35453873f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160201, "uuid": "f22be760-0d94-4c2a-9c67-3b801e96b63b", "value": "T1AA23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160201, "uuid": "26453c06-5034-4cba-97df-66ae522e7201", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693160201, "uuid": "34694efa-ba2c-4968-8e1f-71bec1674fbd", "value": 49097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693160201, "uuid": "584876b8-3e99-46e0-b49c-2a65303bfea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160201, "uuid": "15455148-39af-46b4-9005-5b08243f8bef", "value": "35b129dd353102385bff015c89e176db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df83b6a1-44cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693135291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135291, "uuid": "4c24d433-0b1f-42ee-b0b1-c4b9f2a03caf", "comment": "Malware payload (Amadey)", "value": "063dddf1e07d1fa0a3a1a284443d850f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135291, "uuid": "287bb7be-50ca-429b-afa9-ea81995d2334", "comment": "Malware payload (Amadey)", "value": "2fe0cc90516eda377475f291a4cf1cf62007e47fed5546bca66a46b348381f3e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135291, "uuid": "8d56c643-586f-472c-aa52-24f46c7eef0c", "comment": "Malware payload (Amadey)", "value": "3051cbf2ac11894d8a0c0ce0da0ae8c294f0f953", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135291, "uuid": "a13b2780-979e-4ee8-b082-a3388dbd3d22", "comment": "Malware payload (Amadey)", "value": "16fde45379a9bd3f58ddbf98593426615ef8e9f684468f9396ac241797373d9bb788e5121042e71a81c5de9e725093eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135291, "uuid": "3c955862-3b74-4e65-9b8d-d5950a6158fc", "value": "T1BBE4120AEBEC4162E5F51BB164FA03931F36BC52DA74C76F7649594E09B20C9E87032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135291, "uuid": "4a94d1ba-0763-4030-bae6-43037aabf1be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135291, "uuid": "f95861c7-f117-4a7a-918f-c323030b51a7", "value": "12288:oMr1y90iFjjdGhgQfBtv8DhZcVt41SGsk97NbsPjVsJZrj/STGa2Upc/:NyljjdQNtv81ZcVrLuxsGz/STKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693135291, "uuid": "d4087605-8968-488e-8ef0-fdac0124a4ab", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693135291, "uuid": "a1bf2b18-fe01-4cc3-b850-a1bb479ce946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135291, "uuid": "5e73a44f-8b08-452a-8b2f-d77dbc35ccb7", "value": "2fe0cc90516eda377475f291a4cf1cf62007e47fed554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7bfa42-44d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693138591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138591, "uuid": "1a6cdba0-2b3f-433b-a4db-4b3923175396", "comment": "Malware payload (Amadey)", "value": "1bd6737290d92464c08bd149433d243e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138591, "uuid": "58654d0c-5017-4610-94dd-da4b713f9fdf", "comment": "Malware payload (Amadey)", "value": "300a14d91dbdefa42b43017b7ff97114c896207ae8a8588be23093d0559b3ddf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138591, "uuid": "fe8b9116-d975-438b-8974-1a9cb70a11db", "comment": "Malware payload (Amadey)", "value": "7fcf6e47b9fc8bb7926454907f580097f167460d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138591, "uuid": "401d9e95-e400-49ef-b309-81ddeca7e015", "comment": "Malware payload (Amadey)", "value": "9a0fd8dd499a61cd0454c79d577767e884fb16a77c4af087b83c13291919dd8f0105082e3532332856e97b55906f2c16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138591, "uuid": "8618977c-bea5-42b9-adc1-c0590989837d", "value": "T1E8052307ABC5E062FDB917B458E603830A37BCD15D78437B3A89694E09B27C9E47172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138591, "uuid": "fa4dce83-821e-43ba-8013-fdee88bc8088", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138591, "uuid": "07ddd58b-e12d-4ff3-80e4-ed449002e4b1", "value": "12288:MMrIy90c2o9T/RAivq8kifcS3piFyWHinX2NSbfrBo2kPDQpukiqcnnk9WfToi:0yLYr0cBFyWHinBuMpukixvbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693138591, "uuid": "22100841-39e7-4a78-847f-d9bfba2eabc9", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693138591, "uuid": "ef55a6e2-7320-4311-a45f-dc3b772e6988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138591, "uuid": "5804441f-185a-4137-94e0-a67bb7682225", "value": "1bd6737290d92464c08bd149433d243e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10442d8c-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110032, "uuid": "1c96af81-ddfa-41b8-916d-6832235df558", "comment": "Malware payload (RedLineStealer)", "value": "64d55ed30488d5762191b7b4b632a333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110032, "uuid": "0d3cb029-a349-48a4-af36-6657eed6b293", "comment": "Malware payload (RedLineStealer)", "value": "3080e2a90d8333ab49e4859fa50ce2bca2312b0731a0325d929f8392c16d183c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110032, "uuid": "06d94e21-088d-4a77-a5c1-4476e485eb3f", "comment": "Malware payload (RedLineStealer)", "value": "1086328692b1371e53dfbaf4e7e5be23f967e64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110032, "uuid": "23380fcf-b59d-413a-920a-f881cfb9e86d", "comment": "Malware payload (RedLineStealer)", "value": "0e3441bbf5addb5b6f9fb3710eb03ab506cc995c1913beb74ef21200651967292ebcbbe292f2504c63e0cba38de7faa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110032, "uuid": "0c2b5d66-6ee8-453e-8e23-2a420becd4a7", "value": "T1B0E41213EBE440B3E9F8677468FA07830B367CE18978635B3355A9490CB26D0A87576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110032, "uuid": "d47d919a-5ed3-468b-93ff-461ef3400d35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110032, "uuid": "ad306ecd-3130-45ce-9287-6254b9309cdc", "value": "12288:7Mrby90WUEUFWcJFx0uiRJBWYoVr7kB+DdzwHjOjYvs5C8JK9elD:oyHUccpiRWVXdDdcqOdeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110032, "uuid": "b5a8fda3-7639-4633-bfa6-fba42d328806", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110032, "uuid": "f79a7b95-5188-4308-ac81-f1db043b4775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110032, "uuid": "c22d8260-b001-4df9-b415-f0482982eff9", "value": "64d55ed30488d5762191b7b4b632a333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dee16a-44cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693136189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136189, "uuid": "28231a15-7992-4c85-97bf-8cbffff34657", "comment": "Malware payload (Amadey)", "value": "48266bb3ba6ecf9be5fd85990b992731", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136189, "uuid": "bec6582d-4663-4192-b40d-ef2197d875b1", "comment": "Malware payload (Amadey)", "value": "309e26b0de74d73a4513f6cd9bbda07d168129591a27e1472474b8695186f22c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136189, "uuid": "fc4383ca-3b3d-4d4d-bed1-b1002f0b9efa", "comment": "Malware payload (Amadey)", "value": "a316212512dbdf6cd980644c9ee5161fdbd72d72", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136189, "uuid": "ebaac8fc-a378-4364-9523-b6ab86b1d2ea", "comment": "Malware payload (Amadey)", "value": "375331ceda931437f883a80b42c15bcc35660abf917f2a4513e9f2b046d71e2d44613b1d4f460e6c6a94cd781f9420c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136189, "uuid": "e6642907-3249-4b08-ba90-aa6c22718a1c", "value": "T100652383FAD94053D9B167B0ECF948934B79BDA34D3843262305F95609B2BA0F4357BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136189, "uuid": "d98fb1c2-c387-4aec-88d5-93a7df425376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136189, "uuid": "da9e69dd-e596-4f41-b9cd-a783628d3341", "value": "24576:zyLPLJGxE17uCrSUheuIKgcBSNQp2CBlfwYtf+uAQYv6LPpFkLE53F7842FJ5bwQ:GDL2E5uCTUnKgcBsQp9BKYZLAZCzpFwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693136189, "uuid": "2ee480c7-3b80-4014-a06c-8b719804465e", "value": 1460736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693136189, "uuid": "4f9d4fb2-5cdd-460b-b00d-55b310aea7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136189, "uuid": "451ecf91-9c74-4247-b7da-57da01d619ce", "value": "48266bb3ba6ecf9be5fd85990b992731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3643dd1-450e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693164020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164020, "uuid": "ad9ac532-11b6-41cf-a451-e8de3cda04a4", "comment": "Malware payload", "value": "93e7784defa1b30dcc93427bae186724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164020, "uuid": "2ee1c88f-6bb9-4c90-9342-fd425e5a9c87", "comment": "Malware payload", "value": "30e641405af2fa5bc1a705bf239a45bf8b8e42d6bf2c2692d98299d4a8ff344e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164020, "uuid": "d3298675-b7b5-471f-932f-2fc1d3ed8239", "comment": "Malware payload", "value": "eb20295f9ee17ce56965fc426c347a4fa7992fcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164020, "uuid": "003bc752-8ec9-4a56-bdd9-5c5c1a970739", "comment": "Malware payload", "value": "74efbfcb422a05e9807e3fe07645beba41e1bcdd7c1d1d7d72ed7f05eb6fd8887cbcf390cca46547fe9dc2b84c197067", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164020, "uuid": "0e9a79ca-97ae-4ca1-bd5f-6d6c1ce42811", "value": "T14155294AFF8CCF23C96F5FB7692603F657B5C28A6782A78B119D91A08C463005CE527D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164020, "uuid": "50bf98a8-9e03-45af-9af9-39e0afc4f11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164020, "uuid": "836b64cc-f216-4313-8b40-6abcdc85d938", "value": "12288:suyj5aH+AStprOKd+RyAWjOXjrWq7WWXFpdp8LxwrLqgpwZWpT6oIfo1AfBNAWUU:L+Ltbd+R2OXjrWq51pmxwrNpKWZ6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693164020, "uuid": "f48539fd-22af-401c-a2e2-4ed9c978f417", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693164020, "uuid": "bfe4cbe2-4190-4188-b188-a36cf22dd1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164020, "uuid": "7ce7379e-e708-41bc-b6d7-417c468740b3", "value": "93e7784defa1b30dcc93427bae186724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758cb68d-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169473, "uuid": "7c6a3985-42dc-44b4-a5fd-f0dd064d31f4", "comment": "Malware payload (Mirai)", "value": "9b8a279adec61daee9189329e85790b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169473, "uuid": "fe33aaaa-0549-480c-8555-7d79b75b47f7", "comment": "Malware payload (Mirai)", "value": "342d440b8ec7bedc7e600374b443bdcd0fca5282402b18e08a39e3121be73436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169473, "uuid": "adeaaff1-7330-4409-9b92-0db44d5c231e", "comment": "Malware payload (Mirai)", "value": "5aa21286f15b0d046bb8044ab0a500c264625c6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169473, "uuid": "a2ad6f0e-6dc4-4a65-8438-ca9b727d2980", "comment": "Malware payload (Mirai)", "value": "fef240117d36a7795f5ffe8bf7beeabc4cbe707f8d8999cf2ba6e2a90c9b9d718216fd65b2ef0f4ed99f168b07820003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169473, "uuid": "bd9d6274-7b8a-4500-a575-543c5445dfa9", "value": "T12AB2D1A487926B07C270743AA2788F92563B16E4C5F639372B2192BDDA4145633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169473, "uuid": "dcecaea7-bba7-4e16-8e4a-6142cadb071b", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BvNBZqtAhymdGUop5hu7a:4GHKQFH0rs3zWoDDRsjt7LB9U+Bv1qtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169473, "uuid": "e62130fb-2e56-43f3-8d19-8493c6a957a8", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169473, "uuid": "c748ef0e-1398-4ac8-9b57-3a7a5d21afc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169473, "uuid": "bfa3d822-a091-47f1-8f71-16da7da862bb", "value": "9b8a279adec61daee9189329e85790b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63209173-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693178032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178032, "uuid": "ae4f838c-89cd-4e51-b88a-ca9a8158f4a1", "comment": "Malware payload", "value": "12bdf3966c9db070fee521685bd5640d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178032, "uuid": "25eadc0d-3b1b-47b1-b262-71b5f77c5ed7", "comment": "Malware payload", "value": "34566f261670720191815d5d9440c8bc03ae2fdf1706c285eae27cd18bec2ab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178032, "uuid": "d9afc92a-bb91-4999-a055-63a7f1835adc", "comment": "Malware payload", "value": "be570e5997b9b1aa528381b0085a12930e89b1d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178032, "uuid": "5a47491c-c479-410d-9145-a4a744e4711c", "comment": "Malware payload", "value": "9050ee3e7102257ed3b28999ca1193e32a062682a8948b1b67c4f83312fe0829cbcad51f1afb5d9293475f9da15000a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178032, "uuid": "391da087-7af7-46e7-b93e-be608d124ea4", "value": "T11D635C02F308094BF5A71DF03A3F17E1D3AFE98121F5EA45691EEA499172E33154AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178032, "uuid": "1f3119c9-8122-40d3-831c-5474c7364c87", "value": "768:zAhOAZTLNzHPvbfYjE5nk9L+sdyaMZ3iZCSod6mnlqzFgwtIBQ7qAliBeu0I+:0HNz3BnWLndMmCF6olqmwKBQ7HiBe9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178032, "uuid": "7ba2fcf7-4aa4-4c7a-8e65-1e1fa30ca654", "value": 68848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178032, "uuid": "d88b7a93-bb31-4e39-8089-29d3d4678065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178032, "uuid": "b5f43036-096e-4eb3-8c1f-5d30b5dc91c1", "value": "12bdf3966c9db070fee521685bd5640d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3cc571-44cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693135287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135287, "uuid": "7a7ce875-ed5f-46aa-97a3-fe779f912558", "comment": "Malware payload (RedLineStealer)", "value": "cc3176efc382688b69d206996e5c474b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135287, "uuid": "8d752897-11e4-4971-86a5-0ec74e252111", "comment": "Malware payload (RedLineStealer)", "value": "35ca784235e315d879cd680645e2dcd75705fdbcbcce6b05d97a70f4b5b1b90d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135287, "uuid": "1c5f0c3b-87c7-4f88-a61e-89d4626393db", "comment": "Malware payload (RedLineStealer)", "value": "23bccea7cd28233522860089cd6c4ce6b73cbb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135287, "uuid": "f305fcd6-22d4-45c4-8f6e-f0950e670b06", "comment": "Malware payload (RedLineStealer)", "value": "a1b8b8e60b744c295eaf22128c7569bf2acfadcc37fbcb1ecbd69cb74511655db8015193540d3b1d2fb36b5b6abb2c38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135287, "uuid": "7797c5b1-3b4a-47a2-85a4-951afaaf7dd6", "value": "T1A2652317ABDDA022F8F127B028FB06832B397C914935476F6785C66A4D72AD4E13077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135287, "uuid": "f87d44d4-bb85-44ad-87cb-ad11d7447ff8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135287, "uuid": "bb83c530-6df7-4757-9286-dd5b265bb0f8", "value": "24576:LyEJ5MxUfVR9haK0K5freyqjtkmG6UoEJiOH20YHoy6Q/z0Ty5qVUM4RnU:+EJ5MxUfVvwJK5freamLsiOH20YHoy6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693135287, "uuid": "67a86d4e-fffa-49f4-866f-068977045887", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693135287, "uuid": "041bfd48-20d2-4c1a-9ed0-dedaa0960b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135287, "uuid": "59b96cb2-2eba-4aec-af0a-27784ac24dba", "value": "35ca784235e315d879cd680645e2dcd75705fdbcbcce6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2f4531-448c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693107930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107930, "uuid": "74b3db71-fb5c-4f04-beb1-b39738ff4a5e", "comment": "Malware payload (Amadey)", "value": "220ee7e1b8259f913e1660fc07555e20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107930, "uuid": "c0c284a7-ad58-455f-b54e-cbec4d2c38ad", "comment": "Malware payload (Amadey)", "value": "3653ad2a127661b2c019de9612eb0674169256450cef820e5a15f3d6815c966b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107930, "uuid": "68e2cead-3499-440a-acb4-771e63ee5585", "comment": "Malware payload (Amadey)", "value": "4d0b499dd58c06848d23784def3ab8d208302165", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107930, "uuid": "a95cbddf-4f8c-4524-8cc5-788e82649b43", "comment": "Malware payload (Amadey)", "value": "add1c9073fd23ec9e2fd1bcc81e35336d2e4eb5291d627eb49cfc08d0ab1118db62fe80dfa69388d5e2d8197fac72103", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107930, "uuid": "ccc706cd-3657-451d-9a20-b3259a30833b", "value": "T137152252FBD844B3ECB9177059F706930B387C625DB082EB374A2C8F48B6794A075B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107930, "uuid": "0e11b5d7-8439-459a-ab55-b119ad5b7ff6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107930, "uuid": "25ceb00e-1f61-4265-b012-d33538ef3e86", "value": "12288:zMrky90mpA2y9omDpEMFYdLf1c3125IJ1W3YUO0gNB+Ee/v4LoS2LUr9ravL/7P0:rycNd52f18V1WKkxOILUhrkFcsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693107930, "uuid": "5dabd040-5eed-42f0-8026-5d3ba78521a6", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693107930, "uuid": "5e8d2130-523f-4de8-8d1e-b62f3cb078a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107930, "uuid": "8be5b65b-cc90-45b5-bba9-a7d6994edcb2", "value": "220ee7e1b8259f913e1660fc07555e20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7734afd4-44ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693134686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134686, "uuid": "d4ff7e43-997d-43e8-ab34-ab8716835bfd", "comment": "Malware payload (Amadey)", "value": "833cc93c014e08d90ced8954b27833be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134686, "uuid": "913ea3e4-f576-4624-8108-52755ec266a9", "comment": "Malware payload (Amadey)", "value": "3979a6680315c384e2ef7563a0528678e8640fa96bb435279613bb3866f1788d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134686, "uuid": "012fd913-b78e-4b1b-8e75-0e107a2de2e8", "comment": "Malware payload (Amadey)", "value": "52df29632acf978cd5b35619ec684b495cafea34", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134686, "uuid": "200c39ae-3498-4c32-86cf-9321ae7a043a", "comment": "Malware payload (Amadey)", "value": "5adcc9bdf66c8890b5e58ce1e9046238ee2077c900d3db70224c2705080ce3386b8a9ad9d56055daaa4e8d55c6bbb8f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134686, "uuid": "042b12b1-bda3-457e-937a-eb5e9e205244", "value": "T16F6533629BD95031DCB9177058F213C34D353E6158F4CBAB3B47A92F4D73AA89432B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134686, "uuid": "ee327319-bfc8-44c6-a108-a7e4f7183b4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134686, "uuid": "e67af894-a86c-4d7f-b214-95729a6f1d3c", "value": "24576:+yHfWTQw3noU5Rhx5tXXdvHcKL6o0Z1WetncYCzRPrw+CJ4C3RugVJBcKywj0Lzn:N+cYLCKL6oIwetV+PkLJ4C3jJYLzlv/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134686, "uuid": "d2ab3785-d6ca-4c30-973d-859de46ce4d1", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134686, "uuid": "dc3e8d2c-2bbe-406c-9c3c-fba94b29c552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134686, "uuid": "602c20a8-8e83-4aba-9b97-0cf6909c84d0", "value": "3979a6680315c384e2ef7563a0528678e8640fa96bb43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b712cd-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DanaBot)", "timestamp": 1693129845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129845, "uuid": "d1c4abc6-f8e7-402a-9e3f-f1b9a1bcf71a", "comment": "Malware payload (DanaBot)", "value": "08a1f2e6ff6d3683cd214bb1dda8f171", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129845, "uuid": "bb4c84f7-dfc7-44fd-b854-087444376204", "comment": "Malware payload (DanaBot)", "value": "3982b65ea18cae4789dd20a622a0d23251548cbb7d5dc40325845068c1e23e18", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129845, "uuid": "ea64507c-2acb-43af-9e90-8486c4647fc2", "comment": "Malware payload (DanaBot)", "value": "a13fda2fbe6816b6f70f038d3cb6b217739d5c6b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129845, "uuid": "06bee348-9213-4c50-a4a1-1366a0becdbe", "comment": "Malware payload (DanaBot)", "value": "da8ae21476ab3f84060b2c9b799ffdcee154c84a148d69e62426e248f47d41ed203fbd1f429154d5d9fdea45ed691ed5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129845, "uuid": "3b6b1afd-c114-4445-94e4-c68bcc5d06d1", "value": "T16F2523213650C872C72716B52039EAF5EABFB43105B5996B3B9901FDCFB12D2137A60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129845, "uuid": "92970140-67c1-4b8e-b73b-96418a35b0ed", "value": "4b16a027e1091eb772f50ba43644540c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129845, "uuid": "92ed5ca2-0344-4ea3-a0b0-c1ce0d5f806c", "value": "24576:RPHguA06VNmfwK1QzMolH1p1hjlWlQx+YOpMi0mwuYf:RPguA0w215AH1p1h5Wm+YOc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129845, "uuid": "5a7dd525-5c7d-41d0-8e4b-aca627199e6b", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129845, "uuid": "a03fe9f0-9990-4026-88da-dc3a394b82eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129845, "uuid": "84ba42d2-9ce2-432a-8de8-c873418a0100", "value": "root2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2462f1aa-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131970, "uuid": "da6c1692-e854-4312-9263-36c4707bedf7", "comment": "Malware payload (RedLineStealer)", "value": "c116e6e560d5f856a9562f5457d074e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131970, "uuid": "d0c14801-4c34-4f8f-820e-92a3b0d7e07c", "comment": "Malware payload (RedLineStealer)", "value": "39fd24a3dafe61f1d9f6fac7043a8c30abbbd1705a7da2a82bc53475f1a48bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131970, "uuid": "72ac7a97-e809-48ef-bb0c-7ae5226ec4d5", "comment": "Malware payload (RedLineStealer)", "value": "48b1c8c45e64df9a6537b1e601fe92abfa9f45b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131970, "uuid": "f735aecf-a4b4-4986-98ab-998d75a0afba", "comment": "Malware payload (RedLineStealer)", "value": "6e71287cf3a881acbda94f9b61dc3ec61b9e9b73d2cf2dff55e7e0f0c5df7b631a1b01d6bdd9e4704704f8061a0737f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131970, "uuid": "2a922e84-916a-473f-a478-8f43bcaf89f5", "value": "T133E41202B7E49533DCF413B15CFA1A932236BD615A38076B7386A88E1D736C4A4B173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131970, "uuid": "b8f613f7-97b3-4d85-b2f6-5d97dec4641a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131970, "uuid": "4762c344-ebeb-4dab-9e7a-ced43f2e9fe9", "value": "12288:2Mr/y90UrNenJmANfXVja67HVXhTeHJY+TzUr8Gjh7xNvc9cKr:ZyLRmJpN9jawfTPNjh7jEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131970, "uuid": "61b8a73d-9281-46f8-9ab3-122c021cac60", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131970, "uuid": "ac0639ec-4df8-4da7-b0bf-f75bba27c21f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131970, "uuid": "b818442f-365c-4bb3-b0d5-95f286780a39", "value": "c116e6e560d5f856a9562f5457d074e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de766f97-44cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693135289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135289, "uuid": "6c65929e-2cf5-487a-b685-f6b3298fdbbb", "comment": "Malware payload (RedLineStealer)", "value": "50504f78d1f1513d4bfe41607ccec2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135289, "uuid": "1c3c8e48-69e6-457e-aab4-f7f15d75a86c", "comment": "Malware payload (RedLineStealer)", "value": "3a0f067951cdaf49c248e562e1877dda8c915650c11bacc5b79ef07a9ed1d7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135289, "uuid": "9e9c7e45-e9fd-4770-ad4d-d0dfc91f9a27", "comment": "Malware payload (RedLineStealer)", "value": "46d47551aae81cbbcb7b495ab5381609833aa055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135289, "uuid": "8200b726-bbf1-40af-ab4c-942f6cf343d7", "comment": "Malware payload (RedLineStealer)", "value": "559cc507f07b29c7e33406b22b1404c9e0109bf6972b73ec78146cd83035e2b10135e7ada289c13688a80a225f7a72f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135289, "uuid": "d0c39e70-5d51-47c0-9eeb-704e7350d0a1", "value": "T13D152247B3CC8437CDB927705CF602930A36FDE2A8B9476B2341D96A4DB7692B474326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135289, "uuid": "716191a5-ee8a-46be-a2b6-bc94ed866e78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135289, "uuid": "09b9cc09-fd11-4b08-8406-a91df45b381d", "value": "24576:lyodZRDmlhB0H3sfOjdeb4P1t33Mmxpc7LRGZ:AYZEIqXb4P/Mmrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693135289, "uuid": "0d2572e4-4c65-434d-b87a-ba2da891275d", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693135289, "uuid": "18084e75-e81f-4a9d-88dc-b10bec78b086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135289, "uuid": "3ed14d4d-b0a4-4234-ac1c-0ea731923f62", "value": "50504f78d1f1513d4bfe41607ccec2d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0a3464-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "37202b68-7812-462c-ad16-f88b3fbe8186", "comment": "Malware payload (Mirai)", "value": "76dff8133d0a2d7011b0b63925e60a83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "d6c8cd7f-0c70-4381-ae7a-791b4285712b", "comment": "Malware payload (Mirai)", "value": "3a4f9adb49abc9b8ddc4c721388c667d505e306796fb91c57f40582cebcffe04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "8f818cbf-0167-444d-9dec-59b306583a0c", "comment": "Malware payload (Mirai)", "value": "0e40da774e0a233519956d9f83696830561fd9e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "7cc420f2-595f-4223-8030-3497769f5b64", "comment": "Malware payload (Mirai)", "value": "29014f9d343101316ff9b5f1ad96620a98074e284ddd74518186f2b2237f539df6219164f91505539fd8604c8c792d1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "2f02eeb8-4046-4cd3-8b26-1ec5703592b3", "value": "T190C2E1BC3EFB5F83CA1B0035699CFE3382B0A5A5D35B7697B24441026C130E5AA67C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "2c6d8d6f-21c3-4d62-b02c-08eb80b5210b", "value": "384:MG1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjn1/x:HMw4DZdFbBy6x3K/KdWnH5gjT0NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169403, "uuid": "048dcfbb-6f56-4e3f-9325-b05cd2ab3f6d", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169403, "uuid": "10046309-c837-4fbd-b29f-376ff4dce863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "c337cb72-4469-4e09-b932-07f1f1961f37", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100c536a-4483-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693104019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104019, "uuid": "823b1868-9928-41a4-8055-074949bd6824", "comment": "Malware payload (Amadey)", "value": "d258bfd8988add1e3a94660eeb23f65b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104019, "uuid": "c0baaccf-cdc5-4d4d-8e71-86bfe9fa895a", "comment": "Malware payload (Amadey)", "value": "3a90ba33dfb384f2e4f5f3bba25643bda5743ebbc0c767e45892bc55926fa107", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104019, "uuid": "1bb9e557-5d3c-427e-b2be-d0aac4a2618d", "comment": "Malware payload (Amadey)", "value": "1c7272121d0411b72ef43a992d38a92bc7602ee5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104019, "uuid": "e6a65be7-d7e8-4869-ae96-42d263a73c5a", "comment": "Malware payload (Amadey)", "value": "bb977ea2f668ccce455cbba6047ddade0c89dbc77331aba9be7d18233f2f1ef1bb1144d25c7dbb1dfa5d6258aac6948c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104019, "uuid": "97d3ca83-29c7-4ade-8509-cb4605a62c41", "value": "T11C652343EAEAC122EDA973B19CFA06030635BC355C75936AB785B84B4DB30C9953335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104019, "uuid": "36779169-e17a-4851-86a4-463640a6bfe4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104019, "uuid": "01e2d545-daab-45b9-ae95-6275d7bdb9b4", "value": "24576:Jy+HQhJ04nZJPSZIzN0TKKD3EP3kaNIdudJM14ZAWQUZOGWrgXzx6zhX4jTiFIvq:884nZJP/zXKD3EPUKidiZAaOGrJyHeWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693104019, "uuid": "a0538d55-617a-459d-a1e7-45d4bea75097", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693104019, "uuid": "725039ea-af2d-4ced-900a-f2f2e6448d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104019, "uuid": "66e72bc9-95dc-4041-a43c-4a843ff21b03", "value": "3a90ba33dfb384f2e4f5f3bba25643bda5743ebbc0c76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516da53c-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169412, "uuid": "4b61cab8-f8c9-442c-95d9-fa0561c846b2", "comment": "Malware payload (Mirai)", "value": "c3667c152e654bf9d7e62a9975e78ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169412, "uuid": "8001277b-368e-4a26-9bc7-b263a2719ed6", "comment": "Malware payload (Mirai)", "value": "3b11c1e6c717a677ffa1f62457abd8853891f01dd08a3ed5775454dc7757538f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169412, "uuid": "7fabcb9a-ef6b-4de6-ba12-82cda8a4c4c3", "comment": "Malware payload (Mirai)", "value": "8ef9f0468af4d6e2c5cc7e3ab4d270cba1b03da8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169412, "uuid": "32923df7-b9a3-4d53-a3c2-b3a890b17d68", "comment": "Malware payload (Mirai)", "value": "981b899b294f15b3340ca4a4b2a9417eb5d11def217bae674a39b520dc567e15677ed481604eba1ff45af89fb1eba69e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169412, "uuid": "5902a7b1-a1f3-4f5e-8e27-50ce26890e86", "value": "T145D2D11CC94D7909DAAD3DB955CF96B92D8CB0C0A34DE68E07178458BA17ACBBC071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169412, "uuid": "08f85a4c-e65f-4637-8d31-009592dee2b5", "value": "768:C1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN+rKMJb8WUp:CbDs06t4BEub4sU/MbU+rKMAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169412, "uuid": "d2e16f0c-d75b-41d6-be75-19bc2cf8e7a1", "value": 30316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169412, "uuid": "eb320b75-4f07-4cd7-b9f2-dac55e99ef35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169412, "uuid": "3d47b967-c806-4cef-a3db-3b2b02034537", "value": "c3667c152e654bf9d7e62a9975e78ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd304b47-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149407, "uuid": "3614d2c4-04c3-46c3-ac2d-fabfce4caeae", "comment": "Malware payload", "value": "4ed53b1a16935307e6971978b6b9c62d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149407, "uuid": "10337de9-8d72-4da5-a399-57d92fb0ed0c", "comment": "Malware payload", "value": "3b14a5230b750e2bd1ee08d8d03078f362cddf9ada32a46b465b278656cc4cb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149407, "uuid": "758fc1fa-f06f-4f28-9530-4ee4f540ee52", "comment": "Malware payload", "value": "beb31d6619b1a02fbdb41b712af067bbfaebc7e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149407, "uuid": "7adb70d9-8191-419c-b354-efefbafbf8dd", "comment": "Malware payload", "value": "96c5a1f45f33a23b60385f95c7372bdd625b73a4b2372ba3a8cb003c93bdf602c6083db169af5f7f422f1591db5d0fe7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149407, "uuid": "34c68a5a-e39c-4562-87a6-c35130cba3ff", "value": "T174834B42E746CAB3C4430AB202A7A76A4532F83B5E2B9F45F31C7DF4AB164D87227355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149407, "uuid": "35672119-cc3b-46e6-a322-341d4ad90e08", "value": "1536:noTtSv0GgyWHs3swuC7SWnkemPOrPuY4iJ0VmLIWVOCjXZRsFS:nOSvzcMDlSWkeTaviymUWVOCbZRsFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149407, "uuid": "a39ec7b4-6460-4dd6-afd3-581681e8a182", "value": 80968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149407, "uuid": "f8b163e9-e683-4c76-8190-4d7f8d8fc619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149407, "uuid": "d7885ca5-6518-470e-b298-9bbf114e26e5", "value": "4ed53b1a16935307e6971978b6b9c62d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bb2f9a-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110040, "uuid": "50c0d94e-6bed-4469-97af-d1902e1bf760", "comment": "Malware payload (Amadey)", "value": "5006e229ca69877eb8e5862fedff6f2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110040, "uuid": "e635a029-65f7-4044-9f48-6b67d81588ad", "comment": "Malware payload (Amadey)", "value": "3d62e721af724f9ac4dd0db1d3fee3822860a528ebfe24b88fda7d32ce723dec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110040, "uuid": "a6316a1a-0dcb-4e5c-8bc0-db8f6c5aaa77", "comment": "Malware payload (Amadey)", "value": "0af603b0e8a8bee9f72a98cf04d074ce749b3288", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110040, "uuid": "051e4a3a-5eb8-4c66-805d-73ae5bc8a5ae", "comment": "Malware payload (Amadey)", "value": "eef80aa4c5f5596d2ae8c8b808f215dc53702e52252221ff57d0ccb381cfeae8367955ec89260643d3dd279ddb3ebf5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110040, "uuid": "a6cf5a4c-03a8-41d7-8560-fa9f63d3e1b5", "value": "T13F052353A9E840B5D8F827B008F617831E39FD60A879869B6754D85E0D336E8F53633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110040, "uuid": "d46323a4-5d88-44d0-85e0-a81ee6f3b6be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110040, "uuid": "d0bc6531-5b1e-4d88-9011-31912b7e09bd", "value": "12288:VMrMy90NzjqxLnV+LX1Clj/laSRj1fOc0BHRZ6B7XOcuiCNU5BGUPoeEmQhPeN:Fy+z8oLFCF8I5CHRciJiCNUfG/sm2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110040, "uuid": "b1273a9e-3841-43e0-9a14-6c7ae15ffc64", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110040, "uuid": "9469cc00-8500-4d91-b419-4baf94ba2837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110040, "uuid": "7bf49bac-be94-40c1-a140-448609811242", "value": "5006e229ca69877eb8e5862fedff6f2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171e8065-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110044, "uuid": "a1598bcf-ebcd-467b-9106-531a6e0c1c2b", "comment": "Malware payload (Amadey)", "value": "5b104f526af7f41066e5026f43a9d33f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110044, "uuid": "2445b805-b8c6-48c8-8a76-9e782a8b4d42", "comment": "Malware payload (Amadey)", "value": "3dca6c9c5f620075ba1bf7ba642417a9c77a71232b56859dbb70313b8f798a33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110044, "uuid": "903c6f4a-acb4-42f0-a2be-fa11e096814f", "comment": "Malware payload (Amadey)", "value": "f809df18566b954f3e794498c724f0d7b2cd5dda", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110044, "uuid": "ce637a31-5b68-4902-ae5d-9981b5905230", "comment": "Malware payload (Amadey)", "value": "bd460e16efb16bb98927bb2ed54586b0b82b98b7ea356d859e95fd57141e36ba56a2f73f4db12dd439959555790e2074", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110044, "uuid": "1145b06a-152e-45f7-9369-0500ff9461e4", "value": "T1A7152212B6D88863E57123B018FB0AD32A35BD909DB542BB33909D9A0C736D4B536B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110044, "uuid": "fe70be8f-070c-4bd1-90ae-f83e48c97f31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110044, "uuid": "294efd2a-a205-403d-9c8e-cf59a82a070b", "value": "24576:RyEgbgwAgE/qAj631WFfJHadHyYS/aZsQDhv5d:EVxJlWZJHMy6ZXDhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110044, "uuid": "f9e7f89b-b0ca-4f93-bc8e-178bb6232122", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110044, "uuid": "bec3313c-0b05-41bd-9c2c-4689c60ca17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110044, "uuid": "356187c2-d8eb-4128-9c5c-29ef40c14db9", "value": "5b104f526af7f41066e5026f43a9d33f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116552ec-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110034, "uuid": "9e67876c-e41c-4dff-9ade-7605c0007673", "comment": "Malware payload (Amadey)", "value": "1c790133d9fcb19dcf805e7573dbaf9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110034, "uuid": "1ab3b757-dde0-47fc-b5d6-4a9c087a8ce7", "comment": "Malware payload (Amadey)", "value": "3ed7b76a458193d9702307553f24f7aa68e005e0db4dd1afac4b07833eec277a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110034, "uuid": "edbba308-9756-438b-badc-ebedfb596b75", "comment": "Malware payload (Amadey)", "value": "8ccf8bb16d2346abecdb6326157aec37db80fdbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110034, "uuid": "bc3709d9-0502-4a72-9172-ebe967ff4944", "comment": "Malware payload (Amadey)", "value": "b475c38391fe79b99ea4939b1c8600c21f0a2e1f4859ddaa74d7f80b3f73713b769d3804c3285c5aa9245f05baf7c32a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110034, "uuid": "10dd786f-f780-44d7-8f4a-15383843a495", "value": "T149652345EAE84031EEB667B4BCFE068B0A367DA059B8574B7785A50F0C337D06E31B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110034, "uuid": "5d4d5363-1e26-4503-a9a1-d7c55ccd98ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110034, "uuid": "f392acd0-a822-4410-9e43-1220add0376f", "value": "24576:2y2ARAXOEnjgK3eF14i1K0qnUKXbTt//cHOq4mNOQbEyH+YP:FjejEK3eF14vbTN/cHOgTbEyH+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110034, "uuid": "0e656e6b-7dfd-41ab-a145-9a1a73eed6a6", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110034, "uuid": "97b86faa-8c5a-4ec8-91dd-cfd98022efea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110034, "uuid": "51645b5c-dc64-4409-a02d-c8b80743c5ca", "value": "3ed7b76a458193d9702307553f24f7aa68e005e0db4dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5c534a-452a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1693175824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175824, "uuid": "cfa299f0-ee16-4cd1-8438-09a898ef7a8e", "comment": "Malware payload (CobaltStrike)", "value": "0263214f05a88d60fafbe390bf23d1b6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175824, "uuid": "c32fccc5-4f5c-4446-8d49-cb3b3679b261", "comment": "Malware payload (CobaltStrike)", "value": "3f03890b9ac3329e8f68b04beebc191ac494212a28b99fcbcc5aec81d4e727ea", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175824, "uuid": "434f2e3d-b4bf-4243-88fa-47fbc0390243", "comment": "Malware payload (CobaltStrike)", "value": "6c07146193c064076f689f1e44a94e5dd19ee203", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175824, "uuid": "65c3b50a-7524-4b02-991f-7801dc26927f", "comment": "Malware payload (CobaltStrike)", "value": "208b771d16d835a8cd35044810e290117c87c6100eb8478d8b69c77307ebc1dddc7f492fc7677105a5f71668629d3a4a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175824, "uuid": "66be0af0-dde7-409e-b995-f118f058a5e5", "value": "T15FD58D967860D8B6E0AEA272C965A5927B347C510F7273C72AB0B3F91E737D09E35304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175824, "uuid": "72053e7f-8d9a-43fb-9d41-e4644e07531a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175824, "uuid": "b9d40a2e-91fb-4344-9c5d-1da4c56c938a", "value": "49152:4gQY3MD9OrRIrb/TCvO90d7HjmAFd4A64nsfJbDa9SgsOcVdAJydD1D:GOrReJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175824, "uuid": "fcc43804-eaa8-4568-bb03-da08f38276ff", "value": 2784256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175824, "uuid": "126b947b-ec9c-4e16-962e-f31fc939fa3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175824, "uuid": "787aa723-bf3f-4722-a43b-c673f2a891fc", "value": "0263214f05a88d60fafbe390bf23d1b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438400ac-44cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693135888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135888, "uuid": "c62ed76a-090f-49cd-b163-494dd3574ef3", "comment": "Malware payload (Amadey)", "value": "a3269e5705ae39dca3b5c526b311ede9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135888, "uuid": "180018b1-78a7-48cc-bd3f-3b4844c82973", "comment": "Malware payload (Amadey)", "value": "3fbf082f9700c611376ca0163b124060bf62a0775529a766fc1b10f11fb82b96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135888, "uuid": "820844b8-3803-411a-b0ab-efa9d41f1a13", "comment": "Malware payload (Amadey)", "value": "d01605523214519af48436f0b49480aee0e6941a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693135888, "uuid": "dd9a8e3e-ebd1-433b-9139-9f687c77e341", "comment": "Malware payload (Amadey)", "value": "7d6538f3adb37dc06b35b8cd86e63ea3b65e8bd417fc29fcc2d059927d607fd81cccec5f4eb76415db35af268ace52c8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135888, "uuid": "f6f8bbd7-3eb1-4338-a063-7efde71128f2", "value": "T1E0052357DAD88472E8FA2B710DFA02971F3BBCE158B087A73749589A0D73594703232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135888, "uuid": "f9076762-0cde-4fd7-9ff3-4516de6d07ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135888, "uuid": "94894f12-d568-4336-8d83-82ed671db163", "value": "12288:QMrsy90SQ7fIB2q5ca3wThb2oVjT4B4meaRqbGl8+WusNOL4FrIMSHciLJCuJY:syjt5HGhLVn4btaGl8ysNOL09INCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693135888, "uuid": "673ee133-0f5c-4fa3-bb81-735a25db8bc5", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693135888, "uuid": "c0855808-dfaa-4913-94c7-a314b73be151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693135888, "uuid": "2aa15ca2-6ac5-440a-9cc8-753ef66ef1d9", "value": "a3269e5705ae39dca3b5c526b311ede9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba4ecf6-4481-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693103448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103448, "uuid": "0c64ec7f-c409-4181-8cb4-4259fc4822b5", "comment": "Malware payload", "value": "3360ed59e6b5a767223845de4c8a8722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103448, "uuid": "44dc941b-2a4f-4ff4-81e7-bdb1b278ae0e", "comment": "Malware payload", "value": "3fe822301a31d7f3d2d08683ea2921fa5142740194e847fd4ccefc688d2e205f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103448, "uuid": "a87b21f7-edb9-46a8-84c3-e72e751e5644", "comment": "Malware payload", "value": "5a6ad13aad347b051e1140ea75cba2bb908aee50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103448, "uuid": "711b6b99-3382-4b68-8d6b-c9cb52c6477d", "comment": "Malware payload", "value": "aa67117a919b4d9ec49ed70f9949d6baa1089ec5d0d6423188786a2666f98daab5c0e4796b5bca0646cc15f9210e0360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103448, "uuid": "a0bd90f8-acbc-43cc-a1b1-25c0564f82d7", "value": "T151E53302BBC084B2DA6349321E662F6A96BDF8205F19DECB5391DD6D9D322C06735B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103448, "uuid": "a343df3f-47e7-47c2-8ad4-ba633e790243", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103448, "uuid": "4da48137-aa57-44bf-8660-a22286cee163", "value": "98304:kWhSeBfKEKEmhApqPxNhNW0nh8MOImeZcH6tZimw0gxT4:Cn4pcxNa0hAImeZcHm//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103448, "uuid": "290233b2-441b-405b-ac1f-e2df53dd7b54", "value": 3289336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103448, "uuid": "2135bb80-513e-4f87-bfe6-cbc1fb9c2291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103448, "uuid": "39757ed7-3396-4e85-81cb-5053f409c83d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2116.17869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd6c5d8-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126131, "uuid": "12831a93-ae2b-4d40-a3ec-951d32ec2473", "comment": "Malware payload", "value": "09b05ee9f0837fc2db9d2d54ab8ba841", "object_relation": "md5", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126131, "uuid": "938be315-886f-4b0e-9872-5914e10e1740", "comment": "Malware payload", "value": "40e257f1b270be710f7bb39dc92acea5bb1b378b2bb008f4de82a810607a99b4", "object_relation": "sha256", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126131, "uuid": "b71ccb64-dd33-46ba-877e-de6dcc955649", "comment": "Malware payload", "value": "5e7cf2c6bfb2e2eabd62d89cae3e86ca685f11c8", "object_relation": "sha1", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126131, "uuid": "ea1d5429-5c6b-4afa-9e5c-df885e5f29f4", "comment": "Malware payload", "value": "2ae56617c5c197a93afd9a7536eb2d381e91cd07fe902ef62f027ae45e69acdcb1b41f528f6561ce7dfeed03c786bea9", "object_relation": "sha3-384", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126131, "uuid": "97a96cdf-e0c4-4085-8cb4-e7748791ba05", "value": "T11EB523EBE6095053D4EA73F6D8BB5B61C50C73C3B80BA40DF8988591DEEA6E04F5A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126131, "uuid": "3c434ab6-01c4-429b-81bd-381c1f2a26ae", "value": "49152:Tfgiwjv1LC9xAVFltStNHRhq+9xsvAVFHHngEgboF3BaC9rcfU0ufAk:TfgtCjAMbq+9xwAVRHgEBjDiWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126131, "uuid": "94309cbf-194e-4c7c-b496-c88cebbaa5b3", "value": 2418137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126131, "uuid": "05e3e3db-0807-413e-9625-528675f522e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126131, "uuid": "e3b7ca63-92c7-4509-b544-a0f0b6f21dee", "value": "library.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fed4dc-44ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693136488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136488, "uuid": "b2c9f9c2-a249-4c01-a228-f49973489481", "comment": "Malware payload (Amadey)", "value": "f4172642bbda1ef4acf64b6433ef9ab8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136488, "uuid": "84e4e9bd-1e02-4a1a-a680-99df2b6feb08", "comment": "Malware payload (Amadey)", "value": "4225786a80fe1db35f120744d09557fb7118a74f4b485d2b637f5dcbb66d5d58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136488, "uuid": "e8e6966d-1612-49ca-8d22-2b098f79b373", "comment": "Malware payload (Amadey)", "value": "81113f8a2ea3cea61c9c74ebb99c814e961af257", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136488, "uuid": "7e8bc690-9922-408b-8490-7c6e9d095ec9", "comment": "Malware payload (Amadey)", "value": "a89e0385a4afacea855b7c44d3027070a562831f5d4dc4101ff22169dd4d892f4162f2ab136d944514e0fe92230cd202", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136488, "uuid": "e9762375-00e3-43e4-b11f-cd0c50520b9f", "value": "T1F9E41253EBE4A0BAD8B11BB048F30B532A367D61DE30C33B5784989A5C73595687632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136488, "uuid": "bbb0858b-92c9-455b-80fd-184ae09ea930", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136488, "uuid": "8599f72c-d947-48d1-8679-0237d42acee1", "value": "12288:uMrVy90FDEEg+8KttHprLbwxvaHjFx6b/nB1nQGEDIMX3iw2mCsj:DyIDfg+JPprLUZmjFx6dYZH/9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693136488, "uuid": "81e3bd4d-0312-4a40-9a91-f66e7d260fef", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693136488, "uuid": "69bd9aac-233c-47ed-bfcd-6e921f0d0868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136488, "uuid": "d567aefb-95f9-4ec7-8e06-818b36ef4679", "value": "4225786a80fe1db35f120744d09557fb7118a74f4b485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca7ab19-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149728, "uuid": "673def9e-6387-40ff-b415-60e742152f49", "comment": "Malware payload (Mirai)", "value": "6697ceecf620c198c425b3af68c31ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149728, "uuid": "e3d27a68-5adf-4e30-aa49-0067048f93a3", "comment": "Malware payload (Mirai)", "value": "42cd44a636bd0c6f45f1c874996fdacb9c1339e672a95964bb9f4c022eff81ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149728, "uuid": "eed221a3-e89d-4361-899e-8fd5ab74d230", "comment": "Malware payload (Mirai)", "value": "2b416861b8f405d5a11308f01004e562b63f0b48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149728, "uuid": "e4a7fb3d-d156-4510-99e5-ca517bb2c441", "comment": "Malware payload (Mirai)", "value": "83c98dff3a0498602dc5498b45331ca0e0f71a3613a80f1eb03cbe2b164ff0fe11c92b0a60770b4a2e78353236bacf65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149728, "uuid": "9c4387c9-c5f6-4b25-9533-0215afdc85ab", "value": "T1C9E2F115291A847EEB308471D0F6858776692BBCA6FFB0A64463024DDCC394293F2ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149728, "uuid": "87f8d185-9d65-488c-a9d7-db7ab8c4c6ab", "value": "768:rEKkUgXAnURCr6HmDFStmYt8v69q3UELdH:nkEn7uHEemDvvLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149728, "uuid": "21ec8f94-8e3b-4bae-a4c1-8c3a1035547d", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149728, "uuid": "82ebcadf-0c6f-4b2e-8c38-82c3e00c05e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149728, "uuid": "dc79ba97-b25c-4285-befb-4d9c8cfd01a9", "value": "6697ceecf620c198c425b3af68c31ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d9595f-44c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693133179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133179, "uuid": "48a6cdaf-3d7f-4d91-a113-cca9f47938c0", "comment": "Malware payload (Amadey)", "value": "a9cec9c43dd73e5a141d6f85b9f0c62e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133179, "uuid": "410b708a-bef0-4c8f-a5f2-c4575e294493", "comment": "Malware payload (Amadey)", "value": "43efd803486dbda6c5a92eded9ed07a7106b31ae4c24b0c5b93e619d52c6f883", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133179, "uuid": "fdd5a04b-49bb-4f46-bc50-e3b3dfa1d382", "comment": "Malware payload (Amadey)", "value": "78b0c280ef4acc45febe73478c8bb0536474a3c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133179, "uuid": "49c36a65-e33d-4535-96bf-de7e876194f3", "comment": "Malware payload (Amadey)", "value": "79952d86e30a12f4b0d0bdb5e4c5e7ec8b059d89bf21098025e9c3fe9339fc01c0c38e75a0ab77f3be31a6870ace39c8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133179, "uuid": "3dc0dec7-ae58-4387-81d9-9878c7f6553d", "value": "T15B23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133179, "uuid": "a40a9766-d3dc-4689-b31c-b1f4790c1735", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133179, "uuid": "18cb0108-8491-45ea-8d17-e96bcf727333", "value": 49046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133179, "uuid": "d784b23a-f468-44d5-8abb-db26b763df62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133179, "uuid": "1d7bbdda-a556-4a1f-9d1c-7183e8b569d8", "value": "a9cec9c43dd73e5a141d6f85b9f0c62e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dae2cb4-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149703, "uuid": "6f90b381-2406-445a-aec6-6989ad224126", "comment": "Malware payload (Mirai)", "value": "0423d91e296ae64b01ad106ed43b5919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149703, "uuid": "d096f323-0d3b-42de-8126-f1501bd69bf0", "comment": "Malware payload (Mirai)", "value": "4405a3ea8a662d8de0019212e83314e36c28cfdfbc43c2b8661e358b80492524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149703, "uuid": "fc459763-f56d-45f8-9c13-d9bee03fa698", "comment": "Malware payload (Mirai)", "value": "4ac593e3d8229bc617c7cb31dc285ce5d4cd15ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149703, "uuid": "ab308504-5d89-4692-a7ed-5e50f16a4d8b", "comment": "Malware payload (Mirai)", "value": "ae12bcac6d99d309f0acc946ce26f4d12165d934c01ab52faace1c98e40a88dc218da2648f62230915089d5b4a652c05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149703, "uuid": "85c218d6-4bdd-4f3a-8083-ef0f777173f1", "value": "T1C6533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149703, "uuid": "998185cb-cd0b-4458-833b-6f4f81cb32e5", "value": "768:me4gpsM204GEkRbjveXQonQiuQtt7v3gFHy1eu48B8vB6J7EzNfXQuJpozCE7Pq:mo3EkRbDfDiDHIFy1X48B2SEzNfAuJcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149703, "uuid": "2b21d640-890f-4a90-82c1-3aa50bc9d97b", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149703, "uuid": "0e60088e-a62e-47bf-a736-380036ee4a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149703, "uuid": "4eb94c68-973e-49ad-8ba2-0dd9a638dcad", "value": "0423d91e296ae64b01ad106ed43b5919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7a70c2-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121386, "uuid": "e6e1948e-ff70-471f-b2b5-a1e5c7dd7a78", "comment": "Malware payload (Mirai)", "value": "40f435dd1258ea9f2d3780c9e13dcc9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121386, "uuid": "4ea1b0f5-6ddf-40de-a217-001fe540041d", "comment": "Malware payload (Mirai)", "value": "441f1040cb6b57b704aaae70366c34ad8d35b351d62c4a250b0dc09abd90d93f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121386, "uuid": "161be66b-e548-4cce-90a0-f18c057b8b33", "comment": "Malware payload (Mirai)", "value": "d6425f16042d1efe0b2a67bac794ba8078967e5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121386, "uuid": "23782f28-7336-42f1-8164-e41afdb56529", "comment": "Malware payload (Mirai)", "value": "8252eb8e36a977d4a86d02d0bcc02bc7f868584e8ebdaedca01aeb50c5d1f4f95d9b2909e1245f293099129c3dab4016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121386, "uuid": "b3ef6ccc-4ded-4078-81c9-1cf9c82fb485", "value": "T1E73302A26B6E35E252B04737FC33AC56529C17F99D67309A2CF05A1977C48024FF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121386, "uuid": "4624f51e-7d81-4391-b82e-ad3ee62bb857", "value": "1536:S9O/ZMAXIxNUk0R3LcPqF1aBexo4opKZb6:S9O/ZNKyRLGqFUF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121386, "uuid": "67db4ec4-3923-4b76-84f0-0617c7497c1c", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121386, "uuid": "78d77b38-71a1-49e9-8e3f-67da9e58eb0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121386, "uuid": "2ca00a51-82bd-443e-a1f7-d3848067e92e", "value": "40f435dd1258ea9f2d3780c9e13dcc9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19366a8-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148206, "uuid": "0d83eab5-8f14-4ad4-bb46-e30cb0629201", "comment": "Malware payload (Amadey)", "value": "ab4cce2b7dc4584aefff40f8b1df5572", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148206, "uuid": "d53f8c0a-2439-4e3d-a396-3dd986007f8a", "comment": "Malware payload (Amadey)", "value": "45422c62ce77e250d432d0a7804063682913948e39871b21fe55178fcf849b56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148206, "uuid": "27a1900d-80b8-47de-80ad-29bf57b662fe", "comment": "Malware payload (Amadey)", "value": "3392c2c4073dbf48c89d03a5cf6f65e00722a40b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148206, "uuid": "7b993ce5-3e2d-4db7-ae7f-9017fe36bf2c", "comment": "Malware payload (Amadey)", "value": "fc12b87d740fab2b6d110056ddedf960bb2297448674aa829141cfad71948ed0b7f4cc99afa66e9b56cc3af8d877f217", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148206, "uuid": "cc8a9b26-760c-4c82-9412-cc5b55070178", "value": "T1A96523079AD48071E8B64FF16CFB03D71A377C85992817692317AD1E48336A1AD3B73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148206, "uuid": "645a6b0b-9322-406f-baa5-c02aff02234a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148206, "uuid": "eb41a4a7-c954-4c84-b7fd-b6b710444cce", "value": "24576:JyAdEpDbl6bwE+K+fGmf2KJkEdmIJ4/zbLmd7Iv7WXlgyKingNc0U6twuI+77DNY:8AUDbkbwU9i2KJkEEbOIzclgyKingNUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148206, "uuid": "4b7427ea-7349-492b-84d6-5ee0fe6fdaa5", "value": 1504256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148206, "uuid": "e44626ab-c6d8-4325-bf88-173a257957ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148206, "uuid": "35277e2f-04cb-4ada-9e67-b38ab5964610", "value": "45422c62ce77e250d432d0a7804063682913948e39871.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4c5e3f-44c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693132576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132576, "uuid": "5c8b321c-3623-4576-a183-44876617a40e", "comment": "Malware payload (RedLineStealer)", "value": "ac6829d288e77bfd032d5077087259eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132576, "uuid": "eb201274-c115-4b6a-9156-26697991d341", "comment": "Malware payload (RedLineStealer)", "value": "467f01a57d4829bfcb8a4fb53540b0ea61be431548e57603becd9836be5ba23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132576, "uuid": "9686c8ea-08a3-4c13-a81b-2144f3843796", "comment": "Malware payload (RedLineStealer)", "value": "c05b79a83e8e74e393de4cf238b290c99cd8a00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132576, "uuid": "9deb2dd6-987a-4ede-955d-800bc3f3b025", "comment": "Malware payload (RedLineStealer)", "value": "3484b5cbff020190730cc2d49c564aa4b2ffe054e95c91add19a7c5dd644aef7640d19ecea74055bafad677a314e21e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132576, "uuid": "5106222d-a62a-4729-8b29-afc33cda3743", "value": "T16EE41243ABE88477D8B4177194F602A30F39BC51DE34675F2301A82A1CB26D46A76B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132576, "uuid": "6589959b-2f42-4451-ab5b-86ef03b84939", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132576, "uuid": "e88b9bc8-0d66-4fb3-8779-5cd4ad1fdc4f", "value": "12288:MMrHy90Z8/Wb6u5NpT60VynBN1U0vYiLJKb+jhXlsjNSFjSjVNP:Dy88/Ju/yn3G3OhVsrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132576, "uuid": "faf384b2-8c31-4fab-b794-5ff4ce224c73", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132576, "uuid": "c06a4dab-aa3c-4d3a-8b8a-9aa12c4937e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132576, "uuid": "8a106a39-af95-4bfe-bd95-288edee74c27", "value": "ac6829d288e77bfd032d5077087259eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d10f379-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121382, "uuid": "ef24e264-b31f-4733-9f44-86dc7d60274c", "comment": "Malware payload (Mirai)", "value": "74c784818c30f4152395a2e7e69db34c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121382, "uuid": "aad3cd70-75d3-4159-832b-2e1f120f445c", "comment": "Malware payload (Mirai)", "value": "473ef36072e249c2176dc845e404a9c33a621fcb8dca9a2d76d94bc939723e59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121382, "uuid": "f6f8ea04-1a68-45be-a947-9aca43c115a0", "comment": "Malware payload (Mirai)", "value": "8ae836874415304427095f13642de1ea118a6dd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121382, "uuid": "bfb8ce6b-a6fd-4a75-b439-456ec21942e8", "comment": "Malware payload (Mirai)", "value": "69a24b3055111c53fd7b853f90381f1220f34b448b95080b85813c52bfe821624132c2d72e359036597bd83f2610744a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121382, "uuid": "fc7139c5-1416-4419-bc43-8bd6a11a3109", "value": "T1C0C2E1AF7A966A67FA58633DE034821B0395F51C57AE2B4B37404432E95E82D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121382, "uuid": "51873a5c-b8cb-47ab-81b2-7ef9454cd60f", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHcuT9NL:RMwxdyoEUnDz+Y8tqHWXm8Y20Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121382, "uuid": "a8ed6fac-b575-426a-a1a2-20b24c349e87", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121382, "uuid": "73adfd51-9683-40cd-ac5e-a241ef7d3057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121382, "uuid": "9109429d-db1b-4726-9591-39ce97059506", "value": "74c784818c30f4152395a2e7e69db34c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcf8435-44c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131372, "uuid": "6716d074-e651-4477-8579-de70c92b9cbe", "comment": "Malware payload (RedLineStealer)", "value": "b611d717fe250981e5313e917051759c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131372, "uuid": "5829147f-768a-4b83-984a-da00ae6028d4", "comment": "Malware payload (RedLineStealer)", "value": "480e3c699ae3ab49153fb15399b4611acb6ee86241acaba2fdf9d998d81951a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131372, "uuid": "3fe36917-4f46-491c-aa2e-8ba531ec610d", "comment": "Malware payload (RedLineStealer)", "value": "dbd3a5da7ddbfa8dd686edaf3089b5eadd41b638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131372, "uuid": "fe0531b9-800d-49bd-80f5-760023912c45", "comment": "Malware payload (RedLineStealer)", "value": "a497c2232e965483dbdbfca1138e48ab02f4ad2cd6b016d5be1778fdfd8003d89434d77fb9e52e9c53c57f70cae1a401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131372, "uuid": "091cc70a-57c5-4501-9c44-2ab5fb0ab284", "value": "T1F8652393F6E94873ECA673B06CF7068324357CD19DBC436B6A959A450D32490B9333AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131372, "uuid": "2918e57d-889d-45a6-823c-5d7d9fcf33de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131372, "uuid": "dec45c25-139d-4e8d-91db-e6038335a735", "value": "24576:ByqdIYgZkvt39SvKMozFTXM7meZx5GaZftUgLS3iJQVHscc:0BZuYKMozFjMieP5jKgvJCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131372, "uuid": "cf434afb-794e-4b1b-af61-893c771a5553", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131372, "uuid": "7e7b2b14-a182-4e67-8a76-ef5886bf31f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131372, "uuid": "130724a8-39d3-4be5-bf2f-5adddf6b67ec", "value": "480e3c699ae3ab49153fb15399b4611acb6ee86241aca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9079a7-44df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693143715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143715, "uuid": "3cc48152-50ec-46e0-9dc7-c470383a2cb9", "comment": "Malware payload", "value": "3eb7278ffb8ab7d3f190a56756239e64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143715, "uuid": "4d109387-6908-4302-8944-db0ee6ef1bca", "comment": "Malware payload", "value": "4881dd4ae775b3a32eff68d859c28f215567bb409dde2fdd9f92d65f3f679050", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143715, "uuid": "f20d3a30-46ba-4248-8456-a1b8320bdd9c", "comment": "Malware payload", "value": "610d2cd97b9a63d39bf0ad26412b242917c3a748", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143715, "uuid": "24bc0423-58e4-4cf0-ad0f-9b7d0d527d53", "comment": "Malware payload", "value": "8af3e1ed7f28fe18f858aa6d743f1f723841d96cd9f93162c65424ac62146db3e694848ed0121c9dd40e33719e6ed90d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143715, "uuid": "9e1ea036-fb6e-49b0-9b2e-aa64d218cb1d", "value": "T1041633177F820C3AF4EDD735B281032BA433FDB086D096AF265D897A68721C692F456D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143715, "uuid": "c7894f93-acf2-44d6-92ba-ed363b054052", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143715, "uuid": "465ad3a0-711c-4033-9410-758e4880e1ce", "value": "98304:UYnLcGFW5laRMD5uNPZvTR33Xv/sroQY3cJe:tnLcGs5la2DaVZv/sMF3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693143715, "uuid": "964249c4-800f-4e3d-bb31-6ee7db5d37fa", "value": 4318120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693143715, "uuid": "0321b355-85d3-411d-a2b6-2f380bddb826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143715, "uuid": "d03713b2-21d3-4d81-a754-b917e6c0b138", "value": "3eb7278ffb8ab7d3f190a56756239e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb307d15-44bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693128358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128358, "uuid": "495e20f2-5fe8-43b0-b773-19a1e2fc230b", "comment": "Malware payload (RedLineStealer)", "value": "8f82a8a36079386d85345cead488989e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128358, "uuid": "bc632220-e5e3-4186-8ed1-809b40c22345", "comment": "Malware payload (RedLineStealer)", "value": "48efd79e249eba5fb8682a294b5f6c8440862bbd7c84d4ed0d2e7e7b8095f7c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128358, "uuid": "b9b5a067-9799-4488-bd6f-dc8c609ea8f7", "comment": "Malware payload (RedLineStealer)", "value": "993110a9ca388c8e87f5a21866f204e1d5b5b962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128358, "uuid": "3b43a7ce-3dd3-4151-af55-a0841cd9cb50", "comment": "Malware payload (RedLineStealer)", "value": "71ff92ac9dd1a2f0c7e9fef6fabe76703af0ac842fc797afe8676d5d8f9932471e12d5aee8575b2c5f2176b0250de0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128358, "uuid": "b6be9ad3-9266-4b57-b18c-1c15656e01c7", "value": "T19AE41302EAD95073F9F8277458F70AC30A367C924EB4976B3751AC4B08B2695E43637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128358, "uuid": "554ad272-a85b-49bd-a32f-2422afe31192", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128358, "uuid": "a4a5a1e7-f8d2-4d29-9a66-3d36d4ca7e88", "value": "12288:BMrzy90MTUrnaxOnpuCcRdXYixf0jn06bTZStQkCvMQPiFZOfplf6stPfJ3T:Sy3maQpcPXY62nxStQkCMQqTOf/bPfJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693128358, "uuid": "c68b74a2-72cb-41f6-826c-4e0bf5488aba", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693128358, "uuid": "a1f70e9e-ddb8-41e7-986c-202d08c7356e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128358, "uuid": "a9cfc059-d0f9-44c5-b44a-eec40a559702", "value": "48efd79e249eba5fb8682a294b5f6c8440862bbd7c84d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182dec47-4498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693113052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113052, "uuid": "20bc360a-0b2e-4d82-9949-4eb69a43a4fa", "comment": "Malware payload (Amadey)", "value": "5a22f920615069545f5cacb89f24dddd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113052, "uuid": "8a019447-86d4-4fdb-a998-945af9fdd16f", "comment": "Malware payload (Amadey)", "value": "49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113052, "uuid": "da924acb-e25f-44a0-afa6-d51003544d72", "comment": "Malware payload (Amadey)", "value": "bc46fd49790be457c1f5370a8cd39c9898387863", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113052, "uuid": "f014b605-d585-4a39-b5e3-99ef513bb21a", "comment": "Malware payload (Amadey)", "value": "d3aede19505d28e05e9ed4ff23c7925e03f72002e2be21f3a5ee7ec90b3fbc6d4ff31d059213890f76eeda99ddb6fd54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113052, "uuid": "4aa07c11-2486-43c9-b744-c8663f8d6af6", "value": "T119653343B7D8C4ABEDF577B0C8F617830536BD258878E363A2815AB54931354AC3A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113052, "uuid": "f69c9a60-7ee3-44aa-87af-e858b956f93d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113052, "uuid": "b35e604a-584a-48dd-ba32-abe7e67a6ada", "value": "24576:fytgZwwaIh1UKY8rL414Pmgm2lMcmzNMYWQgcwQVwhB/4aB8arTMVu69y8u5PF5:qeZwwR/UKY8rwW7NMzOYWJcdwhuiDrCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693113052, "uuid": "88a14884-cc54-4da1-a867-c2cc2821ca6a", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693113052, "uuid": "81001349-027c-43d5-8d8e-ba9be98a8f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113052, "uuid": "929799b4-29c2-4dff-ac1c-cdd463f439e6", "value": "5a22f920615069545f5cacb89f24dddd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10a0272-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Socelars)", "timestamp": 1693126220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126220, "uuid": "c88a4d40-140a-47ab-9bd2-9d66725dd887", "comment": "Malware payload (Socelars)", "value": "7b64a5e509aa84c4ad87989675f79f07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126220, "uuid": "6b9c3cee-bd7b-4dad-a8a9-e7737ea2c09c", "comment": "Malware payload (Socelars)", "value": "4a384670a860d25077da61d68413298186d8d82cb3aca20b695066f18e425759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126220, "uuid": "d9cf5302-f0c7-4b41-8ef5-b94d55a37779", "comment": "Malware payload (Socelars)", "value": "0ec3f2cc002c38d8b4bc41f9887075e054ca99ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126220, "uuid": "29371d17-2489-431e-9865-d2e77f7fff36", "comment": "Malware payload (Socelars)", "value": "0391e6346488e0257a7a107ed2749a4b6e3566ac907c390c5e32223eb1236062ff6f7ce91de31145a0e8dd4367c532d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126220, "uuid": "d9e4d15a-3e5d-44d8-bcb1-ecee6c883f44", "value": "T1C965AE11F642A036ECE3007286FF5AFFCD28B621031854D7E3C459AA5E715F27A36A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126220, "uuid": "68644111-cbdb-4ba8-a77d-8c663964281a", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126220, "uuid": "45eb0feb-23df-47ff-a685-ce75837294a7", "value": "24576:XJSLpwfVWRh0SGQ48Lm2194mKa4qrNkW9NTPjB5NqBm7gm:Xup62ESMyjTPjBDqQ7gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126220, "uuid": "ad9b5762-5d37-4688-b7dd-2e9e222f216e", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126220, "uuid": "83046382-833b-4441-a8cb-b06bd6470e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126220, "uuid": "3b7b9df3-3596-4442-99ac-176856808a65", "value": "mp3studios_92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee332fa4-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148200, "uuid": "64852589-7735-4831-9ca2-16e6edf896a1", "comment": "Malware payload (Amadey)", "value": "bb548bc48865580886a6db6943e572b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148200, "uuid": "885238a6-1f21-425c-8bea-93e7f4d27ebb", "comment": "Malware payload (Amadey)", "value": "4ca2ad38892e9858975063807dded8341baf461c21dd71039d667aaac6ac25ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148200, "uuid": "5629b26a-a562-453a-a039-defb57fb545f", "comment": "Malware payload (Amadey)", "value": "df7e1f80c7951f91ff0eb4fda164c75f93272894", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148200, "uuid": "21f421c1-f452-4f83-8c79-4df60698e138", "comment": "Malware payload (Amadey)", "value": "0a8ae0585d70aa8e51d288a6c1fe9fb140d16e8343636ba9b45afe8d1fbd22814fd969e2af64e558d762fbe9479cf9a1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148200, "uuid": "d99ffec8-1e8c-4f1f-ad2d-c3bbe026c565", "value": "T169652357DBD98473CCFA2730A9E213CB2210BD460C7D95BE2249D80A5D77ACA84717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148200, "uuid": "25dcfd60-bbdf-4c59-9fa4-a0f2e556cbf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148200, "uuid": "6ff63c07-03c5-4b1b-b337-1514a2a30e8e", "value": "24576:yyK/giB+jL9Wm0SSnFTsrB04oG5WA2iyJb9hU4viQF+3NIooU6pd/2g0SFa:Z/igjAm0H0B04otATyJb976QeTon7/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148200, "uuid": "908f9eac-27fa-424b-a1a7-6751cc9820f5", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148200, "uuid": "3e8512af-8a9f-4190-a01f-559b5faca175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148200, "uuid": "dd38b276-1030-4714-9d83-1e96507f6f3c", "value": "bb548bc48865580886a6db6943e572b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382fe39-4516-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693167402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693167402, "uuid": "4f6321c0-5285-48d7-b9fe-02b15bcd9b22", "comment": "Malware payload (Amadey)", "value": "d57ab7dc450e2a96abd6198c68d12c76", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693167402, "uuid": "c94b7de3-2863-4165-9d1b-86934b9a95e7", "comment": "Malware payload (Amadey)", "value": "4ca8867c73413aa8cf68d0f5598df56bcbdac57ae45a187a70d7db57013ce00d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693167402, "uuid": "a39e6bd8-6384-4472-bf30-917c31aedfa4", "comment": "Malware payload (Amadey)", "value": "85e4875d423dfd7dc197fe84178fa13bd445e95f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693167402, "uuid": "f7cab3ac-2805-477f-8ce4-e74ef81fa32a", "comment": "Malware payload (Amadey)", "value": "e10e9d7a810c39d5ebcd3d36414adee74517a37d9068620358b59a9b6ecc1815b10267f099e50b29c030c95469268dc1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693167402, "uuid": "e3f3052f-2068-46e2-80e6-7172ee31eb40", "value": "T12E652302ABE54563C9FA6B700CFB4BC31F39BCA45876835B37D5981A0C72780A979736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693167402, "uuid": "e14f88b1-9663-4df0-9b08-2b492a9a7311", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693167402, "uuid": "4a7c3f10-d1cf-403d-a79b-10af2e96c90e", "value": "24576:syOTfdSqViVG4Yp71PK2vXgji16gr/Ol8wLSfYAw5LdBIKEOcwCifu0:bEfi3Yp5PK2vXXpPY99TIXwCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693167402, "uuid": "cd402915-23af-4ba3-9fdb-1c56ea89fa66", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693167402, "uuid": "3c488619-5066-49cf-8077-bc53e73f2f8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693167402, "uuid": "315a1ffd-46a2-463a-9469-ec9debd01dbf", "value": "d57ab7dc450e2a96abd6198c68d12c76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ab114d-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693178036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178036, "uuid": "d4ae6996-3f14-48f7-95a4-9e2ff71a5129", "comment": "Malware payload", "value": "037b7d172a7a26f1c3f4606533b7fbec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178036, "uuid": "4e6b54a3-e543-42b2-8865-fe390b9ef68b", "comment": "Malware payload", "value": "4cb46b66aca57581b2c6ab8de35829c0da851864b9c5dbb292bfcad97928deb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178036, "uuid": "7951d44d-5eb8-4e7e-9426-e3c99f05c749", "comment": "Malware payload", "value": "250a81ac3244cadf901e429749e41f257ad0f88a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178036, "uuid": "69d84b2d-b3d9-4ee2-a18e-15aff271b34f", "comment": "Malware payload", "value": "c66c409e7e3118de5bffa796fba7cca88f76ca4202e780698a1022a44e3de723e2cdadbe43a885e621a39fbc0beb1372", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178036, "uuid": "4b490a55-768f-494b-8cee-ecdf316c721c", "value": "T13E538BA6CD745E58D14946F070289F759723A900928F2FFB9AA6CB69E403F9CF9013F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178036, "uuid": "8ca36acf-666b-4154-acf6-c92030f9ce09", "value": "1536:EaxUDd0YCa+HuN+DEuKMu7jC7dH1TOC3YI05ZN:ELCYC72+ABM7F1TO9z7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178036, "uuid": "86fda675-c1ef-4498-a177-90688add88c8", "value": 62984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178036, "uuid": "9e6141d0-8722-4cde-8a1d-cef77bdb0e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178036, "uuid": "f7813f71-b0dc-49cf-ae67-12a69339bf89", "value": "037b7d172a7a26f1c3f4606533b7fbec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4eb5b35-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693148212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148212, "uuid": "c8ba0ca2-c55e-411f-921c-11005f338d15", "comment": "Malware payload (RedLineStealer)", "value": "f046ff6dd99d9cfed0ca9917de42530e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148212, "uuid": "f5f16031-0f45-419c-a058-19bd0f4453fe", "comment": "Malware payload (RedLineStealer)", "value": "4cf9878e6f4e556a288b165dee9f11adcc596e0c2514be7881b592f533daefeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148212, "uuid": "100b20e1-3f46-4375-80c5-faba78fc270d", "comment": "Malware payload (RedLineStealer)", "value": "fdb50dd6df7eac2ad4da9312300bb77e1c2d3467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148212, "uuid": "ad84de36-14df-4eff-82d4-5bccc6a6710c", "comment": "Malware payload (RedLineStealer)", "value": "8123602facf7b687fc89206f59489f20553da1821aeebc0554dc6c35bb589afb5847a5ba440fd4b77526719fcdaf1f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148212, "uuid": "9b05d9cd-b1a3-4637-aff2-a6b86a5d88fb", "value": "T1E3652322BFECC065EDB10BB158FA01431B307C959E79431A4652AE0E9DE2E55F63873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148212, "uuid": "94cfd29f-b000-4bd5-814d-8d5bc284887f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148212, "uuid": "3e59fdad-b751-4c1f-b1aa-f8fcc47be7c2", "value": "24576:EyEZ14wsyLych1Jfq4xE5KuiaQYCMSF4F2gbXhPnKikNFnLZFXqzYIuqUm:Te/syBh1VrgKuia7CgzhPnKiWF/qzkqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148212, "uuid": "57cb2510-39a1-49c9-b38c-224ca099fb63", "value": 1500672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148212, "uuid": "7b7a01c9-eafa-49d7-8db1-f3f20effd34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148212, "uuid": "56f4f0c0-caab-4b80-b2f5-398b9e0945c5", "value": "4cf9878e6f4e556a288b165dee9f11adcc596e0c2514b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256b9e18-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693131972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131972, "uuid": "dfdd77a6-5c20-4503-b324-3947538c5447", "comment": "Malware payload (Amadey)", "value": "f06b19aad7fb06ab3bbe86673025a83d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131972, "uuid": "c7b3edc9-24a5-4118-8d8e-2335bdbfdd1f", "comment": "Malware payload (Amadey)", "value": "4d0d15cd924e85929bd13e40e8b443635078b55b9e72fd8e1ff42ec5d353b1d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131972, "uuid": "ff18ebb1-6e0f-4b6f-a8f9-86d627797156", "comment": "Malware payload (Amadey)", "value": "1bd2b3a05626b2202afdda9b07fed092ec0a6074", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131972, "uuid": "4af0e921-662f-4de8-9816-f22e958726bf", "comment": "Malware payload (Amadey)", "value": "b8a9ef5eb10f59b29232eae6ecca0601d524faafb93cdafae205b33af46f83f130097ad3d8e53c853e533e11a51e9a1f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131972, "uuid": "4aed4fb5-2def-47bf-a017-c232e65d625e", "value": "T180E41203EBE8C072E875977158FB03831E3B7CA11D6597AF2348995A4C72984F93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131972, "uuid": "2d038644-1aba-4e1d-8ac7-17b1d94a0c61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131972, "uuid": "eb5b4aa6-06ca-433a-80b0-a07c90274fce", "value": "12288:SMrNy90q5TxkhLAIiKtqgudkntA0MspGwWNQ16wrWI6AgOvIFY5yqTo:HyQhLAIiwm8F3pz6wrWIDPyqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131972, "uuid": "0626cb80-d31c-4ba4-ad64-217018fc99e1", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131972, "uuid": "d36d5bca-82d4-4917-a726-d2d49f95a826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131972, "uuid": "a374d512-fba6-4fa8-af36-5a3cacdb889d", "value": "4d0d15cd924e85929bd13e40e8b443635078b55b9e72f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7202e026-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149710, "uuid": "06d47de9-c37c-4ce3-b90c-cfb27a6a259a", "comment": "Malware payload (Mirai)", "value": "27019887529fc4cb924792af7e4d2709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149710, "uuid": "efe17a12-97ff-4416-aa97-9fbd5e744b8a", "comment": "Malware payload (Mirai)", "value": "4da930c1251f815746c061204379b12fa6468bb1dd6011e57ebef4730360163e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149710, "uuid": "22e80666-366d-4447-a8aa-3a99ffffbcc5", "comment": "Malware payload (Mirai)", "value": "2eb13a59e04daca171c2ef4a8c9e6a1c1417e8a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149710, "uuid": "bf59c735-62b6-40e7-96a7-a5bb12302975", "comment": "Malware payload (Mirai)", "value": "43953e6e30135e8de9d179f4f7a8c468d6e5b8963fc8b708dbd2aa23cc4d836ce85f3ba029921d2011eed8cf5426e748", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149710, "uuid": "7ef45861-2789-4705-b87e-fae839242a58", "value": "T153D2D16DE5B442C5FD4D5C3EC08C3FA10E1AE681231BDB9667218C8D5B36C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149710, "uuid": "8626fa6d-33f7-46c0-8fed-d94c2c88461d", "value": "384:n8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjTebRWGVCz0Nvx:8MYHb62x4ahQ3CfdwLjDWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149710, "uuid": "8c5e0ee5-580a-4ab7-9b5d-2b91354157d5", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149710, "uuid": "743d310e-fb8c-4b6a-abe7-f70c90a5f1c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149710, "uuid": "1b847226-276b-4b5b-9302-0addd0018231", "value": "27019887529fc4cb924792af7e4d2709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51d0d23-44c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693130468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130468, "uuid": "2b6854fc-7197-46a5-ba87-7751fea9d9e3", "comment": "Malware payload (Amadey)", "value": "4f87feb7c7ea76f41ade4aa572991c2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130468, "uuid": "764414ae-09ef-447b-87a6-48adc625d9f2", "comment": "Malware payload (Amadey)", "value": "4ee670dfbaf32e22da9fb623a6317e398eb55b369b441ec8cb1bd54fec0a472e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130468, "uuid": "e2238f11-a4e3-401d-966a-5da3819b4aa1", "comment": "Malware payload (Amadey)", "value": "7c3c32c65ee30d793808d3bd67a055ab08b5ec0b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130468, "uuid": "904bb217-ac21-47b2-abd2-c0551007a690", "comment": "Malware payload (Amadey)", "value": "e23d1245413525d1a1e618d05cf2157378becd02a3e992bf5f9f9a33fbc45442c14eafebaeb1dfd3a226d5ec8346b43b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130468, "uuid": "daddce2f-9c1f-43cc-8600-f6d089590ee4", "value": "T192E41242EEC88132DCB52BB128FA13431735BCA15D38876B2B46FD9A4873A847971777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130468, "uuid": "081aeab8-e636-4b40-9200-0585b27ef930", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130468, "uuid": "103e0435-b9a2-48b7-9a6d-a50aba92a6b8", "value": "12288:vMrpy90/gf3vRlB9/+RowWi5OnEMOm0YKG05zG0GtcWANEneckb:+ym8R4LWi4ZE7v5wkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130468, "uuid": "1eb74bf3-7da8-4c7a-bb12-9ae1a1382801", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130468, "uuid": "c9539e2a-25a7-4988-8fbe-0826ef413a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130468, "uuid": "18f7d9dc-2cc1-4caa-9fd7-c2cc7a93b033", "value": "4ee670dfbaf32e22da9fb623a6317e398eb55b369b441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dbbc8b-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121390, "uuid": "40a5ecf9-3aad-4f5f-a17f-3e0a46225dbb", "comment": "Malware payload (Mirai)", "value": "b50379aca4e40bc62811d30ac47ad010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121390, "uuid": "69a20976-8483-4118-b407-b237ac6fda65", "comment": "Malware payload (Mirai)", "value": "4ef32caa8343fda75e851db86c37c4fd5217764e773ddf9f653ea525bfb1b01e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121390, "uuid": "76d0d9a7-2d6a-402e-be73-ba665a7145c2", "comment": "Malware payload (Mirai)", "value": "7d87c33bda9af4f91ebe9ef93cdc25f51266bc35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121390, "uuid": "02a48c68-93da-462e-a67d-d04094a65096", "comment": "Malware payload (Mirai)", "value": "96f9393fcd71666a762d949958793fac4ed85c4f57073fd38a61c834c37129553e8781b87b38d80f3bd9fb0e66da2aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121390, "uuid": "e39122d1-c2e4-465e-8a52-2ed73c863679", "value": "T1FDC2D088F141DE01DFEA29F13D50CADABBD06F5F6955CE8126A053C25B5D2B35305EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121390, "uuid": "fbe253db-57e0-4534-aa7f-c934ed2bcae8", "value": "768:wVdafO76jpmNJJKehmA7trpfIX9KeA7PAhs4uVcqgw09r:Aam+AnKehPRa9aIhs4u+qgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121390, "uuid": "fb8f2b55-c8c7-4170-bc25-982b3bf42bb7", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121390, "uuid": "c54e2373-35a5-4b8e-9ff5-bcc03091224d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121390, "uuid": "05379553-e600-4ee3-8bce-39181cea8fa7", "value": "b50379aca4e40bc62811d30ac47ad010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14feabe4-4525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693173606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173606, "uuid": "bbd8c9a7-781e-4b8d-acfe-35f02eba06af", "comment": "Malware payload (Mirai)", "value": "f53d59725e4f840fcda2678b55d6075b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173606, "uuid": "cbd1cab6-9991-4871-9f83-795a86c38508", "comment": "Malware payload (Mirai)", "value": "4f14f32e3ab478f1c4e178746c98c551d4e07dc59ec74814afb3c52dcce9b54a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173606, "uuid": "f4678799-a495-4b8c-a7e4-25f235fc3266", "comment": "Malware payload (Mirai)", "value": "b75ab8a7488477848d809cd8ed7944cf03741a4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173606, "uuid": "74decffb-c97e-4a61-b56b-e8049af08854", "comment": "Malware payload (Mirai)", "value": "fcb43365b79c60ce2579dda0de86cf6d3fbcc9cd98debadff614b656cdf9128fc90e7013edf240c626e477363d0a970c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173606, "uuid": "fb3ff27b-b264-4f2c-b4aa-088bc02b4ba5", "value": "T1B8C2F0582466FF19D4694C728AF4C9C22E728AE563B031F12EC917D7D66038AC9B434B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173606, "uuid": "e384f788-057d-4446-9b26-00826821bdb2", "value": "768:9ZqbD9poewFRgjRm6O7NxKnSXQnkeOs3UozV:9s/9KgV+jDXQkezzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693173606, "uuid": "6bf92c73-3e8c-4c81-8086-3ffed400f869", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693173606, "uuid": "2d12f8b8-4ac3-462c-b5cf-267c2f1a1e5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173606, "uuid": "1e960d0e-5d35-47a0-89b6-2cb9233daa7c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4014c44a-44d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693138889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138889, "uuid": "182adb9c-4d6f-4cf4-ae99-00980bc51aa2", "comment": "Malware payload (Amadey)", "value": "4f7e733f88004c8ef89314141d52c813", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138889, "uuid": "c42f6ee8-fb90-4630-bfd6-f08a7c9575bc", "comment": "Malware payload (Amadey)", "value": "4f22f4ac9fe02fae587d1f2553437cd14c918987c636086b3013c129706b3c66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138889, "uuid": "5c62402b-92f4-4fad-b7c1-3a532e344a89", "comment": "Malware payload (Amadey)", "value": "796a4d00639517824a4beffb4f22b562f71f63da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138889, "uuid": "d7d8a205-ff42-42a4-af84-0c61622fa588", "comment": "Malware payload (Amadey)", "value": "c05e7cc4bf7dd9071b492a90132c5199fafcfb06184276c4608722ebe1490b0a5fdb1cb77c126a130611a14c00260328", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138889, "uuid": "7fd5deaa-4ad3-4faf-bf85-4e37266ed280", "value": "T11FE41242EBF89073DEBA1B7019F213871A353CE555A4839F274A994B1DF328461B13BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138889, "uuid": "8f423fdd-ebfa-4ecc-bc95-b91a58d1e35b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138889, "uuid": "20d68cf8-666c-4944-a4c1-fadd8af769d0", "value": "12288:YMrty90+y31gZjc/58UP19bAZOYx8teU8HGdXJB6oaoPE/ASNfY:VyC31RbJteTIX73u4SNfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693138889, "uuid": "84095110-2bf0-47d1-88ee-f0a59501af1f", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693138889, "uuid": "e6191697-a1b8-4960-929f-1140e7870979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138889, "uuid": "4b774c19-181b-4160-b2ac-15e868355354", "value": "4f7e733f88004c8ef89314141d52c813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e216a0-4493-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693111245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111245, "uuid": "b2637435-ae0f-4aff-845b-f61f6f82dfb5", "comment": "Malware payload (RedLineStealer)", "value": "05800bd498720b15629fbe22573a8aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111245, "uuid": "6fe3c024-b861-4cff-9012-9b5431121259", "comment": "Malware payload (RedLineStealer)", "value": "503604c8ae70bcb6dc1a46bdd9ca51e3901b34eb4a078f344639476c6834c5bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111245, "uuid": "e220e0ab-836a-433f-9333-610a895b9b4a", "comment": "Malware payload (RedLineStealer)", "value": "e54248f37293ba0903af2c873b3d91a21e2ebbe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111245, "uuid": "3c38d8d6-3bee-42be-91d4-ad1502d1eb82", "comment": "Malware payload (RedLineStealer)", "value": "2a35e136fdab0fc262dd9c759ae99b81e131fd9c15bf9b72189b71481d54da7c53befec8a3be22dff93f82e502a6aade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111245, "uuid": "7f16270b-55f7-4453-957c-bdc1c2ab6b59", "value": "T1AF152243FAC88661C8B9677054F61B831E36BCA14D75938B335A948E0E739C0A573B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111245, "uuid": "0dac0fd3-d4ec-4c2a-8673-076c62bd37fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111245, "uuid": "cfb9e4bb-869a-4f30-8e05-a1e31e1ef8f2", "value": "24576:qyibVOnGrfuqmEQQl5Ueg5wxS3Uu54i6:xG3f5FguSrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111245, "uuid": "fa7bf966-2f87-4946-b24a-923859748449", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111245, "uuid": "2873d2e8-8328-42de-bca5-52956112c3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111245, "uuid": "2593b338-5036-4c5d-8f62-21fb9643662b", "value": "05800bd498720b15629fbe22573a8aca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cef2f64-44de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693143098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143098, "uuid": "f58aa270-8de7-4290-83fc-54fbc825fb7d", "comment": "Malware payload (Amadey)", "value": "842c37a70cb01931cc6508dea4bcdc0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143098, "uuid": "83a383f2-9a60-4813-876c-224fd8ad7ee7", "comment": "Malware payload (Amadey)", "value": "508cda537724777cb3c026b3f05867e5a9c951740b3721e51fde2eacbaa1e754", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143098, "uuid": "22dae2b1-30b4-456b-951c-2fb462e8b9ec", "comment": "Malware payload (Amadey)", "value": "02e770df5575abe4923af2a7e75500be31a5aafd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143098, "uuid": "a26fc79a-3c78-4801-90b7-6325eac39544", "comment": "Malware payload (Amadey)", "value": "6164651048bd3af81235a02c2955e48c4365a0315ca796cec52b3ba8ef9abaade26ad6338261c9500f4722f01f5f2fd5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143098, "uuid": "530c40f1-c0ae-44af-bb1f-6148f3fc75df", "value": "T1F1652352E7D9817BFDB12371ACF603932A3A7C901E79474A2666BD9A4CB2340753133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143098, "uuid": "4cd76bd2-020c-4e8d-9170-f3f58effd815", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143098, "uuid": "45c89268-c4fc-4980-bc12-e55bb808d2b4", "value": "24576:9yC35d3XBns3frKd6rigmtj3JA8CgRxseDt+4YKB2m2Ye/:Ym5d3xns3frKd6rIjbCJ+LYKBZ3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693143098, "uuid": "40b2a6d5-7ba4-404b-a2c8-31ea5d16c00f", "value": 1502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693143098, "uuid": "87b10bcf-a5d1-4527-83cf-73b6c2c25a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143098, "uuid": "07bc22ff-bd44-4e7e-b17f-a83d3e9d31c9", "value": "842c37a70cb01931cc6508dea4bcdc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2192f9-4523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693173005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173005, "uuid": "10e9758b-95c5-4d50-97f8-2f66f7e50f39", "comment": "Malware payload (Mirai)", "value": "b009dcd1228cd338949555f7a89b44bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173005, "uuid": "6ef3ff53-a0fb-4163-aff6-56a6ba71244a", "comment": "Malware payload (Mirai)", "value": "50b3f3e3d7b8c64b6fcea2d9abcb2bf79ce73d633d77d967369a38dd787b0e18", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173005, "uuid": "881530e6-d750-4b7e-a61f-2b82bca3b7e8", "comment": "Malware payload (Mirai)", "value": "ffc0bbb12c86575e1409e8e71060cd31fe00baa7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173005, "uuid": "2c12eb07-11fa-4cbb-bb83-9e6d437fd8bc", "comment": "Malware payload (Mirai)", "value": "2590001372506c22c68aed05dd6a243f988016b3535e85918497a66dd7c12e7aabb32b3095d7c26dc35ca60f30a2e514", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173005, "uuid": "1e98e761-dfa2-4aa8-9f6b-3efff4e96e11", "value": "T1BED34A46EF818F03C0D5177ABAAF424933229765D3DB730799189FB43F86A9E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173005, "uuid": "99350f48-bf4d-42ba-aeab-1f163edac23b", "value": "3072:Hyb738YOScOHv8BFmeX0ZT8bGSvM/9LI/e:Hy/8YKOHv8BFHX0ibGKM/98/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693173005, "uuid": "ab26e152-c55f-449d-b235-5b24287207fc", "value": 131489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693173005, "uuid": "05cd5a36-0104-43a3-91a7-3b1a758be40b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173005, "uuid": "cab5e294-ecf5-403b-85a3-988a77a6a244", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a916e5b0-44c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693133482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133482, "uuid": "26013ea2-733e-4efa-97a2-479185704e08", "comment": "Malware payload (Amadey)", "value": "ad2378eff89690318d21bf980e261132", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133482, "uuid": "a569c653-8633-43d1-8e46-a14be667147f", "comment": "Malware payload (Amadey)", "value": "510426691038077be6c2f434c0fe93aa84baea2a5cd31c58b0cb5eb80e3d4be2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133482, "uuid": "2ce6ac47-25a2-4778-a062-c10513678fb2", "comment": "Malware payload (Amadey)", "value": "d436c40336ac75146375e6592e6c589c8c241f09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133482, "uuid": "66af6d0e-7364-470f-aa51-237b50aa8082", "comment": "Malware payload (Amadey)", "value": "f78fb92e94185731d07f7424d55a2837b2eb9d2f2db469535bae3d5c5f7e170614236b370f73ba486d13534a4574192e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133482, "uuid": "cbc240da-7643-4e48-80ee-5e73e447e363", "value": "T19C23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133482, "uuid": "a032a871-6b5d-45ae-8e78-fb75fd6b596b", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133482, "uuid": "5baef9d0-8848-4b52-aff1-6285384e5db2", "value": 48920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133482, "uuid": "d4a5d0f1-400e-45d2-8010-8cc31cbb595c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133482, "uuid": "a1529d9f-33f1-4652-ace4-4c4f4ad52c6e", "value": "ad2378eff89690318d21bf980e261132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76425609-452d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693177205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177205, "uuid": "65efe080-785e-4ddf-aa7a-0c83113a155f", "comment": "Malware payload (Mirai)", "value": "ff177a6df98f8bba86d95abd03dde99a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177205, "uuid": "dbb6a70c-8996-45dd-a899-69d5bd021fe8", "comment": "Malware payload (Mirai)", "value": "51c9275607e8341f8fef6f395b79dfdd77bc9842f1254be4e16a85e2b9230a28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177205, "uuid": "243665b6-0c6e-4877-b1a6-4be6fccd0eea", "comment": "Malware payload (Mirai)", "value": "8d131860247a1de956d8842eec1f8cabe19430e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177205, "uuid": "283601d9-dca2-4364-aadb-1924e6c0e4b7", "comment": "Malware payload (Mirai)", "value": "9998459906e1e386a3ce3c8ce780205b1fe8bceb80fa8edfb0366b2c8f6488429fa94cc4af018c1755ef07779d39e54b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177205, "uuid": "0d996487-285b-4fcb-97d9-2bed924f118c", "value": "T1D9E32A46F6409B13C4C22B76FA9F42553323DB64D3A723069928ABF43F8779E4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177205, "uuid": "f480406e-f0b4-4ff8-acdc-b34e9d698f88", "value": "3072:y3twf30UgLCaeR+JbyhVgWpQ5F+eXGjE3jIyVM/9909FKF:yifbECaeR+JbyPgp5FvXaE3jIIM/990u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693177205, "uuid": "69afdb23-caf1-47bd-9fef-6a3d05e8d0d4", "value": 155236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693177205, "uuid": "92cdf259-3530-490d-a5ec-bec808cb2de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177205, "uuid": "c489252d-e2fd-4f53-b630-7a6b1127ca0b", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a143d1a-4532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693179413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179413, "uuid": "2e922ed3-d8ee-4b89-b192-bbc0c430861c", "comment": "Malware payload (RedLineStealer)", "value": "16268285c026735474901473ec8abdd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179413, "uuid": "cfba3c72-dde3-4e34-99c7-f70fda4f74fd", "comment": "Malware payload (RedLineStealer)", "value": "522678b74f854bfd8fb590e168b8731d723e246bdc7e75c23aab15ea9c2b1d08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179413, "uuid": "234d2910-34a3-4923-8065-4e205022b828", "comment": "Malware payload (RedLineStealer)", "value": "be45471311a86f2a7332c71cee26b66fbff2fcc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179413, "uuid": "f0e6d8b5-5e9b-4917-8296-46f2feaccefc", "comment": "Malware payload (RedLineStealer)", "value": "e00d162a0de45e7a80a7274abae17c1f82c2e99e153fc1651aa434ccfc0976f71bdbb624fba564e9ba306892a28f469f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179413, "uuid": "8aa1444f-83e5-4f03-8120-5f724632c36a", "value": "T1D923F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179413, "uuid": "0b1164b5-2cb8-4eff-a61c-c4ca4bcd1883", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693179413, "uuid": "dc628c57-562f-4a10-9dc9-9438190921c6", "value": 49139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693179413, "uuid": "ba907e5f-5d2b-4578-93a7-1da630ddae1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179413, "uuid": "400d3284-2d19-4f58-9130-7919bf2c6445", "value": "16268285c026735474901473ec8abdd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e45930-4513-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693165897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165897, "uuid": "1633083e-0467-47d3-8fd6-4b0651391f0e", "comment": "Malware payload (RedLineStealer)", "value": "96323417448ab4dc2cad524812a35495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165897, "uuid": "9ac16871-1b11-4151-b5bc-4456c97ab193", "comment": "Malware payload (RedLineStealer)", "value": "5562ec24624bfd572dd48257f5630ad459ecb6435c553261957c3fbeeb47f489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165897, "uuid": "f7857870-0c0e-4e6e-97e0-df9e9c610550", "comment": "Malware payload (RedLineStealer)", "value": "f5ea07c29ad8bdd4c413d120a012bae8edddb0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693165897, "uuid": "1bb20813-8643-4cb3-b3d7-e64b0f786963", "comment": "Malware payload (RedLineStealer)", "value": "45cd28527f119bc95fb07bbb0e52ca8a4a4fd89bb00d148a449801901b3ae2a31ca3f77c1f8f0bae3ee1cad8fb56fbaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165897, "uuid": "8d5a3cb6-b3e4-4ff2-86c2-41184bc438de", "value": "T152052247A2D86133DCF417B408FB03832E3ABD618A7D97A72755886A09336C5F5393A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165897, "uuid": "15177ea8-7f21-4ea7-a83f-8ea058b39eae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165897, "uuid": "bdb3cc6c-6b3c-49a2-975c-83a7ad9e649a", "value": "12288:9Mroy90SpdN6H8SZ4IqYd0R6HQK7mJ04JbLqbl9qZDD3Yxuhqcu7oVZyjF:NyjpHXSZ4mwWQ3T1qqZHIxuhqcu+gR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693165897, "uuid": "bee85cf7-51d7-4d17-ad50-9df2d8017234", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693165897, "uuid": "a1d24ad3-2c29-4347-a6ad-4bb97381e7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693165897, "uuid": "f1995f29-c1de-4456-8abd-9945bdd9af3a", "value": "96323417448ab4dc2cad524812a35495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca0bf6d-44c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693130481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130481, "uuid": "caa3b8cf-30d3-4b39-8d7e-14b0dc6d904f", "comment": "Malware payload (DCRat)", "value": "a45ddd832d1e566b31925c9077bea80d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130481, "uuid": "f935583b-a54c-4764-a363-78e4cd6464f8", "comment": "Malware payload (DCRat)", "value": "55e30365b67cab253ec7b5d2c18020f459bedeee895e0f9b5eb13f8b0d359668", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130481, "uuid": "08e237c0-5595-42d2-8b56-b9c1b67a51fa", "comment": "Malware payload (DCRat)", "value": "371924a02a0daa8485951ccae7e94f8dd643993d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130481, "uuid": "a5dfbea6-9270-4f5e-b1d6-b2d1478527c8", "comment": "Malware payload (DCRat)", "value": "780b4b39876f00dd6629c25af0e95e79f14f36d02257228b92ae9d029d20480bca1a5f98e3d3535162dbac7e3a149ef4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130481, "uuid": "0b79b390-1960-4130-b90b-8ac8e90755dd", "value": "T199C5DF013E44CE91F0091233C6EF454897B4A89166E6E32B7DBE37AE55123A37D0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130481, "uuid": "7a64a00e-942d-4ac2-8eba-697f5f982a03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130481, "uuid": "e15b5b4c-58d2-462b-9ccf-46c724c5200f", "value": "49152:77jI7RpqKA+bwjR4ad5/ACghVwxw6V5oBg0kgr2AxmSk:HM7RpJGaO/bgcwuoBEHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130481, "uuid": "fd7dd50a-b384-4433-831c-d000d8120540", "value": 2578944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130481, "uuid": "1f0a326e-7131-4913-8582-cc346689f5a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130481, "uuid": "6e1857eb-16fe-4915-8ffc-5beb1e17b211", "value": "a45ddd832d1e566b31925c9077bea80d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a45731d-4506-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693160515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160515, "uuid": "a6e9c840-1955-4c6f-a639-03304c94f3c2", "comment": "Malware payload (njrat)", "value": "2f3113fe74144638f5b4627689c4b932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160515, "uuid": "18917126-d482-4e78-89d7-a81adc7b363e", "comment": "Malware payload (njrat)", "value": "55e4354e2095f46a9c5c8c05a8da4199528677d826477e6a617a14fec4e3be01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160515, "uuid": "dfe2873a-c93f-4dfe-84ee-c8a8d2af5083", "comment": "Malware payload (njrat)", "value": "ba859bf3a8a5c916a9c197a7bde395682e5a023f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693160515, "uuid": "e400f4be-32da-40c1-9d6c-b9c273cf9769", "comment": "Malware payload (njrat)", "value": "903001ef60b019cb4a042b801d16a1fd62a9c27dedd3402cfe93bdfd79a0106805dba1f1b007c1bbdbd702454196dcca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160515, "uuid": "1e327276-6cb1-40b4-b478-8754e0ef8394", "value": "T17D35332EAB95CD60EDB4BC77C907785CDFAA703D5C78DA5A6010D0B3D4EA53E4404AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160515, "uuid": "57d058c5-8304-4442-8ad3-bacb4965999a", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160515, "uuid": "73e8b097-200f-4bf8-a7db-196f406f0427", "value": "24576:qh5Ij9nwTUW71UuYz1OxZNd3ZejfP5LU6FD45xZqYB2yjYL:Hj9nGhqktp4fP5I4gkJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693160515, "uuid": "59f155c6-acce-4495-b3fe-35565a3e23ed", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693160515, "uuid": "e999626f-daec-4575-9ab9-4d95059ef2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693160515, "uuid": "fdc4da33-2dfe-4610-a3af-52a1920a2eaa", "value": "2f3113fe74144638f5b4627689c4b932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8130b84-44c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693133480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133480, "uuid": "5695144f-7317-477d-bdd1-d68a4f67548b", "comment": "Malware payload (RedLineStealer)", "value": "1dc94824f5f83a8289a584f31895d1f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133480, "uuid": "45e533d9-4882-4869-8776-50c8ec799075", "comment": "Malware payload (RedLineStealer)", "value": "55e7c6f48ca099957d813626546bbefb1051785cd30f5a0b06b82a947a419c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133480, "uuid": "e39a0154-db16-4a25-b03a-295d9000ba69", "comment": "Malware payload (RedLineStealer)", "value": "8e3f1a7c666701a7a04f4dab249d8a7f0c784dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133480, "uuid": "8a3d6ff5-6db7-4807-9bb4-e76c8fbb5b2a", "comment": "Malware payload (RedLineStealer)", "value": "de7379948be8b01a441a94762923f5263a44831b4560de44f2a707937cae804ded6280ffbc3a410923554b75901316d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133480, "uuid": "08a407de-7a07-430c-ae4e-eebf2c19cd8d", "value": "T1EFE41242A7D48476D9F123B048FB07871B323CA29C715B6B27866D5A0DB3BE82935377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133480, "uuid": "8a19f484-3f11-4c91-833e-dc64b73ba973", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133480, "uuid": "2adfb07c-40df-4b8d-b860-0640f728cf6e", "value": "12288:bMrNy90t5xt+bnCUGO4HHcGanKVsGq1+pPuEZMBQF2KBzuaMvRyWym:KyY5rO/GPW3CPuEZUQF2OulpZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133480, "uuid": "2ea7b034-d33b-4ea0-b883-b8318d64e40b", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133480, "uuid": "8e00ccdc-12f4-4ea6-aceb-e2e5b088a6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133480, "uuid": "93778273-3a7c-4c8e-a14e-e8f40b02e90d", "value": "1dc94824f5f83a8289a584f31895d1f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e59a04a-4485-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693104929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104929, "uuid": "708bebcc-ba27-461b-a68b-8eb56f0d4b9e", "comment": "Malware payload (DCRat)", "value": "3761292014e48db78c4cc3b6d64628a5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104929, "uuid": "fbf5ab0e-160c-4a4a-8f7a-cc425991331e", "comment": "Malware payload (DCRat)", "value": "55eb1ff4adcf02c61e74eb888b553adf54c5cac56193b01d5c749b502792e2a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104929, "uuid": "77882349-5401-4280-baaf-57bb1ebae1da", "comment": "Malware payload (DCRat)", "value": "9a34f29b8122ff4c24752b058fcb4d0b054f0ad6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104929, "uuid": "9435a5ff-fc63-4319-8580-c1909e246218", "comment": "Malware payload (DCRat)", "value": "0fdb6b6583fa5c38bf8ae2615eee847c9e7ad82a9a1290adca5f36ae635e2915059cb249d44b5b68dd692ccff62c574c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104929, "uuid": "49b14c0b-ff90-4647-9625-de0a121c4aec", "value": "T184454A027E44CE21F0191633C2FF450887B4AC516AA6E72B7DBA376E55123937C1DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104929, "uuid": "b51f14bc-3107-4d50-a0dd-5bb8f6384706", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104929, "uuid": "66096cb8-dbab-4863-9330-4bb17aa48305", "value": "24576:U2G/nvxW3Ww0t+ASeaIQadWtv25qTNztXeFNBL+v7nI:UbA30NbaIibxXeM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693104929, "uuid": "a758dd5b-b71b-4e6f-9df4-c6f216e8ee2d", "value": 1164454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693104929, "uuid": "7e70587c-458f-415a-99bc-4a5869ad131e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104929, "uuid": "c1d4ec69-8576-466e-ad04-e3a8719da4fe", "value": "3761292014e48db78c4cc3b6d64628a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e08362a-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149354, "uuid": "46a87937-50a2-47a2-8ec5-6e111b44d6f5", "comment": "Malware payload", "value": "6b24ca74351cb29d828d27565909025f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149354, "uuid": "0a70835c-3548-47b7-b247-b1ae2c7525cc", "comment": "Malware payload", "value": "56d0d92702f5b91cbc6452699826e9db7b62c42796e38562f241a5867618c899", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149354, "uuid": "4cd35101-c03e-442b-8003-bb886b27468e", "comment": "Malware payload", "value": "368147b3c353099b8e77685e05ad8ae97a66fe15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149354, "uuid": "237073fe-45c6-491b-979e-b28b92b82360", "comment": "Malware payload", "value": "431dbf5f7d0a7b657f22b4106b3e311c5a59e1e1acbf8e37140bf4c1a8b280fed949fb3739882f4e19f73e4ca165370a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149354, "uuid": "ea6924bd-5460-4225-be60-0d95f490a948", "value": "T1F4C33A01D5508B27C2D2277AB79F825D73332B6897DB33119A247FB82BC1B9D1E3A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149354, "uuid": "371cdde0-3e47-46a7-ae69-56f3588ea64c", "value": "1536:RgnO/l0KwpaDsY1M5uiPrbZtvWhAwjg50rwlYlpDmLaiaujqbmwsQOW8fXG4N:eaGDbZtvWh/gcUypDtuebm3QOWsXG4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149354, "uuid": "ac4a85ed-2f74-48af-a032-de97c75c699a", "value": 119507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149354, "uuid": "ed41e1f3-0fc8-4a8a-8ccd-bb52beba276b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149354, "uuid": "b5072a50-ca70-4c4e-b1ba-c3c1ef55f461", "value": "6b24ca74351cb29d828d27565909025f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a744ea23-4518-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693168268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168268, "uuid": "6ae58dfb-fd4b-409b-ba54-8911412473d1", "comment": "Malware payload (Formbook)", "value": "b4514c6314c651cee8d543e916b4eca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168268, "uuid": "b1725bda-ca58-458b-8107-f610374e0322", "comment": "Malware payload (Formbook)", "value": "57a70c86b99cac6435ffc0fc3c93957ece656f9d92061a4ad7e06c531c0bbb4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168268, "uuid": "1d191378-005f-48be-b7ac-39ea4c3f1ab9", "comment": "Malware payload (Formbook)", "value": "521bda730b2b340e88ddd5f8c19b4994088bfb62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168268, "uuid": "cbe2bd56-2ca7-4db8-adca-0155cd2d4403", "comment": "Malware payload (Formbook)", "value": "b8e43b5dab9afbfddcecbbcfcc776041c44b69a98c4b3d15a809af191e8ce3501b5b1695c6c5edb768270492920c0eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168268, "uuid": "1cc46511-96f5-4ae7-b947-18bf78966c67", "value": "T1C1D4130CBDED9B23C23C6AF9E5A250100278E65D5532DADA4CC620E90FE7BC4DA58F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168268, "uuid": "176c0e8b-731b-4eb5-b5e5-a70c0ddbad6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168268, "uuid": "10cf977d-3a26-4a39-8698-4b720ac63836", "value": "12288:mTQmGPdzXjTXKJsEXzqIOJA/8xmBkQQy3kOCxj:nmG9XjTqzqID/8siyjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693168268, "uuid": "afc54664-685c-406d-be25-ea7a90eaa58e", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693168268, "uuid": "8ef0c059-b971-452b-82e1-a25f49ed3187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168268, "uuid": "f1d32dd5-80a9-4857-ba5c-a2a02dae9452", "value": "SecuriteInfo.com.MSIL.GenKryptik.PWSX.tr.31794.24352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620beb85-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103727, "uuid": "b3236a41-d1de-473f-ae0b-17e8d3ddd75c", "comment": "Malware payload (Amadey)", "value": "f690f2cdf1cfe8a0d3d22d05fb257bca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103727, "uuid": "a4c268f4-84f6-4f2d-ab47-aac3d7af95c8", "comment": "Malware payload (Amadey)", "value": "57b1f1964c73f00d136711c129347288a7cfb1e7cd61ff4f29095eac718fbdf0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103727, "uuid": "82963265-3ee8-4bc0-8e9f-c3167bb4d6ff", "comment": "Malware payload (Amadey)", "value": "8b9d2157c3e7c542e176296d1914cb56f70d9739", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103727, "uuid": "d10c032c-4c10-4389-9261-db5806b770b2", "comment": "Malware payload (Amadey)", "value": "20f65c5fc7e152c44a38ef02d80ebe4aa0eecb6334bad366e79a3d2341bc250ef14fae4d4f17888b3d9fd33cbe253124", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103727, "uuid": "db6e8d53-b59a-4162-b32f-cf227254165e", "value": "T113652323FAC58073DDB917702DFB83931A3ABCE9186C065B324968164877BC4667A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103727, "uuid": "39b03296-ec11-4003-bbff-da723c4605d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103727, "uuid": "aab655cf-034d-462f-8d0b-d71926a3ead3", "value": "24576:gy1TlfXSN9FHm88wKWITpYONZu/c5wDlLFk0Ws5z+Y87Md3sycm/0ltICWeBl/rh:n1TlfXujKWITprNZu/c5wDlLJFsYd3ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103727, "uuid": "d0dc46fb-d3bb-4abb-891e-96a5be477923", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103727, "uuid": "4ba12f0a-795c-47ff-93c7-fa3f12f11d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103727, "uuid": "3a0c9fc5-c8da-45c7-a9f7-94e38d13f9f7", "value": "57b1f1964c73f00d136711c129347288a7cfb1e7cd61f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570b1b5e-44c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693130767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130767, "uuid": "1aaf9ad5-5f59-44ef-bf50-1e75ae9b2881", "comment": "Malware payload (RedLineStealer)", "value": "a9e3550879c442354e1901f12bf669e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130767, "uuid": "8adc26d4-16c1-4054-877a-23bb4340f995", "comment": "Malware payload (RedLineStealer)", "value": "57e555bab17a3c042a1de4982a82c25dd8e4c9d0364714fb6f823f17f13df909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130767, "uuid": "fbadec2c-f7ff-44e0-97d0-2cd5312a19d6", "comment": "Malware payload (RedLineStealer)", "value": "5968d943d5b483a23639995e7e7747d7cacd4f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130767, "uuid": "1906d062-6a40-414b-8aff-7dea22936bfe", "comment": "Malware payload (RedLineStealer)", "value": "0cb9260f0ecfbccbb2f820fd68371d2ee114bc7e898c548ab915be92e2f65f3d6b03c1f13c19cb175d66c549ecf8e22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130767, "uuid": "a7d1a5a9-5ba4-43b9-9eaa-6f187d267544", "value": "T1C923F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130767, "uuid": "cb597bd3-4479-44bf-8ae1-377572a01a41", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130767, "uuid": "38499228-da0e-4ded-b512-29fe29ec0726", "value": 48673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130767, "uuid": "829f1392-969e-4f2a-88bf-775fbcd30016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130767, "uuid": "2fe89fb0-359b-4e3a-9c5e-546aa87946f1", "value": "a9e3550879c442354e1901f12bf669e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b191f35-44fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693156034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156034, "uuid": "80feffd7-4484-48c1-ba81-61d44598cc83", "comment": "Malware payload (Amadey)", "value": "64f1d67b14dafea71c599e9c5498edc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156034, "uuid": "d86d6701-51c2-4beb-89b5-8c736e326a07", "comment": "Malware payload (Amadey)", "value": "57fe95c40d83f395bad243134a47ac8af1a322c7d246979562e2574036da5661", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156034, "uuid": "8d2c74ed-3fe8-4301-b255-7bacb6fd9769", "comment": "Malware payload (Amadey)", "value": "6099ea6ef4fe0066c9d97822402878966026dae1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156034, "uuid": "4163fcf0-1f49-4942-ae07-23b95432a44e", "comment": "Malware payload (Amadey)", "value": "81c6cd1780b6bf00f4b10684030f96f63506adb325185155e764b7723396c5f9250b344f45510c88beedbdd7f7e4c267", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156034, "uuid": "62dca617-4458-4255-814c-79b7d62da617", "value": "T1EBE412267B6F4A47C16904FE4F9311BC1B30DC3A698AD3476586B33D4EBA3C7852621E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156034, "uuid": "9423618a-4434-4ff1-ae6e-1917d447478e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156034, "uuid": "efa190d0-95b7-47aa-ac02-7b5cb310a60c", "value": "12288:plKxWCF+i/o4m8mMLkV4dz62TigPHRD/cYWqBGspdHtK:plKxWCP/oRMLDFpigPHlkYWpEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693156034, "uuid": "80f9c5bc-9920-4f81-977b-fcbb91f494c9", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693156034, "uuid": "e113e9d3-e4b0-4338-befd-4ebafae3af33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156034, "uuid": "bebd3fa0-428b-41ad-9937-b92f893c21b5", "value": "CS-Cheat-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9cc502-44b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693127157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127157, "uuid": "7c3a8cc4-e6e2-4a39-b857-98f35a8079b8", "comment": "Malware payload (RedLineStealer)", "value": "849908b418ecba8545ae4bb1af53acf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127157, "uuid": "e003dc13-b02d-4fa7-8185-328515d0518c", "comment": "Malware payload (RedLineStealer)", "value": "58ecf56c80a70f00166fefa3873c5e3434dc213a73cb03e3e3f17f584903fb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127157, "uuid": "b27ebdc3-dad3-4dca-8e6b-8b78b7d68f6e", "comment": "Malware payload (RedLineStealer)", "value": "038d7eceff1e64fef80bf7852d5d59b40747f8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693127157, "uuid": "37caaae3-78ba-4e57-aca5-5dad06229137", "comment": "Malware payload (RedLineStealer)", "value": "dc7e5fd7da7d6a48b4ff4f2a47579aa4a2d4eed566ce632d758b05e43a5e7ebc94bb5c00a51af0be7e46c19235e2ad1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127157, "uuid": "80279e83-89d8-4763-8a1b-2c6ad1e98bdb", "value": "T14B6523037AD58427D9F127B168F923931B38BCA24DA88B332352595E49736D8D532B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127157, "uuid": "8d58e6f6-9467-46a4-8cda-2812532da312", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127157, "uuid": "0434f5e7-f3ae-4398-b8a5-e64afca5405e", "value": "24576:6yyEqE907Q7H/EwUK3CUn0vKkHbEEzEeU1BZdWQ/iuIywDxok4O3EfoMVqFJwkPy:Bbqe07Q78DK3CU0HHoG2ZVivdSU3E/V2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693127157, "uuid": "40d7d3d5-6263-4e5d-977e-a612c179d751", "value": 1488384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693127157, "uuid": "dc2d5456-58ba-4c94-b4d4-509b2599cb48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693127157, "uuid": "85fbf94d-f144-48ac-af69-00c2c1eadb89", "value": "58ecf56c80a70f00166fefa3873c5e3434dc213a73cb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ca4f08-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149374, "uuid": "324a4f28-aeb8-4147-a209-c944efdca7b6", "comment": "Malware payload", "value": "4814e7b952701604d8ff0e9c8177c133", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149374, "uuid": "2249560f-9498-49a8-bb92-21fbda9f178a", "comment": "Malware payload", "value": "59b57cd68e62457fd2fcf682d077f846250de4621845ebbc84e742ed23448d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149374, "uuid": "bcb88f19-d2b5-4ad7-989d-c83e75003b3f", "comment": "Malware payload", "value": "10a599eae5c9707c2f08ac5c0634973da0ef1fd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149374, "uuid": "6509e743-0942-4cce-a64a-1eade5d613d3", "comment": "Malware payload", "value": "42768941ad3607b598f2e3de3f9cb3b6e2504a53a1c1011ff1e6e912ff5e146d12aed64af68df0f4ed5fc4a0ae639828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149374, "uuid": "63bbc8d2-e85b-4e02-a884-5d9b89b78a26", "value": "T1E0A32A37BB230F23C0C9547112E30331AAB5D75938BA5397BAD06DAC6F1AA8435277E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149374, "uuid": "006be334-d8ca-4b26-8ec3-8d19cff71fc5", "value": "1536:G6D5jKKtWKAr7NM5Oftit+lVQycmQHFqXjetRea4Q:Or7N83eVQycmQHFqXytRH4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149374, "uuid": "898c4f27-96c5-474c-b106-c6f7d07e4254", "value": 103381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149374, "uuid": "fb0bf597-4537-491a-862d-f66181d91b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149374, "uuid": "75f695b8-35a0-4496-8daf-05508d6a2b35", "value": "4814e7b952701604d8ff0e9c8177c133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4661ad0-4496-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693112455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112455, "uuid": "8faf4bce-153f-447d-ae82-d18c7c5244fe", "comment": "Malware payload (Amadey)", "value": "1d5b664cb7b981754be97ea2a44dda73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112455, "uuid": "55c84842-cd06-4bd3-802b-2241db9c9d59", "comment": "Malware payload (Amadey)", "value": "5a92810316d0786bf3ec1896d3a1fcac04a9fac71aeddc063f24ea085dab8549", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112455, "uuid": "bcd691c0-ce1c-49f9-ace8-442cf5ae7107", "comment": "Malware payload (Amadey)", "value": "b90d9a2c596865ad3bdc35106d61422a09e40b81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112455, "uuid": "56a8a432-1988-4e64-9142-574de78ddb14", "comment": "Malware payload (Amadey)", "value": "46def7fca9132a6226d17f1c17b84db01a450abad7311c36616706d1057189a709ba834ce6c6ca540d49c0c369f5f17d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112455, "uuid": "88ec2c5e-6dde-45ae-bc3e-4b89bd818f3d", "value": "T17265230B77E554B2CDF53BB048F702C30D36B8B5A878463F269179279976B80E436B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112455, "uuid": "c4ece6d1-f2ef-473d-89af-b22ef096476b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112455, "uuid": "a3749f88-b89e-4daa-b1f2-802056b9dcea", "value": "24576:/y3eCJYcwRAb972oKL0+ydkpzciFziHUmTM1V2ndQ7B1vqXfn7fI7dJlzEF:K16cwRAb9qoKL0+PpIiF+5T+WdQ7BJqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693112455, "uuid": "39e090a2-d7d2-4733-87f4-31f3cf2b0848", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693112455, "uuid": "6ed58eb4-8649-4390-97bf-f98bc43a576e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112455, "uuid": "71cf4653-8a37-4955-9f9e-6399c4835bfe", "value": "5a92810316d0786bf3ec1896d3a1fcac04a9fac71aedd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397e18a1-4523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693172808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172808, "uuid": "5c0110f8-7c30-4200-b3ad-b557f270c419", "comment": "Malware payload (RedLineStealer)", "value": "a1253067ec3bc234c27a42a1ea2418eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172808, "uuid": "28118ecf-d37c-4be8-8af5-9346d7b523a4", "comment": "Malware payload (RedLineStealer)", "value": "5b5671b2102234a4eaa505b7e6f0cf8716f8d4aa3136197ad1f14e4a6892aa79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172808, "uuid": "b7905b72-3c41-41df-9af1-067b6f04de5b", "comment": "Malware payload (RedLineStealer)", "value": "62a34cb7c99cd2e6558e074bb3a2cf2b9377b330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172808, "uuid": "39ed5628-42e8-4199-ad6f-36e1b3eda605", "comment": "Malware payload (RedLineStealer)", "value": "10c51cc053f1a2bd027388c81b8a5a12158b7b2019d93b8e2cfcb07952c90be5bec7c2d965ed57891c5ad0d8ce191095", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172808, "uuid": "b4128c58-a755-4ab8-9a33-bffb734d3a4f", "value": "T1DDE41203ABD85232DCFA3BB119F602632F31BC909934576F2681AD0D1CF29A5753276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172808, "uuid": "fc3d64e1-14fb-4eb8-bd03-2ea9cbd8099f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172808, "uuid": "1f3295b3-dd9a-457b-be49-92532dd7fb88", "value": "12288:OMrpy90+uMdxfFJwsW5wc4WCYidTwWBrUmE6H8obXB55q8HTdtQCp75r8PgsK:HyZJTwsW534WCNtDQs8obZquTvpNr8/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693172808, "uuid": "70ae6e7a-6b94-42b8-bf5c-3250a8b1fd34", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693172808, "uuid": "0d3ba437-454d-4f61-a177-4caaab009d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172808, "uuid": "cc0cdc6e-9561-4cd9-87fc-901d9dd88e8f", "value": "a1253067ec3bc234c27a42a1ea2418eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95623e0d-44fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693155782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693155782, "uuid": "ef3fb7dd-7d9c-425d-9538-c6848fd14fa0", "comment": "Malware payload", "value": "50532b97a338f3659aaa699dbbe5daec", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693155782, "uuid": "84c6b8d7-9b68-4550-978a-6291325fbcd5", "comment": "Malware payload", "value": "5c27990a38a703d843bb5184541a92c46d90b637fca6f4b6259202ff3a5d7dc4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693155782, "uuid": "9db7eea4-11e9-45b3-b119-d06c626b02ac", "comment": "Malware payload", "value": "aa1b3b7809635a8472d11ff72bbcf4973fea3f77", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693155782, "uuid": "b068b60b-4eed-4993-87ee-720a73a38d49", "comment": "Malware payload", "value": "e817a39ce20eda4a4d2c049ae8b3a5c47ec73857243574f3f2199c15d6454a74b620da561a32d5ee1dd0411cca33e85c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693155782, "uuid": "978237f8-1997-4b0a-92bf-548ca2ad1a89", "value": "T180752360B1D0D9B3FDBF177150BFD64A112B6F546E499123B22ABB9C32770E41B8D882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693155782, "uuid": "1ca2c4fd-dd4b-45ab-a500-2c1d115a63e1", "value": "24576:bvRcaq8hLBoYpuGL1mTDVagz5vk+5TPyxaOGiSsVkv51/x8zzsS4UEjR:bvRcaqnbqgn9vk+5TUEx/d6zwS4UEjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693155782, "uuid": "79d30b3d-ad2b-4d7d-838e-ae9226f1dd71", "value": 1602768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693155782, "uuid": "6b3a65f7-907b-49e1-a3b1-db55ce1a9c8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693155782, "uuid": "4d6de417-ba99-45af-ae0b-f1b340dd68eb", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5fbe1c-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103719, "uuid": "a4c9917a-62bb-450d-a196-003b2f081d7b", "comment": "Malware payload (Amadey)", "value": "dff57afda571c09037a31bd31c4b5deb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103719, "uuid": "113b313e-fb01-43f5-9a6e-450a1ec488ca", "comment": "Malware payload (Amadey)", "value": "5c4d2f510b105607d96141658113d18117983bdbf59f729c7219eda84b869342", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103719, "uuid": "9ba17e45-cff0-48d5-8809-37a2a31b1541", "comment": "Malware payload (Amadey)", "value": "c7a833063282672739e1890d24763b6763b271e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103719, "uuid": "ae188b32-5c36-4a99-ad98-9647fdfb980d", "comment": "Malware payload (Amadey)", "value": "4062156e7d79161304b9a9cdf8004913b3c0ff1cf229adcb3e2c1937716478f8e22abfd3c60dd93471a69f9073995b26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103719, "uuid": "3aa6e803-8026-4717-8b6b-ecab1b1bedca", "value": "T1B5E412A2DEC49032E8B517744CF707D71A3ABDA05D7407AA174AAC2B1C72680E97937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103719, "uuid": "6cae3aed-497d-41ec-9d23-78143ce1cfc1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103719, "uuid": "5cb0377c-5f2a-42e5-b938-928141f5a00f", "value": "12288:WMrfy90gJJ4qd8ofoOD7+3p2KLREN/L/86c/9VSchkHh5VDF3yd:hyBJ4qjoO/+oKNO/D8L/9VXmDFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103719, "uuid": "85ed5854-18cf-45d8-b467-bd0617e798f2", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103719, "uuid": "0928966d-c895-4979-8505-aad34d634c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103719, "uuid": "044d9a0a-39a4-44d6-9877-2dc0b784fb60", "value": "dff57afda571c09037a31bd31c4b5deb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa93189-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121359, "uuid": "0becf9ba-cabc-4487-97fe-861c85a28eb6", "comment": "Malware payload (Mirai)", "value": "dbc9568c0786e7186007ccde970aefb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121359, "uuid": "9d5df575-5079-4201-b796-171423b0a7cb", "comment": "Malware payload (Mirai)", "value": "5cfa1a29a12b5f04784d39e0eafc44cca15697616c401c1d8779e61be81d6921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121359, "uuid": "1bc2a60a-1987-454e-881f-118313108d85", "comment": "Malware payload (Mirai)", "value": "5c412fad0ba41db9a74606cc395a76c83967f6e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121359, "uuid": "6bc99c9d-ff1d-46dd-855f-e8d0b0629602", "comment": "Malware payload (Mirai)", "value": "743cea127d378c3b1a93b274889d3a0df56fd45f323d0c32f8c9ebae7172b3a7b21494eda1926e1a36612889b44e8714", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121359, "uuid": "b75bb0d0-0bdb-4498-bdda-ff26aad1b9a0", "value": "T19EC2D13092EE2CB6C6500572E6B856C9BE520F7CF6FE3890224187BB3C41D1519E69C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121359, "uuid": "9016805b-3a5e-4071-a71a-57f86036a785", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE19qFRXVjhymdGUopZ:A8soTAZ3alkXLvFh8nNE1CRXls3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121359, "uuid": "0a3aaac9-56fa-4a83-a2f4-423622a8068a", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121359, "uuid": "fe9d59d4-cf68-4318-be95-664103f9142a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121359, "uuid": "fb5fa26a-1413-4ee2-9e46-e5da4a0f06b2", "value": "dbc9568c0786e7186007ccde970aefb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718c8487-4534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693180204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180204, "uuid": "461d7cb8-bffa-4360-8ae4-00c097cc985e", "comment": "Malware payload (Mirai)", "value": "fc25d422ade5313d20f7ce4401218e53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180204, "uuid": "e15a2224-e672-4fc0-8295-c0cb4fd5e24d", "comment": "Malware payload (Mirai)", "value": "5d4bcf9b06778164935ee16d02b58bdc2077a925e21b043ad2ac1322131d014b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180204, "uuid": "239a4dfe-88fe-41e4-87bd-ac6367ffcd25", "comment": "Malware payload (Mirai)", "value": "eba5759a14ce185ac089c8bd60e0d465844e7e3f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180204, "uuid": "6b05b5f4-f22a-4b7f-afd1-1106867ef71b", "comment": "Malware payload (Mirai)", "value": "8236d70676b759399f3519774a4b0d13d21232f1c62b1ae1611123a677d33262bf3dadda8b6a815f24684d98fe18f096", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180204, "uuid": "e6713935-fdad-4155-b6d3-fa7ff4ac7743", "value": "T1293302626BAD29D291B05377FC33AC5AA6EC16F49D67309B2CF0591973C18024FF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180204, "uuid": "a41f7dfe-9de2-40c4-9320-75fb1753a1b5", "value": "1536:s9O/ZMAXIxNUk0GNmBLcPqF1aBexo4opKZbi:s9O/ZNKyaNULGqFUFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693180204, "uuid": "5bed499c-ec65-4f23-93ef-6f1cf4738637", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693180204, "uuid": "3d7125e5-4ea0-433b-a724-17cf2afc7f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180204, "uuid": "caacaba4-395d-405f-b413-5321672c6227", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c08fdb0-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "6467a5e5-b9f6-4cff-aed8-5b94e84c63c5", "comment": "Malware payload (Mirai)", "value": "48371aeacab4b31b18a008ac294c08f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "afd648a2-bdb5-4a43-8afd-342a6c5090b1", "comment": "Malware payload (Mirai)", "value": "5da5141d44ea155e87f23b4cc7f332c38eab652e9faec87c7d874f2c87990117", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "15af3d87-f627-4faf-8d08-2b3db1137af6", "comment": "Malware payload (Mirai)", "value": "5ed57533496106565c7fbc8b5de30e44591b15dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "9358edd5-6a0e-44e2-a46f-b455c10271b1", "comment": "Malware payload (Mirai)", "value": "828f42b38b0b55e4791669ec02de805eaae6ad92bc9f94bb9751b102a28a18baeef9f8306d803cbb3171d3ce1265cbe5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "b4c8ba6f-b4c6-47dd-af3e-091b4023f6d1", "value": "T1AEC2E1E63EB7799BDE29013D38ADCE374275E022D79AB653D240920820171BCBB719DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "2162bc9d-49a2-433f-a435-bf43776b43d9", "value": "768:0MwoDZLFbBy6HQHRYfeAxdd8afx8wi0Nk:0olcYfe6KZuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169403, "uuid": "90247124-1acf-4ef8-bdde-26e1e31918bf", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169403, "uuid": "15966bc5-7796-4bab-add6-bfaeef5cd0c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "22e69f07-39ea-47cb-9d4d-62602f3ffa4d", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a870b2c-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126048, "uuid": "66c61d29-4c28-4909-89ad-b83056d8c5c7", "comment": "Malware payload", "value": "481b5e096125ba3be016f5ae27805a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126048, "uuid": "c49f0f2c-c128-49d2-80d1-5803a48184a1", "comment": "Malware payload", "value": "5dcae972a839b1dba2111f2c673d29c6c86ef6bbdc4465372951d761ff7db816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126048, "uuid": "9cf27d0e-ab6f-404e-bc7d-a0cb4d9a344d", "comment": "Malware payload", "value": "7deaeabc7d037f4abc11bf4b6da8e5a9bbe3a487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126048, "uuid": "56a0d480-c0d2-4517-ab19-9b588759c8da", "comment": "Malware payload", "value": "b74d9328afbbdb1a55ce34bd0b8c413fa4d39e87c48d39fddf3db202893fedd6b124e12543c58c7cc23fd7cfb51a714d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126048, "uuid": "3e1b987c-b7ed-4167-98df-5f63f19f47c8", "value": "T1CD8559326855D46BC3B1023177BA97E0456F5CE10779C0FFA2D47968ABB87C132B826B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126048, "uuid": "b98802ae-e8a5-4228-9379-2d93ccfa33b5", "value": "be36c0cc97830bb956be383c177ec987", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126048, "uuid": "70323bf8-16e6-40af-9c44-531e94fbfcde", "value": "24576:oWmvnOa0w2iyiQuMOIY59+DvCRTvxuha8WdA:obybp22CRT5ka87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126048, "uuid": "ebaa915b-c883-4464-95da-6b5f6ed739d1", "value": 1754984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126048, "uuid": "e5577ecf-120b-4673-a4b8-712867b22e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126048, "uuid": "ca5a7a72-7852-4e25-a1db-05c8a4347d5b", "value": "news_01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ade78d5-44c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131069, "uuid": "42a6bb27-a875-47c3-8f25-ea1a29c82800", "comment": "Malware payload (RedLineStealer)", "value": "89403274e6517d64e3e40ef98f5aeaf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131069, "uuid": "d8ca1a2c-d8fd-4cc2-84cb-978ec64d599a", "comment": "Malware payload (RedLineStealer)", "value": "6039b12c21000a3afcea809682d382df39a6967a0f2a79fd3f13523e8154d6ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131069, "uuid": "0e39959d-917f-49c4-900b-50221af2202f", "comment": "Malware payload (RedLineStealer)", "value": "7ab991e8afccb9c84da92cdfd5bc7ad61fe43f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131069, "uuid": "2b953aaa-2acb-4727-a38e-db1430bc8f20", "comment": "Malware payload (RedLineStealer)", "value": "d6de9aacd8a60ac87cc0b3b55c1c37a9ef9ccb58f41e9be35b2aad0f640b9acb8d16583fcd79766b7e107a6dd30144c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131069, "uuid": "246890b1-9a0e-4c6e-b31d-7ffb796d196a", "value": "T1CF152312F6DC40B3D5B85B7068F817831B3679A4AE3443AB7B55195B9CB31C0BA703AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131069, "uuid": "f7714cac-737c-4a52-99a6-8b24bd4d8184", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131069, "uuid": "b935bcb7-d132-46b5-97b8-ddd2da925770", "value": "24576:iykdK2LUM0PhZNkh2/KmUVPEjLBWj6oQjzX:JK/tW4A/j4shfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131069, "uuid": "b5a0f2c1-9aad-44a5-927f-82f0001262f2", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131069, "uuid": "dea404e6-cba6-4e61-95e0-629be97818a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131069, "uuid": "8d506d52-b8f2-489c-ba54-961e5b72152b", "value": "89403274e6517d64e3e40ef98f5aeaf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b573b10-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169429, "uuid": "43774677-f6ea-47a2-a26c-520720860002", "comment": "Malware payload (Mirai)", "value": "7500fe056cdc0244aeacb4edd8b73fb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169429, "uuid": "f991a000-ec1b-4f30-9466-9277d12a6681", "comment": "Malware payload (Mirai)", "value": "60b3abbfb524d47b1075d14ef40491be75c2d89ebb47e812805a1bffc7c5dd68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169429, "uuid": "32553b6d-f0e5-4bd1-a832-18bd0953e763", "comment": "Malware payload (Mirai)", "value": "f4fcc65cdd19b25094a532f238931661afca79eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169429, "uuid": "59e4b71a-ef59-45cd-8917-dacb316a2eea", "comment": "Malware payload (Mirai)", "value": "b89228a0e20c3dbde964925d1774f96611f7f506ac1a57eb88f67cbcaeb048630c7493105ca30784d5b482bf3bed6c87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169429, "uuid": "89010c07-c5d6-449d-9db3-771f5cef2e97", "value": "T187D2E02CD95C7D45CA9D3EBE50CE5AB5388C71C0935DF68E17224448B62BA87FC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169429, "uuid": "52b96fd7-7cc2-4c78-b44b-fff8955ec73a", "value": "768:D1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN0JbKWUC:DbDs06t4BEub4sU/MbU0+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169429, "uuid": "1f4578cd-65a6-44c4-8ba0-16b5341b688f", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169429, "uuid": "4a085fac-475e-4b40-87c7-f2fa7a3b4561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169429, "uuid": "f88b8ea1-a921-4164-8629-1c0c58bc2363", "value": "7500fe056cdc0244aeacb4edd8b73fb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411fb5dc-44d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693138891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138891, "uuid": "b531db72-868f-42c8-bfd2-465da294f2cb", "comment": "Malware payload (Amadey)", "value": "b36a5945e5b43601d1fd06fafcd6f12d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138891, "uuid": "a9b0a741-3fbe-4bc8-bae5-c8a8ff4de614", "comment": "Malware payload (Amadey)", "value": "60fe75748ce416654d0992610b85fad9c450dd0faa0f8818a72377494ed286e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138891, "uuid": "32e740b7-8cc6-4284-912c-a5b9101b09b2", "comment": "Malware payload (Amadey)", "value": "15da3953cab38605e71806808968705f74a1d02a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138891, "uuid": "8e5645f9-440d-46cf-a862-63821aad3c89", "comment": "Malware payload (Amadey)", "value": "d0f533886f78d19054c21a3fdf1b3e0306afe98db19bd87e91f8c361475a5a7195d104f1b19608038a21cff83e02ef0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138891, "uuid": "21ce9e2b-0e1d-40c3-9398-93e7314ac2fb", "value": "T1851523527BE49AB3CCB22B7055FF23430B317CB12978568B1385E45A1C722DA98B573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138891, "uuid": "ecefc368-4069-4ac2-8b5c-63ee1b6d17e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138891, "uuid": "deadc519-8df8-4579-bc11-ad3a4ac316ac", "value": "24576:wy82QdgiOpmDYH/yxggKk04amGM0ogFa9:38t2mDi/yCZCtgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693138891, "uuid": "427f5c57-678d-462f-8599-bb71ded2ca9f", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693138891, "uuid": "70fd6255-d626-494c-b409-368bf6acc58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138891, "uuid": "35016ed7-5cc0-48e7-93f7-c919a415a6f2", "value": "b36a5945e5b43601d1fd06fafcd6f12d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a002ec2-44c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693133778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133778, "uuid": "718e8f85-8843-4282-b318-6c6d990a4fec", "comment": "Malware payload (Amadey)", "value": "8b2482d6c64496e345aec498aca7fe44", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133778, "uuid": "48c1e289-ce38-45a7-95e7-40504536df04", "comment": "Malware payload (Amadey)", "value": "61af867d68aacfa7f83ed71910e161fbe5ad24578a614c3356228f3e5e9ad2b0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133778, "uuid": "695dbb94-667c-4a28-ba1f-a0721a954107", "comment": "Malware payload (Amadey)", "value": "5b1bbf10f68d1cc507759885f19b58fc36dbb3ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133778, "uuid": "f56c8431-7558-4c9e-8e8e-288187a4cf2d", "comment": "Malware payload (Amadey)", "value": "3bb3e25a7e3b514fbcd55ddca5405c6fce60c3a7b3646b2690a69c5b154b07ae6b6a925ae704a8c5a705c60ca915995e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133778, "uuid": "863d0e33-c3d4-450c-8d5d-c30d3dca294b", "value": "T179652317D7DC9072CCEAAB7429F707831E71B8A11E78075633A39E066D22644E8753BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133778, "uuid": "56e69697-9195-44ab-ad06-cabd5a63eedd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133778, "uuid": "3dba372b-56f6-449f-9355-9ed7e9eba8bc", "value": "24576:TyG9N0hwwfbuoVTH7IIXiKj9OrqSkEGsTID5rLsyjYmZUjfZ1BbDDsUhvgLZkrVS:m0N0tfbHTH/yKj9OmZsTdyGJ3hlgLWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133778, "uuid": "af13d56f-bc5c-47ef-9e3d-e1bf607e9712", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133778, "uuid": "9645eca5-b07c-4d9d-bf4b-2af91aeccf24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133778, "uuid": "b7e61e49-17a3-4d21-a2db-b5e1bd2f15ef", "value": "8b2482d6c64496e345aec498aca7fe44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006adebf-4496-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693112153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112153, "uuid": "d8b69e81-7828-465e-a418-2223a5d9d334", "comment": "Malware payload (Amadey)", "value": "cfb33b32d340268b8483e661596ece23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112153, "uuid": "0ead80e0-a546-442f-8a17-a40a4918e70b", "comment": "Malware payload (Amadey)", "value": "61e69a8bb5904c8d9d6f2d50f00a7255485c392d1f4b59d428a441d06a1642d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112153, "uuid": "3d8b95f2-2c92-4628-8e71-f167d9068989", "comment": "Malware payload (Amadey)", "value": "237b756e843c21afb4242d07d371971a323ee5f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112153, "uuid": "009eb83d-b43e-4295-b0fa-3e721fc5c2d1", "comment": "Malware payload (Amadey)", "value": "cb117129692bac512d6fa5b446a01277b81e774277b621043c4c26cb896e97eec2b81714d985f81523db6de3f8d532e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112153, "uuid": "f233d31f-9a85-45dc-9b24-ddfdb91db846", "value": "T1A365230277E91023ECF95B708CF617930A357E948CD9072667A5AA7B0D72784E173B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112153, "uuid": "854a6a73-f4ff-4073-9f66-91f706302f2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112153, "uuid": "1b181db8-3d92-4b6f-87fe-0e3f55a4d5c8", "value": "24576:kyYg5T1MDsbW8Kxmb2QhJCH4jKUBxHVOR28ABlHl2sauWScKEHNUyrG1RN7tIc2I:zYg5JMIbJN2QJCAKUBxHVORHPuvcxfGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693112153, "uuid": "9423469b-03b6-4649-9a03-1f5ee3e75609", "value": 1492992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693112153, "uuid": "412c40df-16c5-4332-8c9a-5470c413481c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112153, "uuid": "d159d24a-0dc5-4452-9724-7dbbcda70c66", "value": "61e69a8bb5904c8d9d6f2d50f00a7255485c392d1f4b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87e05d2-44e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693146392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146392, "uuid": "c62c6d29-30b7-481c-b720-47b86294e7dd", "comment": "Malware payload (Amadey)", "value": "132e760c951be9c00126b381826a6149", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146392, "uuid": "35e8f8ed-0861-4c3c-a147-085041c1cff7", "comment": "Malware payload (Amadey)", "value": "629816423cc645f37778245468c47f3937a52c10df3ea68c67ccc6394d91787e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146392, "uuid": "ed9143a6-2bec-4f1b-9442-1a4e5459e59a", "comment": "Malware payload (Amadey)", "value": "a6ae1698d17f2136699979489ec6a82045a18e8c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146392, "uuid": "33169c2a-37a5-407b-80f0-cbcccb155ba7", "comment": "Malware payload (Amadey)", "value": "f579402530bcbcbf8e3d9142336870244539db192f92e491f4e3e7b7aa1e3ac96f288fa78837226fd9e3ce6893479de9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146392, "uuid": "629cee20-68d4-41d0-911c-2adc5ad63139", "value": "T103052215B7E88877D9B9277129FB13830A3A7C628C71D3273356EC9B09B2298527135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146392, "uuid": "fbaa0d6b-ff75-4dd5-96da-55ff300ed0af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146392, "uuid": "5641e17b-ab37-4c8c-9abf-9ad8ed3f70db", "value": "12288:RMrUy90PnxLQLgQeQxtm23y/g5zW1gPdQDvXHBATDdnz58gJFguDJIVK9eTSZMWV:ty4x8LZxWgnCUNBzDJIhieTId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693146392, "uuid": "6545ac45-58a2-4897-bfb6-6e9b4c803b8d", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693146392, "uuid": "6dcabe57-de8c-446d-9d25-bbbe17bbc8ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146392, "uuid": "00690b09-5ecf-45a8-a3d8-e410da07c9fd", "value": "629816423cc645f37778245468c47f3937a52c10df3ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a232b236-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149361, "uuid": "0e9e7033-58a3-441f-a4b8-3ebb02481036", "comment": "Malware payload", "value": "24727a55266ee8f79e16d00454c7c701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149361, "uuid": "b9d9f0f5-2735-4489-a2e8-917a9bb3d6c7", "comment": "Malware payload", "value": "633cdd39c6568bb6285cb1d18e184290558947013a7bba4b6be8ca999ba4d074", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149361, "uuid": "ff86cb95-6e8f-4fdc-a676-9bf0c22c6db0", "comment": "Malware payload", "value": "e139efb0b15b95f3c21db51b2251b701e54735fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149361, "uuid": "4873e770-3c4f-4f82-9be7-1cb9ea0de175", "comment": "Malware payload", "value": "e0d9a25b567b5fe954987d7b7286f02da20644d6f4c7842ce8fffab99d2deb5c2d9f16489781e60cbcf8dad52c5bc1a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149361, "uuid": "e7c382bf-fff0-44e3-b410-cefaf671a506", "value": "T1F9C3C517AB61DEB7D81FCE3306AA4501108DE14652E97B6FB2B4CA6CE74B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149361, "uuid": "5bf197d8-4f2a-4957-866a-d98a8fecedb8", "value": "1536:Y/eTSqoVbv27X/T9MVmpZx36b059MvJiXC1oymcLL24OdiaF/+gUmkigFxfC7cgQ:YgoqT9t5moaTLuieUmkigFxfKcgnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149361, "uuid": "fd9ddece-cb5f-4d89-8715-b5cce7236aef", "value": 121966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149361, "uuid": "359c97f3-57d6-4555-aa93-626d3714b807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149361, "uuid": "19e68776-8726-4990-a013-1d29fb2074e0", "value": "24727a55266ee8f79e16d00454c7c701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ea724b-451c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169792, "uuid": "e897dced-efc2-4eb8-b226-88fbaac2bb1a", "comment": "Malware payload (Mirai)", "value": "94fd00b06d0e600d8d506b1e75c18510", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169792, "uuid": "f380a636-af8c-43ac-b3bb-7cd8e74c3be4", "comment": "Malware payload (Mirai)", "value": "647d86c62c1e3a3f921689ed716c6d6a974eb0bfbf1fcf18cf3ca457fdffe8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169792, "uuid": "0969adee-dcf5-4844-9b41-2c290618e3a9", "comment": "Malware payload (Mirai)", "value": "78719f33d1db04089d6b55ad2f3006ba5a6fea79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169792, "uuid": "cb542d0b-ddaa-4aba-8bdd-1d7b7a71b39d", "comment": "Malware payload (Mirai)", "value": "d55648c2cc6fb5a540d69a0bd5616086d95e189e439a3a6438b637e6a9b820a16a34937b17dac7b4bfdf4090aaf7584e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169792, "uuid": "d3ef78b7-059b-46c8-ab5a-d105d138752f", "value": "T1DA735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169792, "uuid": "3d73017f-a44b-4919-95b7-a33c2aa4f597", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws83:YwfdNu4cmZvFqI3w73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169792, "uuid": "7531fff1-6460-44af-a01d-e6371fe20cee", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169792, "uuid": "bc49b96d-7c20-4c05-9136-182cad07c044", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169792, "uuid": "0cba7137-3eb7-420b-8904-2630236962e5", "value": "94fd00b06d0e600d8d506b1e75c18510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf9bdef-4492-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110644, "uuid": "d1f639a9-92dd-40c1-a52b-c7da27208cc3", "comment": "Malware payload (Amadey)", "value": "2663e8708eb182fa9dcc9fa2661d1cb3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110644, "uuid": "20b5b807-da66-4075-97f7-dc86dadd83a6", "comment": "Malware payload (Amadey)", "value": "64a0da701afcf800a58c0bbc86d01d0f1079cdf9e936c27545f69e818ae5efba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110644, "uuid": "38054321-15f4-42ce-8961-ee1b7189b317", "comment": "Malware payload (Amadey)", "value": "685814fb339028f39e8ec120b936bd1b0498eb19", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110644, "uuid": "2b1b0329-4e85-4806-982d-559f3110ad50", "comment": "Malware payload (Amadey)", "value": "09781f6f3b85c1ff8bdf1ba1b9e7a6ca8ec19aa6571b2312ef699807fcb14b4a3ed9766a36c269e9201f693e8ee6907d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110644, "uuid": "00611ddc-fcca-41d5-af54-449673f69e3f", "value": "T123652346D9D98422DD602B3025F317930B39FDE29DB9835F138A458E0DB3AC4E935B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110644, "uuid": "4393b7be-c548-4e0e-9c92-4ac0624f96bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110644, "uuid": "36a79a59-a929-4a3e-8373-c50f939302b0", "value": "24576:Fysms2DI8ZreWlWzLKAbecDh2TvrTGT9PO5ctGY8fWNLIY/KoIvV/V0IVTmNb+wa:g3DI8wWlWzLKAbecDErTS9P7H8fWNLIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110644, "uuid": "d101ac23-374c-4471-b6b0-4322808bb554", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110644, "uuid": "d55ed0ca-d2e5-499a-9655-803bd487cd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110644, "uuid": "9a2dbe69-5704-4294-9e9d-5a6e5dab58fe", "value": "64a0da701afcf800a58c0bbc86d01d0f1079cdf9e936c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3316981-44b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693124157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124157, "uuid": "f6b2a0c4-5442-4bb8-8414-8a75f77fc2ca", "comment": "Malware payload (Amadey)", "value": "5e43a2f9583626f62d6abe6c2c7fa881", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124157, "uuid": "eb026503-2356-4dca-b0d8-3a4a3fd0c911", "comment": "Malware payload (Amadey)", "value": "64eb1f8ace7e3f3e29f096388ad953bcd409e7fad28e2ba65d5beffcb5918c93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124157, "uuid": "95148892-0fe7-43e0-a70f-7034a42896fc", "comment": "Malware payload (Amadey)", "value": "15346b1d20800908bec5b8b4b3d70390b3948d7c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124157, "uuid": "93160f10-49d3-48ba-ad58-003f0559e4ba", "comment": "Malware payload (Amadey)", "value": "8a1b30186ad436b0e806dd7d914e61b6da458f40173987c564dba3753f5aacad56d48a6e43e7d0ea0f781ddc80bae2ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124157, "uuid": "da4743c6-825b-4741-8754-b9bcb2440edf", "value": "T187052303E7D85533EDB1273424F616530A393CA15CB6632B5289E99F1C73A84B932B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124157, "uuid": "b9323082-15f4-4057-bbf1-3df0ed76dbac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124157, "uuid": "00851686-e154-4cc9-a9b6-9dd8e0326f94", "value": "24576:nyU8MGxMWpmvQ4O+RSjyqOEpoHMcZ9kL7NA4Z7dDhRa:y4gjo44O+RmqEx29knNF7ZhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693124157, "uuid": "a5263b53-f295-49ed-9eb4-0c79f5303c5a", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693124157, "uuid": "2a80d2cd-2ea1-4e95-a37a-3be81a081333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124157, "uuid": "a8b8f68d-817d-4d6e-9e1d-50a4e40a9ad0", "value": "64eb1f8ace7e3f3e29f096388ad953bcd409e7fad28e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846cc78a-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121394, "uuid": "3b44112c-88fb-4841-8262-da53f55241c3", "comment": "Malware payload (Mirai)", "value": "c3319d9333fc6826f92f697b339e08e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121394, "uuid": "908ea8a5-68a5-4384-a0ae-9b6f0bb789d9", "comment": "Malware payload (Mirai)", "value": "65630f2c47ead4f73acfd3cd723da0464c49e879c02e5ba840bb09a86d9abfa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121394, "uuid": "651cc6f8-7108-4c27-9b52-a6b0329d2c11", "comment": "Malware payload (Mirai)", "value": "92e0085f6f728653b2299cb6b9fe5848d66bcab4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121394, "uuid": "5b307bdc-6967-4444-8e18-118a1bab76aa", "comment": "Malware payload (Mirai)", "value": "f302d1f22452d944c90c40f682fd61c7bf1e1b43d28fd0dfcb0d1738a77f33fd28a29c98bd20b45e2a6e6dad93cf5ef0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121394, "uuid": "f0be187f-6037-4f78-9183-d0fc114fe496", "value": "T125E2F297D372A452DE782AF2F5A984CA6BBD4BACD27730B316015A182D9B0435B3C4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121394, "uuid": "49af5309-b9ea-4dbd-aacf-a0e4be0cc45f", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XcglO9q3UEL5Im:1orm1vpALgUJrlzLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121394, "uuid": "7d81ae3d-0631-45c6-9bef-47fca32ff5e8", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121394, "uuid": "cd5d91ff-28fe-4c72-9ca0-bb06e2d4cdc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121394, "uuid": "592e96f3-3257-47f1-969c-d908886f1043", "value": "c3319d9333fc6826f92f697b339e08e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754c2a8d-452d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693177203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177203, "uuid": "716c75eb-6cec-4438-aa76-da5a1033bc81", "comment": "Malware payload (Mirai)", "value": "7d516376e24957fea2a4dd7f61704553", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177203, "uuid": "e0ead341-e8ed-442f-bb1d-8b0102d80474", "comment": "Malware payload (Mirai)", "value": "65d8e100ef23141b8cf296fb3d2b294900bbdfca6ae8081b9b55b849725a7edc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177203, "uuid": "fcadd95b-9275-4025-8269-7e01227e28b3", "comment": "Malware payload (Mirai)", "value": "4732fda7f304bccf6b21a3381a70269b6c56ca56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177203, "uuid": "8e8853f2-caa3-4ed6-8a0a-020de83381d1", "comment": "Malware payload (Mirai)", "value": "baed3b88cad0312dfccbbc884ab0a4ba501f6c29d7255f8ecbfca7ec73bd9090ae08a30f5429ec3879dfcd3649b0134b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177203, "uuid": "8371a115-d44a-4b39-850e-c8d1accadd03", "value": "T179434BC9A6C2F8F3FC56117D907E57B25A33E4365079CB8AC3E9A432D82A501E31769C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177203, "uuid": "f707e884-4ab7-4426-8a88-b1763311e22e", "value": "1536:Kn+6DzH01HHjv+nAMQounJv6IEzhUO3Q3dSB:eU1HHjv+AJo8v6BGOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693177203, "uuid": "dd98e855-92b0-457f-85d1-1be0384ce4c4", "value": 59636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693177203, "uuid": "b29229c5-cb9d-4ab5-af55-4649f1686da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177203, "uuid": "708c0ebd-8319-4752-a2d0-5237fd87caa1", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5946d12-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149394, "uuid": "a8069c0b-168d-4ee7-91ea-30dc199d617a", "comment": "Malware payload", "value": "4aeac28ccd7c0be2061bdf89d4795fa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149394, "uuid": "f4b99d5d-413c-4439-9135-507ac415514f", "comment": "Malware payload", "value": "6604e6ee7466c466d08dba5f1576139ecf2ccf0a66a09ad6f55da38ed935955f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149394, "uuid": "6ba3a76f-2b85-45a1-b56a-df85b04de0d7", "comment": "Malware payload", "value": "e1aa2b289ecd6b162d54c73791e76a5b651c5908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149394, "uuid": "67fe2961-a858-40c3-ae91-57edf0c19fb4", "comment": "Malware payload", "value": "c7dda05722ca1085bc012aef8d1e7777f34c500a93cf873e103da2836038fd0ef5e8da7fd8c1b8a112d7b3ebed00ede2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149394, "uuid": "9d8ade42-3b73-492b-9f1a-66b77ec5c5ec", "value": "T15DA31A41F9418727C2D237BAE7DF439D77365664A7D733016A386EB42BC5B8C2A3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149394, "uuid": "ab291491-20d5-49f2-8104-1f9fd39309b9", "value": "1536:v1rThJkHYdjfvrekyc+CWMxtOoy9XPdI1p4LM4cYmRiqQ4b/XAhhIQ:nJQYQkVWM2XPS1pKM41mRiqQ4bvAhhIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149394, "uuid": "b2aa50a4-3bfc-429b-bd00-44aa3ddeae1e", "value": 97955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149394, "uuid": "5a72ead4-5549-4de7-b36a-c0dd76670e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149394, "uuid": "58f2d707-4352-4de8-9d5f-7ec96f81a8dd", "value": "4aeac28ccd7c0be2061bdf89d4795fa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051fe01d-451e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693170573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170573, "uuid": "651994b5-7740-41c8-81f3-f22d6b52a832", "comment": "Malware payload", "value": "c85fc1019c919b3908d53ad494055eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170573, "uuid": "8a8358e8-aca0-4e28-b74b-a0e1a3a30768", "comment": "Malware payload", "value": "66af8d820e8bfffba8b57cc480ba2b922bdd67b1ffd1fcfc6f2512dba35c9ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170573, "uuid": "e9ad12e0-c7e1-42f9-9001-5bdeb995960d", "comment": "Malware payload", "value": "69544746fc6509d76532e7bd9cb834542c463535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170573, "uuid": "b71f1d05-5c85-455d-839d-0cad16608a04", "comment": "Malware payload", "value": "e2ab7c2c488ca2d8689fe0d3a5ab35a1fe48a1bc5c1c09d05a9fe2e84bab5dfc35a4bfcac9b276a7aa133b3dae4baa90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170573, "uuid": "17722a51-3b05-480e-835c-3ee247a9a90c", "value": "T106056D95F292FDB9D949877404E31329637AF0809319EB3F3624FF38095BA849E73619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170573, "uuid": "b7fa85ea-1cc7-4a10-a099-d5d8205ec5f8", "value": "2c703405fb0537fcd8815cd35526211e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170573, "uuid": "c4701512-fe18-4e7d-b230-4a164d50e493", "value": "24576:CxCd/kaCUc9Fd89fgOfzScpL4h3o3W04G:AgkaCUIFd89fgOfzScpL4u3W04G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170573, "uuid": "813aa4e7-fa77-4d56-acd0-6220653c954c", "value": 800171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170573, "uuid": "e65ab2b1-c6be-4ecd-a765-2ebfac18b960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170573, "uuid": "85775640-871e-4325-95c6-17b18d4ce3d9", "value": "4688982 - Archive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8103ffc-4481-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103415, "uuid": "dfdebcc3-3bc4-4436-8f88-b48eda8dc190", "comment": "Malware payload (Amadey)", "value": "670649aadde1ec1daccfb0003ea2133f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103415, "uuid": "40c31c09-e33b-4007-9b5d-de87a19893f0", "comment": "Malware payload (Amadey)", "value": "671fd7291f684ef6d1d0a29b6bbc39f5161069ca1652740d26c87e9e1141bb06", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103415, "uuid": "2f0d63b0-4fa3-46d8-bd8f-5e9d73fe3f5c", "comment": "Malware payload (Amadey)", "value": "b2237e50886e6781d49aa85fe0099b642ff47f8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103415, "uuid": "c89c7fdc-8385-4187-b26f-af5e12d51fa9", "comment": "Malware payload (Amadey)", "value": "f7f1df9df0e0a16e99df5d221ce617b3cb3b975a7bea318627444b0b2f12120e29a878a939dfa798b2acb774aad34996", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103415, "uuid": "ec7068f7-e6ad-43d1-b07f-5ada65466748", "value": "T14EE41242FBE58433DCB56B7488FB03C31A317CA05D38526B2395685A0C72AE5A97B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103415, "uuid": "a377f1df-cc97-413b-8cf3-4499edc60366", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103415, "uuid": "1002d38f-de7e-469b-a0fa-13622acefb6a", "value": "12288:VMrzy90w8bhSL/b1OCW+vfk30UoXmtzu6J6826IAueNoPZKJFZ66cEp7:yya4jkCpv921z2LYoI66cEp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103415, "uuid": "84b5e0b6-2323-46bd-8485-848233f2e4b9", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103415, "uuid": "8a629b50-92c8-4936-811f-171356051c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103415, "uuid": "aed8724a-7642-419a-83a6-8c6f47d17660", "value": "671fd7291f684ef6d1d0a29b6bbc39f5161069ca16527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c763de-4486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693105524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105524, "uuid": "de6180b1-7bb9-4e28-a9df-2c90b36e31b7", "comment": "Malware payload (Amadey)", "value": "0a5c96faf2f9692cd61acd87c4a8904a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105524, "uuid": "a297409e-aa51-4914-969e-61a514ff3d57", "comment": "Malware payload (Amadey)", "value": "696d56ece02f86a544b46d6a9395f2e817c93be972d0c57e7a16da35523a5b8d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105524, "uuid": "40d63247-e141-447a-9ea2-ce7c02a8daa1", "comment": "Malware payload (Amadey)", "value": "5bb618b80eac7823b0f32be3f75c804a2568cc5f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105524, "uuid": "1e06b9a7-195e-45aa-ace9-14724f0b9028", "comment": "Malware payload (Amadey)", "value": "4d1476c0caf149776c0e7a4bd13adfb612f73fcf0aa9ada9fdf5180e71169bf086ef7a7565825f924e85d19e8b4c96b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105524, "uuid": "a391a6a9-3b8d-494e-8820-8bba0bf05258", "value": "T124E41202E7E89075E8B45F702CFA02D30B3BBCE14D25D35727A6696A0DB2AC054B537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105524, "uuid": "4aac6b5a-7ee6-4fe8-89e2-b29589c9e332", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105524, "uuid": "d47256ea-4861-4b05-a2d8-d7f6a1626a58", "value": "12288:9Mrmy9093T08Ofx7hR0rJ1sLZlJYO7L/zQSZxUAiYSdarAkyH:3yG08Opd+JuLlb7DzQ4ibagH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105524, "uuid": "66516bbc-f426-456c-b175-414b77760bc7", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105524, "uuid": "0679212b-e873-414b-a4a9-f8cdf5511d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105524, "uuid": "a4e45a16-4f04-4a37-ba1b-65622792d7ba", "value": "0a5c96faf2f9692cd61acd87c4a8904a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff23ef0-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693178053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178053, "uuid": "cc805021-0e0b-49b1-9244-924b3cb7e5d9", "comment": "Malware payload", "value": "b81bb62a7e2598f19ec164e5132f0cbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178053, "uuid": "6e1070de-76dd-4e37-89a6-63147bf43c1a", "comment": "Malware payload", "value": "69c9f593ff6c5a4d4ab80f73f633c951cb72909c033ad024d0ea1cce9ee1b80f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178053, "uuid": "5e99c2b6-2db1-42c9-a6c0-791d7d1f12b5", "comment": "Malware payload", "value": "b81572234aa9faf460d2ea6a693b18108cee2ea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178053, "uuid": "02920ffe-8734-49fd-a8b0-4639e65e4e60", "comment": "Malware payload", "value": "fa047508605cf19dd812c7a52af2b5a1c1dcdc52ee1cb0d87fc8f66cb63dbfacb2b04b5b37b33096bb9b3745a2f27553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178053, "uuid": "8512845d-1b19-403d-88fe-f84e2c6825a6", "value": "T196733B8AB8806B11D6C155BBFF1F114E33138B6CE2DE731299245F60778B96B0E3B51A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178053, "uuid": "67e50813-dfaa-4c59-abc7-07bf48fd4877", "value": "1536:ZsnbzjGN/owf3+WbH6PqJw4baaXaWiBCyd+ic0XaZBzG/78g5gYwq:+Gqwf33m94baaXF0KZBzG/AgGPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178053, "uuid": "f1d16cf5-0287-4fbc-82ef-8a060f9cfcdf", "value": 79888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178053, "uuid": "a5055472-4834-40f4-90d0-492a36b2b096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178053, "uuid": "cf1ae241-49c9-431a-acee-ea57917a6381", "value": "b81bb62a7e2598f19ec164e5132f0cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc42c6b6-44bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693128360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128360, "uuid": "b8c9df58-3f89-4470-85dd-96eac1551dca", "comment": "Malware payload (RedLineStealer)", "value": "5ba6fb2c3a5d0c2f232a2e904619f60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128360, "uuid": "aa478076-03cb-49da-86ad-c83d52829868", "comment": "Malware payload (RedLineStealer)", "value": "6b39d4f9844e8d8d555eacdc2803518256537fffa17c1f7af32cacb49dafe97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128360, "uuid": "e7b48abb-a980-46b6-8c63-f60d2c3a376e", "comment": "Malware payload (RedLineStealer)", "value": "cddd02d63a213f74ffc91b088a0dba8765e93397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128360, "uuid": "d9200ecb-0cb7-45a0-8faa-061accf8840f", "comment": "Malware payload (RedLineStealer)", "value": "548ccc025357f56d01c18fb6fc242f9514627f3fcf47d72bc0d6fe78d53add0975d1c8459c0c2bdad065e3d6278b6be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128360, "uuid": "8274dd0f-4b8a-42f9-b1d2-aff32a7e7ae6", "value": "T1BE052212FBE89162D8742BB558FA01A30A3A7D701D74575F23866D9E0C73AD4A93232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128360, "uuid": "b7a98cc7-9d94-4918-bd44-21d8c2ae465a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128360, "uuid": "3309d1dd-c0ff-46ce-b7ca-cfdc3104e27f", "value": "12288:4Mr7y90m7S8aommRvPjJMS7PY5ewkt7sqQtlQPqh3BoCaMmo1BrmMmnJZQQ79E3c:Dyz7AmlPnxwUAtyPq3BolM3/KMUFqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693128360, "uuid": "163beb89-68b5-4ec9-9c06-a2607fba5c1e", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693128360, "uuid": "00f807eb-677a-4da8-95fc-24b188a9d8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128360, "uuid": "b202bead-ebda-4268-a83a-fcb45a4454ba", "value": "5ba6fb2c3a5d0c2f232a2e904619f60f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceab9d8-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169405, "uuid": "9719f010-2063-4ce2-9ce4-9ce47a429b22", "comment": "Malware payload (Mirai)", "value": "2d69b8f66b47b8a121fccabf081122ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169405, "uuid": "53d92670-5f71-4c34-9e05-da039ab124da", "comment": "Malware payload (Mirai)", "value": "6bd5b5620ab83898c420cb4d356779a88d39719df1cb3af03d06da72eee9665f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169405, "uuid": "f5599826-77c4-46b9-a976-8c46140585ac", "comment": "Malware payload (Mirai)", "value": "49a64baee7ea6a2390f524cf2e134593287dc5f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169405, "uuid": "7efa3757-1b35-4dfc-b23d-379d855771d4", "comment": "Malware payload (Mirai)", "value": "35f2bcca58fb581d6bb2e01fd4a7de41d3e39bd832db28e6ec7721c5d05a6a50e3c22d382eafcfeda4331c70df8d75b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169405, "uuid": "bab042ab-32e1-4d3d-8904-25c74b5f80f9", "value": "T1C83302632B6E2AE152B04777FC33AC0A669C17F85C6730DA2CF0A91577C58065EF2683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169405, "uuid": "98ed7752-6bf9-4728-a746-16b228ce209f", "value": "1536:d9O/ZMAXIxNUk0YLcPqF1aBexo4opKZbZ:d9O/ZNKy8LGqFUFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169405, "uuid": "bcf56524-6540-4836-8cf1-7bf669f2ac2c", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169405, "uuid": "d2d251e0-5c51-457a-bdd1-b8ced6cadf6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169405, "uuid": "74c70601-164a-4013-b899-61c349194c0a", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e948d5-44c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693131671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131671, "uuid": "0885c7bd-2341-41cc-9b6d-09591546f6d3", "comment": "Malware payload (Amadey)", "value": "369432f895c3156b9c9d938ab7694c0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131671, "uuid": "3b209bf6-e4c1-4032-b6cf-fadcf46e87b9", "comment": "Malware payload (Amadey)", "value": "6f6f9e5a991267cb340fd49fd23dd4fa1e361af186b9a3ce55a15c4c9f227434", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131671, "uuid": "dfedd623-92c9-42d3-a354-10cdf05b0667", "comment": "Malware payload (Amadey)", "value": "d2ee9e9ce38ce69cca0e8d2603c3b545db4eb2c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131671, "uuid": "324e2b64-917f-4045-af1d-1cad78c23f7b", "comment": "Malware payload (Amadey)", "value": "fe76f5add3eb8da961de63c557c77023540cbeb325e0f95c49894237c180aca85b6f0c20e40d7f0967fbbd4889e97527", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131671, "uuid": "756a688e-875e-4b60-a618-4cef70fd1def", "value": "T13165238296E84073D9A6377028E316D30A35BC545D39223B2B9AF86F0D73694B53D73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131671, "uuid": "1698a9e9-851b-4aae-8314-1a662cf9bc2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131671, "uuid": "ff1efc1e-46c6-440f-972c-c3bfc1ba75e2", "value": "24576:WylRPZ7OjWkBEm7FQKzX+dUVhM8e3cMzsPBRTZCQObF/LVaCG8+PUN2:l17eWkBEmhQKzX+dUM8esBPXZCQObF/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131671, "uuid": "e0c05497-f7fc-42d6-9e0a-e90b0e251bd8", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131671, "uuid": "c1e7a37b-f4ef-4c9f-bca4-0cd6fa0f3534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131671, "uuid": "477465fd-c843-41fd-811f-5e4860f18b1d", "value": "6f6f9e5a991267cb340fd49fd23dd4fa1e361af186b9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac2db17-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148195, "uuid": "a466c7c3-13b4-4ebf-899b-612b193f4c46", "comment": "Malware payload (Amadey)", "value": "3219503e6eb51726bbec49813e494e10", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148195, "uuid": "af364c4d-3026-4127-bb57-0c29e5dfb2d4", "comment": "Malware payload (Amadey)", "value": "704b9cccb59c9005337d1574de9bfe4d4f63d6b0efa53ba0142b3573ce807b66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148195, "uuid": "aace1b43-0297-411f-b87f-82dcbdc2ad1d", "comment": "Malware payload (Amadey)", "value": "d67a6b55f711bc3027282602365dd7ccb946cea2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148195, "uuid": "ffcdfc5a-0ef7-4dc8-bcef-627503aee145", "comment": "Malware payload (Amadey)", "value": "0522a1224d622beb2880279ea7b40ccb66b32b464c1b82e5113db1452dd3fba09d3f76e211b4111c5dcb32fc4c14a764", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148195, "uuid": "d2842f21-6848-459f-83a4-6697e661e9c7", "value": "T117052216B3E44133EDB623B009F60AE3023D7D959DB8536B1B5AA98B0CB27D02576737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148195, "uuid": "10de5576-9e9b-41ed-badf-3af7f2f3aafc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148195, "uuid": "0f555fbe-d1bb-4f55-a0ad-8bb2a09c7f28", "value": "12288:QMrIy90C4B2LFAb/PNKphSHmt4n2HA+n0h9I8cQYQUN6LU7NkqezvPbPyyZt1zbe:Iy3G2LFcmt62HFn048/rGknbzPyFvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148195, "uuid": "0e826761-3fa8-4784-990a-397c015a2f10", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148195, "uuid": "2f7490b9-bad3-4fae-b9b3-88401a6f32c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148195, "uuid": "5a453ea9-1864-491a-a630-9cd8f5967ce9", "value": "3219503e6eb51726bbec49813e494e10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65f96c2-44f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693151945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151945, "uuid": "5ae44bf9-b884-4254-b21f-b51612184e96", "comment": "Malware payload", "value": "2d4fd05bdccee76bac5231cfa4da5130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151945, "uuid": "c44f8938-0e95-4d41-9f4b-d59d8f8674c0", "comment": "Malware payload", "value": "7083e4774a68e23dd2f9239e5108f6615ff945a0673e7e975ab2ca2d4cb297d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151945, "uuid": "c51ccf50-92f1-4b03-abb8-9e7b111b09c4", "comment": "Malware payload", "value": "44589ad8fcdf386aaaf5cfeaeb917bf3f51f6fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151945, "uuid": "5f64a0d9-8e1b-40bd-984d-2d207cb4c76d", "comment": "Malware payload", "value": "c9dadd401ddae9c1eea0bc60bd8ab0b3f8ed3489e8ad2be3a443572cc3f9bad45557a5992bea73c9587298de66d6b233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151945, "uuid": "409a4c7a-4bc9-447f-aeae-7e72c9488549", "value": "T12BC5ED44DA4F12D4CF692EA7216BB72F63045931EC77CC8CF8592883745BCB4149ABAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151945, "uuid": "fc4b9579-afd7-4d5a-bbbe-f4d2ad59ea8e", "value": "5fc71b291b4cc66f107eae1b9c82ef58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151945, "uuid": "5b38c5e7-84f7-4cbc-b6fb-c8124fb34a45", "value": "24576:f9pwADGez1Y0ve8Q7SlDhJD2/m/2Kq+nirnycpw0SrkrO:1p80v/XDhJD2/m/2Kq+ijyccrkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693151945, "uuid": "c2d7706f-4197-4f1a-b6da-a45aa9f72d74", "value": 2652824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693151945, "uuid": "48e4baed-01f9-4b67-bf43-eea4852b5708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151945, "uuid": "9f00e8cd-db94-4ecd-b9a6-550c62360487", "value": "oebd595d1a23f36763e746f48750d171a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a05b3c4-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169454, "uuid": "a144b6d0-59dd-457b-a112-2fe9740c7275", "comment": "Malware payload (Mirai)", "value": "a3ac1ee107c8c174c24ff3dc6e3107c7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169454, "uuid": "5aaa9e5c-f8f2-4db6-9123-4e7ffe65aaf4", "comment": "Malware payload (Mirai)", "value": "7093788c96cf1eb24d0e2883c498fde515d2765c833448396812aeb07dbb53bc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169454, "uuid": "79d5cf16-8954-44ad-8912-4db4878aa0a2", "comment": "Malware payload (Mirai)", "value": "00d52525f15b272a67375922785993b0dfd01f59", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169454, "uuid": "409efd24-3328-45e4-be3c-7e005d54a1b6", "comment": "Malware payload (Mirai)", "value": "6a38d793c78ccd0bee6b671df97a2e8d200330dd6be26d56c3bf45c2c68a2608250e1adec9670c4169aee27aa342fe18", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169454, "uuid": "2c49c2df-ccb5-4ba4-9bb7-47024a36858b", "value": "T141D2E0E3E1BBA2B8D4F2B8B1386AED80F5D5307B8714435A40BFED85DAA734C1134A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169454, "uuid": "ee773a83-81ff-4880-bc0e-9008a20852ff", "value": "768:SYSoXdJZgicCHD+C98MP7L1YVPb2XhdSx0sq:SYJdJZuCj+CiE7L1APbah4tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169454, "uuid": "c8e724bb-b90e-451c-978f-b254855ad9e0", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169454, "uuid": "a6f31778-d04f-4a4a-8b39-1cb9c5517a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169454, "uuid": "8cbe7a5c-a790-4bd9-b06f-21b0770f7b80", "value": "a3ac1ee107c8c174c24ff3dc6e3107c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a9e267-4532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693179491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179491, "uuid": "c2c0782b-d3c9-416e-b1cf-6800922277cd", "comment": "Malware payload (AgentTesla)", "value": "5313d6e64482c697ea11c93b462cfc06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179491, "uuid": "c5610d25-908d-4da7-81de-4540e04c7822", "comment": "Malware payload (AgentTesla)", "value": "71e7dfba6cd94d1be1096f5d2ac0938c3bc4bedbe649f422eef44f9821f170ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179491, "uuid": "2878e2d5-39f9-4380-bf2f-7edd8ea206d3", "comment": "Malware payload (AgentTesla)", "value": "335505545c66a20f80729d9770c140d5e6a6fd6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179491, "uuid": "4d81e401-cb02-42af-b2a6-01da6615596d", "comment": "Malware payload (AgentTesla)", "value": "3f5fd736d4c740bd1a125a640f9cf244cbce9cd3c1d662742089ecfc26fc5d431c80ce6b53086021d4f61d271eb47190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179491, "uuid": "c8519ce5-8ca2-4c2e-84b8-84d9d8793edc", "value": "T13045AD03795B8DE4E3968773C59F94040FACE3417267C78F298A73D62C03BA56AC9693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179491, "uuid": "015219eb-3d0d-4ddf-8564-b32e24edd608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179491, "uuid": "b1515bf3-3a48-4dcb-aea5-9656ba45450d", "value": "24576:uHSddjJjiX96ehkq0/7Ac5KVMUvfGYbL4OuQdTKIAEThXU:J0VXfGYbEudRRT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693179491, "uuid": "5276d084-3345-4d5d-a696-0f602091f262", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693179491, "uuid": "b065a65f-f44f-4eb1-928a-a3b657eb7a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179491, "uuid": "04f24a2b-f2c2-41a5-b839-931ee57cb1e5", "value": "SecuriteInfo.com.Win32.CrypterX-gen.16916.25752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db621381-44af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693123258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123258, "uuid": "51f6881a-2f87-4d4f-bb29-4cf2e4da3110", "comment": "Malware payload (Amadey)", "value": "58b4124b916e73054acff524fb34493a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123258, "uuid": "c856bfb7-a3c6-4101-b035-21869a7e35d6", "comment": "Malware payload (Amadey)", "value": "73535d4d992bf86b98d83cd5811fad723fdead2fc12c0dd8e2c35f3741fd8f6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123258, "uuid": "18fef6ea-3efb-411b-9f50-b062d49d2411", "comment": "Malware payload (Amadey)", "value": "047bbb8a4d9d224fa4e2327fe42866d48436d95a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693123258, "uuid": "905f0eb1-f5d3-45ab-85da-9076a7c34b5b", "comment": "Malware payload (Amadey)", "value": "8adddf1e48918d1dfe0c23c9565f495218ab6731449baecdca3baf65ef0974fa01f2801be5a7b0dcbb84311428b8ffd7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123258, "uuid": "67120597-ccd0-4dd5-87f2-ef74c911334d", "value": "T1E1652347A6E48432D9A80BB09AF707C722367C661875C75737A9E05E1C726B4E83633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123258, "uuid": "bedcfef5-a2be-40f4-97af-e275aec8a67f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123258, "uuid": "7652cded-1634-4aab-b7d2-7a17c332968f", "value": "24576:ZyHN5cDwL/PwXvJZWeV77IrKleqd3Ap9JbMEMa8AsT67HZRbByCO5xfnb6TGQLE:MHfckkXZV7UrKleq12TMbr3WVdO55e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693123258, "uuid": "0bca9b10-cd4b-4ea8-9006-70b372b1c7b4", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693123258, "uuid": "078759f6-f9a5-46f2-b31c-4c0b0ab3296c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693123258, "uuid": "7e78cd86-1d3b-4984-bddb-f84001f9958c", "value": "58b4124b916e73054acff524fb34493a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d65a675-4535-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693180707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180707, "uuid": "61b67d1a-00f3-4dc4-ad15-476891da322d", "comment": "Malware payload", "value": "cc21de315a7f1d507a1e653a4e10ec8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180707, "uuid": "a866dbf4-5fb1-4ee4-995c-48d85dd57720", "comment": "Malware payload", "value": "74b6906f9f430db5a2c332db439956723117898e32c9e9397941598dd44a473d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180707, "uuid": "f9baafb5-75a1-460b-b5b3-2cd2c936a9c0", "comment": "Malware payload", "value": "9fbd0b97f6dc4598d0c9feed7963e1364946d9e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180707, "uuid": "f0e73fba-832b-4f5a-a07c-3c8899372aef", "comment": "Malware payload", "value": "332f856a92faa0df43d3ed3ddbc372a76d29ceb48406118d1a91fd7d62c8e2983f2e0ee44d21ae73f9eb67a6aeb826c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180707, "uuid": "0359d8cb-b7f6-479d-95f9-8e29ec692f41", "value": "T17FE2E507BB610FBBF49BCD730EAE6741108E5019B2947F77BA28D848B34664E1DE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180707, "uuid": "c0eff54e-7f6f-496a-8cc2-b8e362bd4577", "value": "384:GJBituvsisJKrcfl++Vo4ngsfFry4q06mdS/ZdpuluqAvlrHhJ0J6TBRL4x8CvU:4B32Ymzg4yB0MZdMilr3G6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693180707, "uuid": "1a72022d-132c-48f4-b55b-9eb5c820cbcb", "value": 32468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693180707, "uuid": "c03c0d4f-b719-48e1-b72e-d14eaacb84b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180707, "uuid": "82e8a0f0-5a74-4837-8d29-74a72e03736b", "value": "cc21de315a7f1d507a1e653a4e10ec8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdaa1ef-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "4050f20c-e5e7-4aa2-a471-40899927569a", "comment": "Malware payload (Mirai)", "value": "896fc023c41c945bfa20eb624fda2d96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "51dfae95-c48b-40bb-babc-ba3f2c067472", "comment": "Malware payload (Mirai)", "value": "74f7a9f9c9f9b6d130f3d98e6f176afaa3a6a66ad88a8c6fb5c0abdbfbc3d0fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "e807a6da-65ef-403b-91cf-5bdbc6423425", "comment": "Malware payload (Mirai)", "value": "81bad7d135e8801130eb75be50277135c297803a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169403, "uuid": "a41f7229-0699-461f-ba60-9ac93e7bca94", "comment": "Malware payload (Mirai)", "value": "8461e0f152ffd32eb650d4df9be78c2ee5689a3792e5b3ddccc1d0c37002fa0b2d5d603b9a03eec499cb4b9b43de8c99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "3bef4338-d56c-49d8-9fa5-2f93469f2728", "value": "T11E33027227AE29E291B09737FC33EC5A969C17B85877309A2CF0661567C58024EF26C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "77dccb6a-6c44-4385-934e-8f6b3f36b14e", "value": "1536:S9O/ZMAXIxNUk0bI+3LcPqF1aBexo4opKZbg:S9O/ZNKyXIELGqFUFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169403, "uuid": "7263c9a2-03ac-4006-83c7-e06c49eaf03e", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169403, "uuid": "9e3f6357-d697-4448-9d6d-a814e0bbd141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169403, "uuid": "10d3ecc6-06cd-4e1c-8298-65445a72a9b2", "value": "896fc023c41c945bfa20eb624fda2d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26824e01-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131974, "uuid": "f213ac7c-5dad-457b-807c-8d1c6c460b13", "comment": "Malware payload (RedLineStealer)", "value": "e538392decffa0f02fd89cea7abdce64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131974, "uuid": "01169bdf-5396-4b5c-af7b-d242eed20ac5", "comment": "Malware payload (RedLineStealer)", "value": "752a338a2f7230efdb447ffb0c711aa39b9c824b6e7ee0e232633b923abaadaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131974, "uuid": "0aeee9e0-02b1-44ba-8506-89788e5b48f6", "comment": "Malware payload (RedLineStealer)", "value": "2ba3b284f51c1e581fb741aa24ba6c172a3580e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131974, "uuid": "524399bb-8ee1-405c-b609-c72d77cd63e2", "comment": "Malware payload (RedLineStealer)", "value": "1bc1d539f42fa0305a46d8ed292b863adc6753918e4dfc331a3a397808de878a06fda3e2ed75fecbcd54a32d6c341912", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131974, "uuid": "c0c98c44-7091-48b9-8454-8c59ab965ed9", "value": "T1B865238276D54073DD745B704CF723C32F327CF1AC345BA62A8AA49B6DA2694B53234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131974, "uuid": "f782682a-dc72-49ab-acbe-91608443716f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131974, "uuid": "949e374d-9f69-4b45-8cad-4a8074b89468", "value": "24576:WyG+sBKi1ufgwDIZpKU9W7Wx2ilOqItaHNb109un3/uPNlMhYPgRvOM6YA7mMf:lGZBKic4BKU9W7WzgeB09un3/uczvmYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131974, "uuid": "4ca5130e-b10c-47af-a22d-24e508fc7a91", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131974, "uuid": "b47dff32-0c17-45db-9f01-4c015979230b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131974, "uuid": "db63a053-ae9e-4f54-95f1-506b4435e55f", "value": "e538392decffa0f02fd89cea7abdce64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7651be-44bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693128065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128065, "uuid": "d1e8c42c-aaa3-41ef-938d-8c41c15978e1", "comment": "Malware payload (AveMariaRAT)", "value": "a34e9d45482af9e20fca8c6e68908964", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128065, "uuid": "c730417f-605f-438d-8816-fd6e436af667", "comment": "Malware payload (AveMariaRAT)", "value": "75ff5e50641de3d87b26fd80cba3c73e2cadf6ee818e6c748a25399c457eb3f3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128065, "uuid": "b5ebfc6a-8f91-4a14-a489-012ee208c776", "comment": "Malware payload (AveMariaRAT)", "value": "8485533c26dcc7d2cc21a679dae316832ad2c59d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128065, "uuid": "167b4a3c-b6a5-4032-8a30-f9e42fc8ab34", "comment": "Malware payload (AveMariaRAT)", "value": "12aee5ea0111c1b6770af4c7c73e390030d2591f12f888b8a666560ccda169fe4ab9e0f40a94a438cb0476ede17a5c43", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128065, "uuid": "967afab3-de19-4401-86ec-0e1218346d02", "value": "T19CE37D227BE54439F6B706701AF83E25D7ACBE310E31CA4B5BD8488758B1589E9353E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128065, "uuid": "c7222557-112d-4b29-ba26-7238052b50ce", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128065, "uuid": "f5fb58d3-efa0-4679-8040-e7eaa4d00533", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHuYzHKG08Iwj:2dx3wqz3ZcDeDOYzqG0zwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693128065, "uuid": "0d9eb0b8-9e76-4621-86f8-266ea781ccb4", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693128065, "uuid": "365a75e8-44ad-4398-9354-b5f782e1aaa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128065, "uuid": "e4fb30a6-5ba1-43fc-abb8-2ee4f6ce0647", "value": "a34e9d45482af9e20fca8c6e68908964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134353a0-4525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693173603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173603, "uuid": "4d226241-463e-425e-85b3-888a06149c51", "comment": "Malware payload (Mirai)", "value": "7508be260edf3154649d0e0b099550fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173603, "uuid": "312b5f3b-5ba0-43c5-9c5a-4bb5e64bbff3", "comment": "Malware payload (Mirai)", "value": "76cbb6171ac66c354bea8211d5bc6a5c8d52d214a0f26898dfdeebe9eff9ee34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173603, "uuid": "92149268-029b-464b-9869-4274bd70bb49", "comment": "Malware payload (Mirai)", "value": "e817d860a9a860492af0d36d795e84ffa31352f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173603, "uuid": "ac336943-b578-48b8-a339-782349d7177a", "comment": "Malware payload (Mirai)", "value": "3b5108c950de87d8066a9fc7d4f52662fa549c18527994aa40900279ec5cd0e73367813db2af8891c93d9b66bc9db4d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173603, "uuid": "b4e3dacc-3ca6-480d-a638-d864b004d5c0", "value": "T1DFC2E1FDB9B71E9BDE030236E8AD6D33C1B4F095E31D72872280511664031F9A626DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173603, "uuid": "14eb6b6c-f452-4623-b852-1bc1c26a63b8", "value": "384:Mw1DMwk8JPyGjyDZeEXVZVBy6rITklSm4nnLZd1ZTTqX7n06/d5e5lV8mBNy0NF:5MwwDZHFbBy6rn21ZTTq1l5eTWr0NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693173603, "uuid": "63f9550c-6e66-40e9-8cba-501fdebaa0e6", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693173603, "uuid": "dcbfa4de-e301-4c66-b0b5-a4fb6daba49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173603, "uuid": "7e5b57c7-7304-41d4-a969-2e5c12c8ea4e", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9688ec4d-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175112, "uuid": "7afd7630-3fee-4563-8cb9-912f913a284a", "comment": "Malware payload (Mirai)", "value": "ee75d3c6144640b4d6f0fd020897004b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175112, "uuid": "d28c6745-d0ab-4055-a378-2b1e85382adc", "comment": "Malware payload (Mirai)", "value": "76d7cad78741c643cc8af3c5270edd8b14f74a13013e60a68665471b42a2c338", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175112, "uuid": "96ff6d38-3a00-4a45-8938-24849e3157b4", "comment": "Malware payload (Mirai)", "value": "7a8f5955301c74a920963b9ad365808ef4da8074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175112, "uuid": "e7931bd9-d1fe-4c7e-83cc-16d13474ccb6", "comment": "Malware payload (Mirai)", "value": "2c517285b3efdb5e012b4903566f58b0938948017581cb1d395b98ee8d93078c0dc36e1e0730d2184d0186042117baf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175112, "uuid": "6da64973-c70b-478a-84e2-b56672f136ff", "value": "T1DBC2D0E6E55D6E4AC7FE68B31D51CFA033A11F08B774CCEE5045F7221669A22A901FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175112, "uuid": "adb088d5-3ac9-46a2-91de-86cbb6fd444f", "value": "768:aqMkNa3MeiQoOX1UO5sHLSQo4uVcqgw09C:PgMetbX1UO2H+Qo4u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175112, "uuid": "66ac7150-4d6a-4453-944c-8be363d4f726", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175112, "uuid": "a49ab328-2cb2-4a08-9d8b-6cb8f20e141f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175112, "uuid": "50bdb7fd-9a7c-4570-aa3f-df5d8092e8c6", "value": "ee75d3c6144640b4d6f0fd020897004b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ff55b3-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693126261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126261, "uuid": "4a80a664-adb2-4de4-9117-de5dd8ca34ed", "comment": "Malware payload (njrat)", "value": "41fc13f9e13e4faf96f0a982e500fc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126261, "uuid": "d3270263-7220-4006-90a9-e86ac6f042dc", "comment": "Malware payload (njrat)", "value": "76e39048cd1241a3d682a6704973493a3ea1ab4a013bf04445486e77ae36d08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126261, "uuid": "3dbd51da-a543-4a1d-a707-3104842696d4", "comment": "Malware payload (njrat)", "value": "b6af1ab879b6e4fb05f75f983b94c287c00cfbc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126261, "uuid": "237d5817-7ac8-4b22-904c-207f0722582b", "comment": "Malware payload (njrat)", "value": "daa5e89c19509f280d739775d51b2fd4df2a99fcade43c3e9510181f8b817e674516ac71bfb4d13ddff2ddabc5a23c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126261, "uuid": "74e7719a-fefd-4ece-8f8d-fdcf5ca168dd", "value": "T14C93E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126261, "uuid": "38153e70-51c8-424d-a32d-76c46372a014", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126261, "uuid": "04c3713e-d29f-4589-93a3-3686956c091f", "value": "768:0Y31JnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3EsGj:pJxOx6baIa9RZj00ljEwzGi1dDcDXgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126261, "uuid": "baaa635e-35e5-4325-8610-47229c200806", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126261, "uuid": "aaba4929-51b9-47fb-9d64-3115cfa1db03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126261, "uuid": "c0d83841-5fcb-4e49-bd2e-d3649b30481f", "value": "41fc13f9e13e4faf96f0a982e500fc10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550187ea-451e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693170707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170707, "uuid": "55a42d0f-2ff6-429a-926f-9220bc5b9b46", "comment": "Malware payload (AveMariaRAT)", "value": "0e5aa77031459c9c48cf2fa298677656", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170707, "uuid": "a3b08a45-ef95-4324-8369-7b235a9dc63a", "comment": "Malware payload (AveMariaRAT)", "value": "7814c75c9ddfebea34123a885417c971802505f045ed5c0103a9762b83200656", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170707, "uuid": "b7d38c31-aa99-4009-bce7-7f4a212ce55e", "comment": "Malware payload (AveMariaRAT)", "value": "441d43e583d891907bc932b1b9adb611e44b6660", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170707, "uuid": "842418f3-ea57-4387-a38a-87e659ccb0d8", "comment": "Malware payload (AveMariaRAT)", "value": "319a075e2937f3d861507319d7816ac2fdebca9feac5b3a0c7a42f74acccc11c0566b3dd234cc22a36b7d17e9edd5df4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170707, "uuid": "4af6771a-0645-4840-8712-026f7daf75a0", "value": "T127C4121132E9D947EE7998B9E870449007BBB9123A51EBCE5CE07ECF35F6B4856007A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170707, "uuid": "913adf27-0651-45e3-b3f2-a52e98a9b8e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170707, "uuid": "b981bccb-3ac9-4d45-b0f8-9b5eeae33948", "value": "12288:WApwYWJp0aRZNRx6fk/iBwX6LV2Dviqnb4oaJVkoXfDjobK:WaFINUwiBw/DHnzUXrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170707, "uuid": "f005e883-4009-4a6b-9a82-4624cb205893", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170707, "uuid": "3eba8d65-9cc9-412e-b864-1ee40316c5b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170707, "uuid": "b99482ce-084f-4e8a-843a-e8a6e6ebb20b", "value": "GZdD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1feda749-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110059, "uuid": "9fdc0869-ba59-41bf-adeb-6e4524ac9058", "comment": "Malware payload (RedLineStealer)", "value": "6e57886a8b2190030fa3d39f0ca80619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110059, "uuid": "7647f573-717d-42bd-adb7-a46ea24547d4", "comment": "Malware payload (RedLineStealer)", "value": "78870c839c9f216d0065943c9d7e1add63288182c7eb5080bf53faeb28be7fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110059, "uuid": "ea6fc4b8-cb39-4165-a92a-f0455a25e219", "comment": "Malware payload (RedLineStealer)", "value": "b7900731e745729edc09bdc2bc300cf73c833a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110059, "uuid": "f53e22a4-9687-4738-b244-972551036abb", "comment": "Malware payload (RedLineStealer)", "value": "93b4a3579e2f5ccef07da4523f4bac756072d122a424bc880fb1dbc0332a86b60fc381e97ee78a3ef0e0e557ad3a5d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110059, "uuid": "f9783797-5505-4ed1-875c-363fabf44863", "value": "T1E7E41252B7C99933C4F51B7069FA12C32F32BC618DB8921B2788651A4CB36D07971B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110059, "uuid": "e7ed940b-5e64-42ff-8d18-acbf2a7f1c14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110059, "uuid": "d34c79ff-7a55-4416-8a2d-8bb01b1a23aa", "value": "12288:lMrvy90BB7J2qFK75NcIGORXvG3GdY7pa0nbaSKX8QurgAiGhrnZO:GycG/rR/MGi7prnHKMFhrnZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110059, "uuid": "13603d23-ecc9-4d3f-9403-77d37115aaac", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110059, "uuid": "12cebb46-f9c8-41ec-9c53-802eb652a8f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110059, "uuid": "921ef239-671d-4e4c-917d-b62a6b831cbf", "value": "78870c839c9f216d0065943c9d7e1add63288182c7eb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6020fd44-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169437, "uuid": "b1bbe7ae-280d-4624-b4a3-170b9647fe61", "comment": "Malware payload (Mirai)", "value": "bc0f518542e3df6cd505ae97e44bcbcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169437, "uuid": "84bc2770-8c4d-49e8-a48f-1df51cadfd68", "comment": "Malware payload (Mirai)", "value": "797063fc79e7b37a83ed3050cf81cd000df0487bb2f848891c9da6d52bbb7011", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169437, "uuid": "c655f512-98be-43a0-8ec1-f08d2a3123bc", "comment": "Malware payload (Mirai)", "value": "78619645a090b8d5149cbfff0f564dc909f46b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169437, "uuid": "c3737ef3-ec6f-4b0c-aa50-3faa94697fa8", "comment": "Malware payload (Mirai)", "value": "22ad5fd43854cdf941650cbf521216a22cbe8ee80d6dfc0916f407696e74fc6056b02d7b0e9ebb0583214fe04040ae44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169437, "uuid": "4ee6445d-9f38-4961-8dc0-e675dee55f3c", "value": "T14BB2D06487915307C2A0B435A37C8F925B3B16A0D6F73926172093FCD69549633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169437, "uuid": "5ae04892-f410-427a-932e-e9a13d728574", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BCDEycghymdGUop5hu7b:4C9KQFH0rs3zWoDDRsjt7LB9U+BCEgs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169437, "uuid": "b8df39c2-38d8-4fc4-b1da-2244a0db4a2c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169437, "uuid": "fa7e1f69-4ab9-4a82-98f3-b37f98a3daa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169437, "uuid": "dab363fd-104e-445b-b7f2-c12b270cc46f", "value": "bc0f518542e3df6cd505ae97e44bcbcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735473f6-4534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693180207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180207, "uuid": "529d5e08-0b1f-4590-a182-68e01979e9a3", "comment": "Malware payload (Mirai)", "value": "aabd4e6fb5c52046a8902e626c1fe6af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180207, "uuid": "7a7a335b-28e7-4de0-ac45-c34ac62170c4", "comment": "Malware payload (Mirai)", "value": "79bf1601c8b805c012b6880f8ffa8cc7334138f7764de72ef9174c64a214deae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180207, "uuid": "c88dcd75-de92-4ecc-9c60-7446fc07f612", "comment": "Malware payload (Mirai)", "value": "b97c79d50993bc59b62181c057615bf9a46b08ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180207, "uuid": "68bfc468-2df8-4f57-ab3c-34a10d5888ec", "comment": "Malware payload (Mirai)", "value": "85ac9045473423d0a542c89c2608e5342f0447f0981e9922cf799480f8457478f4952f6754623e33cab068102a782dc4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180207, "uuid": "0f9a2ef2-838e-4db5-99c5-80dda0070bbb", "value": "T19AC2E13096ED1CB5C7600532F7B866C9BE034F7DEAEE3890124157BA39429056EEA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180207, "uuid": "2ed2573f-5cd3-42a5-bdda-c9755bfa9999", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNENTGjhymdGUop5hW:ESsoTAZ3alkXLvFh8nNE9cs3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693180207, "uuid": "bd4e567a-263a-472c-b28e-7f9acbe77037", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693180207, "uuid": "25b47e44-b113-487b-8b48-24fbcc7c87cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180207, "uuid": "4fdb5323-0f99-4808-a9b5-2d6e2517b2b2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195cfc16-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110048, "uuid": "508aec06-d38d-47a3-a133-106e29544c54", "comment": "Malware payload (Amadey)", "value": "4bf287caf31d97c430a12b0a7cf6f1f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110048, "uuid": "eced6b40-3a37-41c5-add1-1ec4c73500a6", "comment": "Malware payload (Amadey)", "value": "79e57ca82045eb1691a57bfa5b6dee790a233dd63e19865d7c55ce901112c4f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110048, "uuid": "03f3bb32-16ff-4e4b-a06a-4d792c123298", "comment": "Malware payload (Amadey)", "value": "90ac44ef843c6cf8124a504672b6ab0e74805548", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110048, "uuid": "32fe29e2-a4b6-4c45-af92-81821714fb5b", "comment": "Malware payload (Amadey)", "value": "1cd18b8e805a3e4a911d849b61a1d5a34613e316bc4d09246902774da0f31ba7678fdedf50f0751abcd834c78a88c33d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110048, "uuid": "01fd5382-4c97-446e-814b-f873fb49c087", "value": "T14EE41203ABD891B3D8B2173059F643830F343C979D748767325AAC9B0DB2A85A47672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110048, "uuid": "024ded0e-e05b-4105-9385-59e0a256c342", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110048, "uuid": "48ab947d-4362-42a3-b006-8eb916c160fc", "value": "12288:pMr3y90adto5mvaQ5Fk2ceUo8zXiOVdwNS3Ln+Fy9UXXWVsiUn8giuUlS7q:2yTnGmvHLL8biOViNyLnqyWXmVsiQUlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110048, "uuid": "6f18eb2a-41f4-41c2-85da-b601ba64342f", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110048, "uuid": "a97426e6-cfb2-4e6b-b0ca-e0202460423e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110048, "uuid": "671f024b-3ed7-4609-8dd0-b679078fb801", "value": "79e57ca82045eb1691a57bfa5b6dee790a233dd63e198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5523d77-44bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693129261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129261, "uuid": "8d93045a-e4b1-4624-a90d-09a734523dd6", "comment": "Malware payload (RedLineStealer)", "value": "6af2f7bea81469451c28ce8ec08c2e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129261, "uuid": "dd0493a3-7f43-4cdf-80fd-2fce367e76fd", "comment": "Malware payload (RedLineStealer)", "value": "7b5169e20ee50c61932065f9e4ade38ce303b54c5fd08d61a087b3b2fadb9d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129261, "uuid": "a0ec512c-4460-47b6-a094-4677846b0ffb", "comment": "Malware payload (RedLineStealer)", "value": "636562395bf29431548baff0697941040cfc3d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129261, "uuid": "86c15bf4-5171-491c-8acd-46c4d6c36830", "comment": "Malware payload (RedLineStealer)", "value": "77f6272422784ca9fe7970dea145a8e3d1a107e2380c1c812a9ed18bf30391f00cb5c44cd2b216328dd18b8a462a4f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129261, "uuid": "8913f841-d6df-4ddf-8cc1-fb7783732c37", "value": "T172E41213A7C48536D9B267B02DF203832A317C658D74936F67D9E82F49B3644A8723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129261, "uuid": "cae07914-1f1a-4a3e-a304-d23d3e01749f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129261, "uuid": "9356359e-1df5-4bea-87e3-b1ff2bb4d2d9", "value": "12288:JMrey90Q0gzBqwQW7MBy/zhG/9UVA7iXPxkjIRf05ZCR7I7SQdWIgcfui:/y1zBq8Mgzw+FNRfqZCRKSQdLgni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129261, "uuid": "0c73a03b-6cca-4625-ac7f-73522ec4f035", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129261, "uuid": "ddccc7b0-c49d-474a-8884-3dec9bff7511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129261, "uuid": "a74be958-753c-4bff-98c1-3ee38c371e33", "value": "6af2f7bea81469451c28ce8ec08c2e74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fde870-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693149388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149388, "uuid": "fab19773-4747-40b7-9ac6-d0f24580a931", "comment": "Malware payload (Gafgyt)", "value": "987c4e2c519419bb90cd1582ca559332", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149388, "uuid": "9456b5ad-3479-43dd-9637-e6c19ccd89de", "comment": "Malware payload (Gafgyt)", "value": "7b74e0c4ec79aaf451d706c31cc3d23a73c5e3574cd916c841334e138a79c293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149388, "uuid": "bb44b906-9143-4fdb-afba-f8f2680133db", "comment": "Malware payload (Gafgyt)", "value": "5d2f04705861c88927fc45ac4a80917293be7408", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149388, "uuid": "c76e124e-ba03-48f2-a33a-d822eced7d94", "comment": "Malware payload (Gafgyt)", "value": "e614408ca5ef6358e3792a0dae8a2215ed3e7b4760834a9128a9600a459394f181992ed7a993901f442dd93677e12dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149388, "uuid": "1de824ad-85ae-4d9f-a5ef-a8bf7187b8c9", "value": "T11FF33A05E6408B57C1E2277AE7DB424933339B64A3DB33059938ABF43FC2B995E32516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149388, "uuid": "638c3e6e-6083-4429-8e48-35c367ab9e99", "value": "3072:CuyamcedZX4hn6y1KxU5nq3jM/9lFLMTmPwfvRQlfN:nyamcedN4P1K+5nqzM/9lhSmPwfvalfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149388, "uuid": "9882cee2-9a51-40f1-a71e-3af500a39f5c", "value": 157540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149388, "uuid": "3e674a29-f2f4-454c-a3de-0a879b4c3c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149388, "uuid": "c958137b-0684-4871-b436-4126ebf110ec", "value": "987c4e2c519419bb90cd1582ca559332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b254cc1-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103716, "uuid": "d1d0d85d-2585-482e-aa95-3e45868c9228", "comment": "Malware payload (Amadey)", "value": "100d77da102df94e99d36d46dc39ae69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103716, "uuid": "73419a80-f7c3-4960-b9c9-7856b3d2aabd", "comment": "Malware payload (Amadey)", "value": "7d196b7c89a02b9039c6390e549dd0d5f28916cc0ee91ba5fd54d75f0c8fa76b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103716, "uuid": "e9f5150f-c21d-4d42-ab84-d8f4239614a3", "comment": "Malware payload (Amadey)", "value": "f0cfb860facc160943962a29c3a982ac9632a0da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103716, "uuid": "2caa7f58-55a7-45b7-a25c-0d2e42ee00d7", "comment": "Malware payload (Amadey)", "value": "06315cd4fd2444ec9d1df8ce81df1c38470353e432544e08a4ddbc4dd121bd56fc6f00098c23204a146cebf1329542ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103716, "uuid": "31282d9e-1427-44dc-86d0-5e4a274d5695", "value": "T154052221DAD91932E8B227786DF742570A37BC914D3C822B33885C5E0DB2294BA77777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103716, "uuid": "53556b9f-1273-4c08-b966-09130424649a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103716, "uuid": "5d782cde-bf06-4c0e-b391-6aa09bdf6eb8", "value": "24576:UyJ7bECRhCUqS7g58PmAM/QZBTwi9ZOXJB+:jJ7bE+CK7gitX6i9Z8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103716, "uuid": "e85dd057-480c-456f-8d46-726e8771bc06", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103716, "uuid": "147f34fa-6e86-4838-bb6a-159ff1c4f187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103716, "uuid": "6db09c4e-9c18-445c-b3ef-15e445eed7b2", "value": "100d77da102df94e99d36d46dc39ae69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a32093-44d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693140990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140990, "uuid": "557b8df8-97f9-4b35-831b-787285f922b8", "comment": "Malware payload (Amadey)", "value": "175c336111a2974d14e491be9d92b29d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140990, "uuid": "4d3ea1a9-a451-4069-9748-46a125de23c8", "comment": "Malware payload (Amadey)", "value": "7da1070b26ac635f36c96a37658d7d3bbf1b691eea637680310132e1a2009a88", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140990, "uuid": "d159f03b-4b08-4877-9b64-7405bdb0be57", "comment": "Malware payload (Amadey)", "value": "b16ba6d388f103b8c8b8b52651c4aee0af332c0e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693140990, "uuid": "6832faa4-c212-469b-83d9-1949faf05532", "comment": "Malware payload (Amadey)", "value": "8bce2ea6e9812bdc0e48ae5cd712bbf975c84578e9239a06acf771430f72a91578b0e6a0fbe6f84184fddd31da6fcfec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140990, "uuid": "f4aa4321-9018-444c-9ef8-b7386ad57d0d", "value": "T18C052206EBD88472DDBA17B158FB03C30E32BD619D78836A27459D4F1D73A94A87132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140990, "uuid": "ed158662-1d5f-463c-a94c-a0beae4c0664", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140990, "uuid": "2994b7e9-721b-4edd-8835-dd478528997b", "value": "24576:ZyZzjnI1ISeDCyvh7AqIMvN9e4SPo23tQ5A:MZzyISeGeFZ9jSPoYtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693140990, "uuid": "47e44d57-240c-462b-a619-6141b81fd804", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693140990, "uuid": "b5eedf71-d8e9-45ae-856d-2fe4e136415e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693140990, "uuid": "0f2ee92f-0670-4dcf-8dbe-9522b7ee3301", "value": "175c336111a2974d14e491be9d92b29d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccb42b8-44db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693141890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693141890, "uuid": "b62cc019-755f-4ab3-9359-84dc263acd7c", "comment": "Malware payload (RedLineStealer)", "value": "e994284db4e4e6308be47a49f97cdbc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693141890, "uuid": "09a40716-5f51-4034-98e7-2f28e9671453", "comment": "Malware payload (RedLineStealer)", "value": "7da5f16dab1ccefa986436b861f2de284884d88e39c99e4f3050ebcadfeac6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693141890, "uuid": "b7876dbf-f734-4f7b-9306-21e5c6c3e7d6", "comment": "Malware payload (RedLineStealer)", "value": "93c03a9a40763b776f1d4e56ec6436839f553bae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693141890, "uuid": "3b4c14b2-8f00-428b-a887-1e10693b8096", "comment": "Malware payload (RedLineStealer)", "value": "5f4826c0b25c07ffbfc986f7fef93841f8e74644d31b4b0926a1df8602b65694c1babd6b220faee2b04e3e46cb41447d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693141890, "uuid": "4eb390a9-602c-4e78-b224-af2c9e33c3ec", "value": "T1901523136BED9123C9F32BF0A9B202830F397DA19878831737966E1D1C72791A536776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693141890, "uuid": "d950e401-603f-4d31-b196-834d54204b33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693141890, "uuid": "d807a4d4-25b4-42fb-9931-0f7c23ec8846", "value": "24576:My6if8007WtBDaB4jXMaSUAfhVG9FVhrASyZwY4:7v87WtBuOXMaZUojkSIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693141890, "uuid": "eb17d77a-f25d-4fd8-b4a1-92c844158954", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693141890, "uuid": "3cf17a24-a2a9-4980-acd2-7ca87addb2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693141890, "uuid": "65c22478-5f54-45af-984c-865c53743659", "value": "e994284db4e4e6308be47a49f97cdbc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0b895c-44c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693132873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132873, "uuid": "a7b537ef-063a-49bc-8491-1818eef7bbc6", "comment": "Malware payload (Amadey)", "value": "4f69027399f29c1bb8c1e959a62166f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132873, "uuid": "c15f0121-6d75-4984-9f19-178353a068e3", "comment": "Malware payload (Amadey)", "value": "7db58e6e503317c598f345d6e2f0e665a0dc66c3ca1bf9d922aecfc7dea9e83f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132873, "uuid": "56a7b203-782b-4d4f-be7d-4335066f1683", "comment": "Malware payload (Amadey)", "value": "153b838dfed0a7d4ae3dcd2bf01e0d190be38e5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132873, "uuid": "8612f6a7-80ea-48ae-adfa-e8a167cbd9c0", "comment": "Malware payload (Amadey)", "value": "100ed816c86f0521d42f7256ab95f0b1bae583276807b493869cec304b1c1ffcdf518f9da42ddc131b025e8359f63863", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132873, "uuid": "f15c7ab3-8f70-42b1-992f-67b1c68b6710", "value": "T13215230697E54073DDB21B7119F50AC31F3BBD664B78836A2784EA4E2CB3980A974737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132873, "uuid": "00a4ea2c-2d17-408f-95e2-cd3580dc85ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132873, "uuid": "7667dc3e-4452-4328-8528-64b0f7959b56", "value": "24576:nyDRZHVUdo+aVaSAUzTjU5udAlh/Pl4QFvc:yDXHCKvbXCuAPmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132873, "uuid": "1c943c68-a43d-450b-a0b3-dc013cec4a10", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132873, "uuid": "ce6c5c0b-8af4-435d-a805-48d2b1780e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132873, "uuid": "0beb692c-1f48-4dff-9104-ac63e29951d3", "value": "4f69027399f29c1bb8c1e959a62166f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785e4b57-451d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693170337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170337, "uuid": "fa3a3896-8769-4af1-8e4b-3472b262741a", "comment": "Malware payload", "value": "c80431554e96fda01a3bf204ffc0734a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170337, "uuid": "bb7fee5a-57d0-40e0-b89e-eab19aa3fc18", "comment": "Malware payload", "value": "7efdd86bde8ebe7882d0de3f1a06444be741b9e7b748c2b1a6a2193d97bf431a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170337, "uuid": "cceb3850-a645-49a5-96c5-7bfdab0668a0", "comment": "Malware payload", "value": "28a3ed5d9ae43a245b1e109241a6acfb0b7c4377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170337, "uuid": "82dc6c58-2c86-4371-b528-537acf55919a", "comment": "Malware payload", "value": "d396771ee61d61d333ce8e081e4b15da82433e7fb3e0b9e0f6ca3974d86d15a7fdb9d2d9e98bb60a0d51da1691b95efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170337, "uuid": "39e56fdf-c2ba-49e2-b0c7-337942ba5283", "value": "T16495F1C3F18036E4E82A49B79789487057273E77374CE3ABD61472662BB31928937E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170337, "uuid": "fab35f7f-4be5-4409-bb87-956e3fdca959", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170337, "uuid": "d68d284c-f31d-4061-be59-252d62f7edd6", "value": "49152:pawKdtFVckgEGtSOSrPNtZHgNGxQoK+3nPx:paND2QOSPlHIeQoK+3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170337, "uuid": "3386b868-dcdb-4601-977e-4efcf8a8a425", "value": 1962415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170337, "uuid": "33ad7a9f-db1e-4669-94a9-99339f520dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170337, "uuid": "b146861b-4945-45fd-8ac4-71809592d98f", "value": "StickyNote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94120692-4486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693105529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105529, "uuid": "2456324c-ec8e-43f2-9c06-6e239b5052e6", "comment": "Malware payload (Amadey)", "value": "152f4014c53b0166a3cdce90251b5144", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105529, "uuid": "2252d0e0-2e61-4b42-9139-8e586c0496a3", "comment": "Malware payload (Amadey)", "value": "7f668c64422fc5c4225af7db03eea97abdfce57a9184f8bfb8a20060e97c04d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105529, "uuid": "73ec5e69-f8c4-4345-8c27-7ea27aeabb93", "comment": "Malware payload (Amadey)", "value": "a81e4e951787d0703467e2d5194ce24e95213ae0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105529, "uuid": "c22628a3-7b99-44b5-925d-d66d353f439c", "comment": "Malware payload (Amadey)", "value": "56049004a8d3f3caa34cbd2db8d3e913ee75025bd2b46ef39a40e46ded78781d0780c721233fd6bb46633f0f3820033f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105529, "uuid": "9f022719-c898-4a1e-8602-ba6381a2bd32", "value": "T11B23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105529, "uuid": "9bb240fc-0668-4b38-9310-b86227b758ca", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105529, "uuid": "72050d2d-93db-48bb-ac0b-f367d4cf6829", "value": 48934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105529, "uuid": "409f3049-04ba-4a52-8908-5735f0651b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105529, "uuid": "d3c4d9f4-93f6-4858-990d-6933d79a2e9f", "value": "152f4014c53b0166a3cdce90251b5144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23460df3-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110064, "uuid": "2c62afc9-a7dc-468d-a258-c110a0266804", "comment": "Malware payload (RedLineStealer)", "value": "5aa97a59090abe49f0d7d853663b5127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110064, "uuid": "b2de4504-0dff-4a17-9589-1257b36aceef", "comment": "Malware payload (RedLineStealer)", "value": "7fdb94e4e8ac2e1d6b0fae70e63a78bab3c86ab66725d74bcdcc6ea4d35c406d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110064, "uuid": "18c18d57-9f8b-4470-a28c-b4815f9eeba7", "comment": "Malware payload (RedLineStealer)", "value": "f5216841f63357fbae33bb46acb4315b451869cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110064, "uuid": "cd1d41a2-33a2-4b87-bb98-4a8fa4ed71a2", "comment": "Malware payload (RedLineStealer)", "value": "ff3c3b258a926024ff23b958fa8c28581aaed6a043554bb42beb30038e0f0f1c445afa4b7e1b5dc750725cef45d0656e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110064, "uuid": "8ab2b99c-f273-4a61-a179-f4496b2ad83f", "value": "T19A6523C66ACE01A3E9B007F158F213831336FEF15CB4862B6742A94E4D63794E976367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110064, "uuid": "72bce31e-45c9-4383-bc0e-1d8677002235", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110064, "uuid": "189057bf-8721-49a5-b2be-b9f335ecf278", "value": "24576:EywI2dJFGJlz2HXqLNxKGukI3KT/JA+s7YVB4ICoShTsqgbNO4KSACwBMwL+sKC:TwH0J86jKGukgI6/Er4F7hgRbNO4CMw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110064, "uuid": "3baa3ee8-48ad-4323-8622-3bbe5e0a9318", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110064, "uuid": "d3a49cf8-b8c0-49de-97c2-4e9371a1e42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110064, "uuid": "b9296c60-120c-4d34-b3e5-e850b5d19698", "value": "7fdb94e4e8ac2e1d6b0fae70e63a78bab3c86ab66725d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7a7fe9-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103721, "uuid": "787fefbc-a7d8-44a9-9304-2ac5147d8afa", "comment": "Malware payload (Amadey)", "value": "fbdc1711663940e24b26f8590f08cfca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103721, "uuid": "e4cf1531-5a64-42c5-b35f-8dab36e459dc", "comment": "Malware payload (Amadey)", "value": "80d0367f802d13d941344077aba8b12a208c13aff7a8d23b9fa3e0a71bfcedbc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103721, "uuid": "522227de-c8b0-4666-982d-a690496fa06a", "comment": "Malware payload (Amadey)", "value": "b713a7e7e0c934b762813aeb351326a726eedde1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103721, "uuid": "12caca01-167f-4467-bc9b-921f72df3df9", "comment": "Malware payload (Amadey)", "value": "b6869df827af2d508b02c50d7fe4272f77e1309c5498455da79f8645f189120d28576aef3a9f7ccdcfbca251355f70b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103721, "uuid": "74912dfb-b428-4242-95ac-f80b30ddc3a8", "value": "T1C1052316BADA41B7ED7523B046F913C31A32FDF0697852672B8A98651C333E0E436367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103721, "uuid": "2a6e43fc-2022-447d-a41e-87c5981b988d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103721, "uuid": "0172f5e0-b112-4497-a037-1c8834566e1e", "value": "24576:fykXlP6b9jXTGQEInhKTCyFecq9vg57Xb8JslVW:qklP6bVao8TCyFlq9w7rQsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103721, "uuid": "ad81d1c0-61fd-4dd2-94b8-b01024a689eb", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103721, "uuid": "0d7e02c6-429e-40c6-842b-b294f2bfe7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103721, "uuid": "e7f33417-cfdc-494b-9fc7-7cd2d93a31ef", "value": "fbdc1711663940e24b26f8590f08cfca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3552f77a-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693147890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147890, "uuid": "9079c69d-4315-4bf9-a69c-deb116d6ef38", "comment": "Malware payload (Amadey)", "value": "57335a427c0b86e432942d6eb900ce4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147890, "uuid": "1e510cb3-25f5-44bd-859a-1523cb2a7945", "comment": "Malware payload (Amadey)", "value": "8128339c71d4677f4bd95df4bc0e88010a80a8d1370176327fd051e849ae1883", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147890, "uuid": "2e0d4438-2e99-4602-bef2-cda78e5b39e1", "comment": "Malware payload (Amadey)", "value": "751f5b466515ce14aab609409d5ce58522d2a76c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147890, "uuid": "5a187ce1-a54f-4ca2-9908-bd6d7cb983b8", "comment": "Malware payload (Amadey)", "value": "eb861dc4e66aa02e22f056df015462ad2f3c00075ed14eba36a1ca33f28e96b4b46a3f2227759ec8ed7428d6478ba7ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147890, "uuid": "49446b50-0979-411b-97a5-7cf8c7dc3e5f", "value": "T1AAE41203B7E48426D8BD6B7094F206931E36BDB66D7487AF134A695D0CB26E0953233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147890, "uuid": "cb35a760-f43f-47ac-ae95-65e38a7c0d32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147890, "uuid": "54465f1e-43ad-47a0-97b9-fa9c3945b25d", "value": "12288:CMryy90CqwjCanjjd0pzdS7p9rKVkaL46TWajclaOrLQUqHwNdKFZVsGoD:Iy+ACajjdSU7p9rKVkaL46TKrLJHNdKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693147890, "uuid": "70955ce5-837c-49e9-b1a0-7a824b647033", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693147890, "uuid": "134eabc5-115f-4a0e-a9ba-33dc6124b512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147890, "uuid": "b96faa2c-390f-493d-a2ea-67eb9dbac9ef", "value": "8128339c71d4677f4bd95df4bc0e88010a80a8d137017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1289cf98-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110036, "uuid": "3f2c8dbf-7ede-40e6-8177-2d7fc7f82bc2", "comment": "Malware payload (Amadey)", "value": "8f4ae20d1d47ee3087c2ec52a22e9023", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110036, "uuid": "71d77f62-c5f3-417a-81b4-81d32322299a", "comment": "Malware payload (Amadey)", "value": "875ed2f9942a97456569925ec9da5835f9f7673601250b1d6215bbeff5023f24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110036, "uuid": "cb53ef36-99f5-436d-b174-c68f4959bac4", "comment": "Malware payload (Amadey)", "value": "ae08549f23a5a7b5ca349746ea3362f797320e65", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110036, "uuid": "bc110381-2998-4c25-a4c5-0799e6554582", "comment": "Malware payload (Amadey)", "value": "77a9a3b2478be1ba3d6df333e3349becaa28229e1277f6cca43251317e68792c49b17a06ed883f13ea0c120356eaf886", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110036, "uuid": "6b9b7dc1-b334-4b73-9bc7-e6ca1b82829d", "value": "T178052313EBED1462DDF557B014FB12831939BC94593543AB2B86E89B0C727C4AA7232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110036, "uuid": "94af569d-9a97-465c-8b10-e424553e9777", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110036, "uuid": "6fd60de0-3661-48a0-9f92-11753781d418", "value": "12288:sMr4y90nw5++oI1IyHrym6IMnzOO6b5vlJU9axzD+nMqxst6gyEvrNbrNFTREmW:8yCw2eym/crS5N+nMqxmxNF6mW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110036, "uuid": "20f0490e-00d3-4450-a5eb-a4d7f7deba95", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110036, "uuid": "7074295b-6a08-4d02-8d7b-7ebe3705b180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110036, "uuid": "ee60c058-2af7-4e94-a4f4-160c17c87e2d", "value": "8f4ae20d1d47ee3087c2ec52a22e9023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7754f0f3-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149719, "uuid": "3319dc70-7859-4c45-a125-e4f9e47fc643", "comment": "Malware payload (Mirai)", "value": "314d0654c84d1dfb7700f44519dc7a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149719, "uuid": "46c5f068-2233-4e2b-a44f-c6304c3564e7", "comment": "Malware payload (Mirai)", "value": "87785f433b19e81e1b5e3de4127071d4aaa51e811678acb50b98c6b5e857ef4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149719, "uuid": "a2d0f64e-59e6-43fc-9d18-df3205242336", "comment": "Malware payload (Mirai)", "value": "6136d865b1aaa382380f175a2e6e021bea034c39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149719, "uuid": "b5b14d90-3d35-43de-bb4d-66ddce80d1b8", "comment": "Malware payload (Mirai)", "value": "90530fc31b2c84973d251112210b1524cdc108a972514e2c3c9afb70ec0350eaefd0d778829fdd289cfad0b11abddf9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149719, "uuid": "3532d0eb-a148-471c-87ff-4e46a4f14a38", "value": "T11EC2E091E1B62D89FB7A6E502E65C2C177B04E8EB777CCD225589F0404A361747087C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149719, "uuid": "e3ffa781-5d8c-442c-b339-ca2662f6ee06", "value": "768:AG959yM0HWubJsWDYcGU54uVcqgw09S0y:OM0HRJswYcGi4u+qgw09S0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149719, "uuid": "314d7be3-1660-4f00-90b9-6dbb6342c227", "value": 26232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149719, "uuid": "7235bee6-5f48-457e-9308-08845ac5d141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149719, "uuid": "1ce10067-94e1-4955-b029-7ca56a801a8a", "value": "314d0654c84d1dfb7700f44519dc7a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f76dba6-451d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693170402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170402, "uuid": "5eef54d9-234a-4028-ab9b-8eafdb574c32", "comment": "Malware payload (Amadey)", "value": "309fb97037f913fdb7cc0bbecf98470d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170402, "uuid": "3cb28de3-6497-4f8f-8359-cca6ba14bc5f", "comment": "Malware payload (Amadey)", "value": "8796f8a62b6beeebba7b46d308a63c203d4675d19af71b6ebdf54db9ad0f22e7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170402, "uuid": "ca60cc2d-cc0c-412b-b79a-e1e89430bb60", "comment": "Malware payload (Amadey)", "value": "6a601ee234724fcef2b506dcc1649540082b31cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170402, "uuid": "5db05bd1-06c1-4eac-907e-1a4e6b116625", "comment": "Malware payload (Amadey)", "value": "6855a14a02804a1173521f0287d3df8bc319b105434aaf3edb6d3bc71c941daeaf01242c666333c0b9b1b866927b109f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170402, "uuid": "8f0eb999-bd28-4c3f-9acd-2a19c92dfd5f", "value": "T177652303B5C86466EEBC23715CF327870A36BDA288785B775789A85B0C336D4583637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170402, "uuid": "aa850c81-67ab-4d34-b6a6-3a42b0e67b47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170402, "uuid": "3947fd6f-d074-45d5-b91c-a39cc26aa833", "value": "24576:hy4bLWq+GR4CNDCKthrxtFH0Hp6PCq9Rshifwj1/W1TVE7CMoJyHfZawTfRit:UWKsRpYKthrxt9a6Ptp4jpoVEOMy6fZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170402, "uuid": "0910189a-8dd5-4169-83a6-4dd647214b9b", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170402, "uuid": "e89365d5-cad7-452f-85a4-b086aa358b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170402, "uuid": "dfb77038-c9d6-4e65-a66b-a3b2650ff3c2", "value": "8796f8a62b6beeebba7b46d308a63c203d4675d19af71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4484d690-4487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693105825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105825, "uuid": "a5a565ad-2438-4aee-872b-bcc2d80178e3", "comment": "Malware payload (Amadey)", "value": "068b85e105ad083de03b8679e7786299", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105825, "uuid": "a92e9901-b477-4667-9502-e21389f0e15a", "comment": "Malware payload (Amadey)", "value": "87c0fb014c7a9339e3d96819336c3e4ce95756087889530faaaad188d2cef39d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105825, "uuid": "750c35b5-6199-4784-bca9-3e535aaddce7", "comment": "Malware payload (Amadey)", "value": "d6b540fcb73266bd41596f97b3f36bd185cc6582", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105825, "uuid": "b0361090-b947-4893-b909-992f369c7093", "comment": "Malware payload (Amadey)", "value": "ef97f7f3d49f9a8bdf1dac36c24deedb44194f843579e5fcbcc318315ec0b827342634ff45ae4ad44a366e9cf16e396d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105825, "uuid": "9f11fd5a-eb22-4fb4-a2c7-ce333d1d4cd3", "value": "T18C23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105825, "uuid": "a2704e5c-9413-419d-a651-a4de2a9beb33", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105825, "uuid": "4075aa79-c9e4-4a82-90f7-230d0bc2b477", "value": 48946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105825, "uuid": "6470d697-fcd6-45f2-8575-a81930c91033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105825, "uuid": "0a2ec564-6d98-4d14-951f-a5f0390d8fec", "value": "068b85e105ad083de03b8679e7786299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66605a3d-44c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1693132511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132511, "uuid": "7262c0cc-e666-418f-86ad-ed0098192c50", "comment": "Malware payload (Worm.Ramnit)", "value": "5f6a5e59586760420c29a82336845e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132511, "uuid": "7de0b37c-ae3a-40f7-8aad-69f6a5df4340", "comment": "Malware payload (Worm.Ramnit)", "value": "87c160843bc0bdcd754a151c288f899763494385830016c299245f1fe9354b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132511, "uuid": "3e4e61c4-c205-4721-9cdb-72e8d764f747", "comment": "Malware payload (Worm.Ramnit)", "value": "9c078d849c2505576d98cf9e8b0e30c777e06bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132511, "uuid": "e5f10d98-516c-48a6-84ad-f306cc70a0e0", "comment": "Malware payload (Worm.Ramnit)", "value": "1bb14faa2efeb7289f2fd867ef5b900e07d6b9aaca1ffa9c01d7414b2bae03a1f41b7b911abba84c091d56d8c04411bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132511, "uuid": "9b4eaf61-e348-4e90-b546-a0b29886d7b1", "value": "T1E025124AD3E05A4DD2D0C972D199F73E6418CC241C2654AB98E1FDD33AFADC05EABE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132511, "uuid": "d164f69a-7ae4-40a4-9466-b51d5c76c5e0", "value": "de4f61ba808396467867a045f2a86ffa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132511, "uuid": "eb974b3d-7a8e-4cdf-a6d5-78e0fe570a12", "value": "24576:p9i31nCX+v7ucalwTGn+bgzb/KmdpNY0R:p9i31jv7ucaCTGuYJdpNY0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132511, "uuid": "d186f46b-2ab3-45cf-aa08-e9ba1b339e59", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132511, "uuid": "4bc2207a-5595-44f0-902a-4837de19fa8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132511, "uuid": "fc75c943-26e0-4eb4-93c9-294c8087deb4", "value": "jxszdjp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec0a8f8-44c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693134082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134082, "uuid": "695460ab-9b1a-439e-8657-57970b0879b8", "comment": "Malware payload (RedLineStealer)", "value": "0c190cd1d2e06c5b505c83c1db92dd6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134082, "uuid": "0f2dd1bf-2b88-43a4-a762-58320b797bc4", "comment": "Malware payload (RedLineStealer)", "value": "887b72d2d5026e33574443482f0fc5df190d8b87895c778a27fe292844617cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134082, "uuid": "40f0b554-de5a-4788-bf18-7f18cf302c53", "comment": "Malware payload (RedLineStealer)", "value": "ce7cb1c3a6ed6e9de0457669b6cf2a60a6288186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134082, "uuid": "aa1dc0ba-ad4d-473c-b64a-90033c6f4073", "comment": "Malware payload (RedLineStealer)", "value": "b4d33dd24aa2a892c1c9763911b01fb476f3b782683546391e023b238af4e72505c5a350258ea43d13ff2ef94aff7983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134082, "uuid": "a41f660a-fdba-4076-bbb6-1e2d9bd8fb88", "value": "T11FE42343ABD89473E8E417F458F606570F3A7CA20979DB7B3285999B4CB1AC0643237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134082, "uuid": "59678b02-1496-420d-adbc-e8dc907a0e47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134082, "uuid": "99cb2064-ef7f-485e-91c3-8045f70c762c", "value": "12288:VMr9y90iPh9gF8qGqbjAdP5W7UCtIFxXe1+B9tkWHmRTSvbGTZ2xFHrHlmYvZ+:Ay7PoFqqbjftmXestXG5Svb0ZWLly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134082, "uuid": "f05c420e-1435-4e3c-a7c7-ac903a748cf1", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134082, "uuid": "394abfdc-4dd4-434f-8210-ba89ee4b7e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134082, "uuid": "4862d938-1e03-48f1-9316-15943c0dae93", "value": "887b72d2d5026e33574443482f0fc5df190d8b87895c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f910399f-4479-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693100115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100115, "uuid": "6fb10b6a-9eb1-4779-b1c1-a2a780c149c2", "comment": "Malware payload (Amadey)", "value": "079f762a1db34fbe0b8ca57719ac3b0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100115, "uuid": "48ec1299-cee1-40b1-8384-de7fbadccb17", "comment": "Malware payload (Amadey)", "value": "893ecc11ce815902761ed14c8d7dba16461113bc6e12511b31596da311cf78c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100115, "uuid": "66d04976-06ba-4f21-a282-9dd2bc7fa3fe", "comment": "Malware payload (Amadey)", "value": "075d75da289e23c6179efe154ef522bc0f55a78c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100115, "uuid": "a86a03d4-821b-44a9-b16c-53f4f4c6c72b", "comment": "Malware payload (Amadey)", "value": "c596c665dd561e3c54441ec183a536c952ae2094b2d52c3570f63182598008ef581570d5f6881d9ff04d213b5f28e5b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100115, "uuid": "5fd818d0-4774-46d5-9a90-ab6394ffc37f", "value": "T19123F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100115, "uuid": "2a7ae1bf-c79d-489d-9f1d-e18f2b4d6804", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693100115, "uuid": "4e67c2de-6e32-4356-9197-5a462f66e220", "value": 48802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693100115, "uuid": "6f146af4-4851-4539-a9fd-33327d8b2ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100115, "uuid": "ce03e59c-45e4-4ba5-b73a-4a3c49379876", "value": "079f762a1db34fbe0b8ca57719ac3b0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db62fa4e-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693132278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132278, "uuid": "f9bbcd76-9247-44f0-a5b3-d8094eb006f0", "comment": "Malware payload (Amadey)", "value": "6c719846c4312f3c16ac0c091bee1dae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132278, "uuid": "bc9647e4-0a49-4769-b71e-6f36fba1e2f8", "comment": "Malware payload (Amadey)", "value": "8ae0d54a44c038c8d5dc60276258eed4ebf397cae66bb27d9e043ab64be54e06", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132278, "uuid": "156beff7-2509-42f2-a471-e6131814c351", "comment": "Malware payload (Amadey)", "value": "e465a73d76af069467e8dc9a3b5c26bfb7460d3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132278, "uuid": "81a0e5b6-7a21-409a-8a1a-cf827a9afcaa", "comment": "Malware payload (Amadey)", "value": "c1bd153666f5d8957e4b29d9673c692d4ebb5bf6e23b4651a85d78080e3fb1be608228843c836d96451455750418b04a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132278, "uuid": "1c17c12c-99c6-4e1d-8b8a-2b88f969cdf7", "value": "T133652342EFD45412ED7853B06CFB05D72732BCB19CF05A5A7BCAE8530873A41A436B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132278, "uuid": "092f1b44-b2be-4fef-8d2c-1edef0dc556a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132278, "uuid": "17a9509c-7e9d-49d4-a477-262fc0015814", "value": "24576:xyFCjM3ntzp2JolyODCHCKlAGOBN2ykU02emZyZH7cZXTpvePxg8CzwoAWYNg:kFp9zWEyCKlAGHykU02emwlA1uxg8CL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132278, "uuid": "777b6ef3-a06b-4e0c-b973-2562437fd3d7", "value": 1502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132278, "uuid": "edfbb46a-a9b1-4ae2-9695-62479085ecf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132278, "uuid": "e9f7d3f0-752a-4ccd-9b67-6965de8f4aeb", "value": "8ae0d54a44c038c8d5dc60276258eed4ebf397cae66bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5390c9-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148202, "uuid": "38f9305c-3f93-46f7-93c8-4d8e97f75309", "comment": "Malware payload (Amadey)", "value": "f4e4c0b32fd46a3a4064bb54a371a772", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148202, "uuid": "f970ff4f-cbea-4d55-94ea-707e86cfedee", "comment": "Malware payload (Amadey)", "value": "8c9899269551971f4722e4da03d4586ca588f012f50338bb0fdc8dca77a6d3fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148202, "uuid": "4acb9b7b-190d-4baf-b41d-a383ae4763b6", "comment": "Malware payload (Amadey)", "value": "f5f62730dc0ed67d19f90f6d91d32b2fea56efd5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148202, "uuid": "93470e3c-0389-4cba-b6e6-f7fa09e89644", "comment": "Malware payload (Amadey)", "value": "931fc1e4ad85e561103270aea9677dbac36cd6878a585a794b0563ad2210f0bae006d394627433217d2e353c1f32db00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148202, "uuid": "533314c6-6491-43be-84f4-7440ffbe23d7", "value": "T101052246DAD88473CCB917B04DFA03C30E357DA21AB84327775AA85E4DB3591DA70B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148202, "uuid": "cfaf3a7c-08d0-47b2-b313-8e35fe49b5ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148202, "uuid": "413aa1b3-932e-41e2-9422-758611a1bdf5", "value": "24576:6ytN3D+pXQX+S5J+7bmCNXOvCm/sH4BF8:BtV6pGAmCdOvCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148202, "uuid": "f991eb3e-bc93-44f0-b167-33394ef321c8", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148202, "uuid": "18262aa7-375e-4596-97bb-9b6173b6812a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148202, "uuid": "a03e7864-6dfc-4f95-8bcf-9e494c3bc17f", "value": "f4e4c0b32fd46a3a4064bb54a371a772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a89896-4494-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693111548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111548, "uuid": "49bdb5ac-74e2-4590-a40d-10b1f7c88d05", "comment": "Malware payload (Amadey)", "value": "3c4617d513432d9a34cdc1585e71b047", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111548, "uuid": "afd29972-7499-4fda-bda5-a2fa486744e9", "comment": "Malware payload (Amadey)", "value": "8d1b912ca52cf88c5024a0b48ec59e7291aec683d29e0794868017683eb27642", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111548, "uuid": "396ac6f4-7db1-46f7-8e6c-ce29d0883e35", "comment": "Malware payload (Amadey)", "value": "ee13074375c405c2563bb7418d307746cc3f63aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111548, "uuid": "5ce7091f-63be-452d-88cb-3b36507d06c4", "comment": "Malware payload (Amadey)", "value": "a049a7007b642f334780071105f529c18eab0ce20998cd3c1a16c837e1fb298ee8971a1f55ce7205afcc352d6e18c2c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111548, "uuid": "699bd184-6af8-4ae0-b7b1-6ef0fd63b934", "value": "T18D23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111548, "uuid": "6f1e763a-cd64-4228-9f89-0448e619d70c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111548, "uuid": "3cef41a4-61f9-42f7-9b08-28df3d27be92", "value": 46011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111548, "uuid": "725c617a-0496-4b50-b174-7dc3019aee9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111548, "uuid": "fecd690b-85e3-4b45-a410-8fbabcee228d", "value": "3c4617d513432d9a34cdc1585e71b047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8451b71-4487-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693106127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106127, "uuid": "ca3dbc26-b1bc-4b7c-8f8b-c87a46f2311f", "comment": "Malware payload (Amadey)", "value": "249c8c1cd7481232dc79c13a94956098", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106127, "uuid": "e31f65b2-b569-4a8a-8e5f-4c382d393c9c", "comment": "Malware payload (Amadey)", "value": "8eb3c24b8282f77fcba7584cb602031ce077b63cba855ed799382b37d807d144", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106127, "uuid": "77b3c51e-efc0-49c8-a5c2-450a8648aea2", "comment": "Malware payload (Amadey)", "value": "9250d22c8cbc9b76da52c2798d89f62f5b006b07", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106127, "uuid": "18d0a41d-0e01-40b6-b74c-d3c243b0a1e1", "comment": "Malware payload (Amadey)", "value": "496fa9b5aea876f082720e0a93d7b30ff4645f885599a4ff7b9b8ab29dfc4fa09db716c8f16d6c06d1d5795aaf7828a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106127, "uuid": "85921366-d338-4c26-94c3-79de82f12055", "value": "T1C1E41263BBF95132D9B067B069F706C30B397D615CB4830B2345B94A0EB2294E87676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106127, "uuid": "63b58033-0961-4b51-84da-06b0a13b29cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106127, "uuid": "b96e2559-17d3-4056-9245-392eb65d607a", "value": "12288:wMrcy90ZG7PcKNfYUxAdK6Shnmxgof0Lz7cw43k0Eh/H11Da93mm7J2BhU:8yvNfYUmdjDapaw/C93mm7aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693106127, "uuid": "25984633-ebe0-4c22-a03e-d36118582665", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693106127, "uuid": "db6ecaf9-ab5c-401c-993c-53588a491072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106127, "uuid": "7e33b846-c7db-40f7-93dd-8c00dc4d74e1", "value": "249c8c1cd7481232dc79c13a94956098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c286c78-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693125971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125971, "uuid": "c66e5bba-43ab-461b-bc9c-83c5d71ee705", "comment": "Malware payload", "value": "7c9815b7025b3f1c3225578c6342070e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125971, "uuid": "7f5bde2a-f426-41f2-855c-0c5f7fd2ce56", "comment": "Malware payload", "value": "8f67a07b727c8d6bc4af5b91c781d6f71fdc4ac7c1453ab9ccd1b33e4f2b4ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125971, "uuid": "a85ed37d-8218-49bd-9018-8884e055a592", "comment": "Malware payload", "value": "b0a8996570026d392c113451aaa1d01be7079af5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125971, "uuid": "360de99c-c7f3-4655-9d4b-9652efd87d66", "comment": "Malware payload", "value": "afe93842379ce198501e2a4f950564738de3f61e3fcd9c5d0b31847ba0325ebe55c397cccbc0cdd64f23b14beb19d7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125971, "uuid": "2e292bf9-46f5-4361-bbdb-4f94557fd13a", "value": "T1B185A317E8E600F9C6BEF0244746A227BDB234A983347BD76ED54A861364FE4763E314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125971, "uuid": "6dbea20e-002c-4665-9a62-59135a2822a1", "value": "49152:2rzB+Y4p5/4JCa+GjOKbX9l7qx4TXWgO8862fz:Ocz/8kGjz3pA8862", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125971, "uuid": "1b16ac8f-c1e1-4b22-b808-9bbf45af8746", "value": 1822673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125971, "uuid": "de0371c9-53b3-484c-9f07-cd54038b5b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125971, "uuid": "109e424f-aa53-43e2-a56d-21bdead016fb", "value": "kscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fe0c7a-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110060, "uuid": "7a6d25b4-5c23-4e3a-83ec-c630fdcda7cd", "comment": "Malware payload (Amadey)", "value": "d2655519735e8984c2378d8a0ce4bb06", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110060, "uuid": "f19fa4c0-f978-42bb-83f2-8dc07efffeae", "comment": "Malware payload (Amadey)", "value": "8f77437bbc7f490842dc2e8177bf583a637c907bf8d87b6989975ea91481e02d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110060, "uuid": "dd7efa6d-f83b-4c45-83b3-c41277db3ce7", "comment": "Malware payload (Amadey)", "value": "9aac0c79d8c6e4b0de5f304dc0317d1488b49690", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110060, "uuid": "78019f33-cb38-4754-a017-27bb1bcd1c22", "comment": "Malware payload (Amadey)", "value": "56e93f1185b3ead2bf9c332aff80573c63e7c08ab4bd11a221d005d129b4cbebfefaf13010be0570c1136f312aecf286", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110060, "uuid": "8b35e4f6-24d8-4b3f-b2ea-452ad0abc7aa", "value": "T1EAE41242A7E49833D8BA2B7058F302C72B367CE66D79532B2746A91F4D739C0A535327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110060, "uuid": "338b9ea6-54df-4a28-aae8-61737b773cf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110060, "uuid": "47f7fbec-1248-452a-ae6f-b4a5a794ec32", "value": "12288:wMrxy90/OphIOnegI5BZ2BYJiKaHIoNnHBhkhn0NFNIii92aPu8hyeH2:RyGMhIO05QYJZQI+qhnWqiioaxhvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110060, "uuid": "137b21f7-f507-4bf2-8655-27540aeddbba", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110060, "uuid": "5cb9b227-8130-404c-b7c1-d09fcae6abf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110060, "uuid": "3f8d232a-44e5-4d49-a4e4-739c4554e745", "value": "8f77437bbc7f490842dc2e8177bf583a637c907bf8d87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8a85c1-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149349, "uuid": "94d5d8cb-5c29-4692-bd33-ecc3f972ca76", "comment": "Malware payload", "value": "0080a946ae53b01c880251ed63fcd490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149349, "uuid": "beaea8cb-ba80-43b4-b09e-21dcb2fabfcb", "comment": "Malware payload", "value": "8fe89b7671cf592f294cc862b15406dd54d271833c88cfe683b459191301a285", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149349, "uuid": "6f7599f0-aa81-491f-9f71-6fe0036cd67d", "comment": "Malware payload", "value": "8b9f0ca82285ecc610078263e96b1964d408005f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149349, "uuid": "a5e4a469-64f9-4158-95f1-dc55690784a4", "comment": "Malware payload", "value": "57fa6dccb72979c21e278dae6fdc7c1c1a2ad0df1f22c09593978a024c9dc6e53aae641090922d6c7a1669b49fc406a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149349, "uuid": "be938ef4-0939-42b4-9a28-581065d1e700", "value": "T1D4930993F801DFB6F40EE67604E34724B671BB624E532662731739AA9E362C43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149349, "uuid": "f970121e-b5d1-478d-978d-14c8a4e792ed", "value": "1536:xeKQ3sO8oOpIGZfRDQmvjbl+D39ZvyeAyjmg2gwNabTmQHVqXjetR/3Q:URsIO/ZfZTqvvyeAyjmrgwNaHmQHVqXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149349, "uuid": "b493ef52-f4aa-43fe-9714-0922b6461902", "value": 97433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149349, "uuid": "01b90b0d-cc9d-4623-b9af-e0a7031912d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149349, "uuid": "11ce0b91-7d07-40e9-8aac-ec8d26179995", "value": "0080a946ae53b01c880251ed63fcd490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d47a3fc-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693129784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129784, "uuid": "d7282131-5873-4ba5-8de1-69ddfa57dde7", "comment": "Malware payload (AgentTesla)", "value": "c178cb400a5d151c4e59640ca55b604a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129784, "uuid": "1e734fab-57ed-415b-92a2-054bf57c6334", "comment": "Malware payload (AgentTesla)", "value": "903bfcbe2d85143ad723b47ed1edc96f5416fa3b584fe76e74d75e93ff4b2e64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129784, "uuid": "d9e67b0e-8e76-43e5-ab77-32ce1d8084c0", "comment": "Malware payload (AgentTesla)", "value": "2f335f8791e3effef43c8f3441d9573f70ea22e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129784, "uuid": "bd5036fa-5820-47f3-bcf4-8dcdcf686eb3", "comment": "Malware payload (AgentTesla)", "value": "5c4e3f7d29ff66f36a80595306d6594c6deb9d82bf28d02e4ef029ddd4ac8f0f76f9e2073681d2e3ba4b344b9dbdc63c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129784, "uuid": "7d4bbd58-872d-4f34-8531-22cd56b88ba8", "value": "T19A357BCB2F310D84CB4F34715C8C1B8856923DA149F59CF22B75AB786D468BFA69227C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129784, "uuid": "3a6f8d99-a081-4838-bb7e-6e4e9759ed27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129784, "uuid": "9fa2cbcb-7fbb-45c2-b2c3-31676c0a9d94", "value": "24576:j1u6u4RbJDAzdUqYyDim6cF56gemFZiPZHWxEGPnqdOp:jV9RbJwdtim6cF5sR2xEGPnqdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129784, "uuid": "a4edb76a-5886-4cfe-a9da-69f72aedc031", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129784, "uuid": "7dbbeb0f-95ff-4537-ae40-9fc257fceef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129784, "uuid": "8f5acf42-6560-4ac9-bcc1-63738fa1c9d7", "value": "uzomazx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e262a5-44e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693146811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146811, "uuid": "50c10d14-cfb3-4553-a43e-9caaf917ddc0", "comment": "Malware payload (RedLineStealer)", "value": "f2843d0ece5de99b19dc6ad56bde6ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146811, "uuid": "17082b1e-fdc6-4342-a115-dd16cd263572", "comment": "Malware payload (RedLineStealer)", "value": "903d6e4d7f146a084a7d7cec6eda2d10efaf217351bb73fe0b7a785affc5d73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146811, "uuid": "6c10b975-a803-4328-9781-f8b6f71ff875", "comment": "Malware payload (RedLineStealer)", "value": "353f69426be7011ce67ea03a8c6f4ae0d1354f79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146811, "uuid": "89d23756-652a-4bc6-a865-f80fddc32698", "comment": "Malware payload (RedLineStealer)", "value": "ea86e306ba061fffa331cfb2e158f9939bcc760b212c5ecea62fc3ae2c7d17390f89cd8472b629233cfd012d5f3d80c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146811, "uuid": "e87ed41a-9c60-480b-8f67-6995109c025d", "value": "T1AE3429BE54E06860EC81F2FB0351BF6CE57638169AE0933D137A22E6726E5C0D778671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146811, "uuid": "8c82ed7d-d60c-41dd-a95c-e47b7a644e77", "value": "f3c9e4f5117bac247a9fa50ea51aa9b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146811, "uuid": "9a924dad-da79-4253-a9dc-6758d1584f8b", "value": "3072:lolLvssSrkIyfmgK3cy0Q9WVoaae81CbuUN0BPkf11gr42xfsjwsfuB/:yBssSro4MpQXACn0nisjvfuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693146811, "uuid": "ae544bd7-24e8-4ee4-9d37-439b1b543920", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693146811, "uuid": "e5634976-c1e0-41bb-963d-0a8a6f781e7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146811, "uuid": "09646ea8-3feb-4517-866c-99fbc5edcfdd", "value": "SecuriteInfo.com.Win32.PWSX-gen.31026.20526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3751d8-44cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693134987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134987, "uuid": "ac18cbd9-1150-40b7-b960-a47a5df68bc9", "comment": "Malware payload (RedLineStealer)", "value": "1cebf7cf538866c48bbd0543ef494d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134987, "uuid": "ada3a400-4f44-4fcb-b7f9-9f5545e89e64", "comment": "Malware payload (RedLineStealer)", "value": "908b282eed44ed93adfc9e3c32c90165c1aea402128689dcbe2942a3b81e38ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134987, "uuid": "03f3fd4c-09fa-4403-bdc5-6609c0e1e6ea", "comment": "Malware payload (RedLineStealer)", "value": "eda95c24551d726ed2c751f5e8018c7d2eb6c1bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134987, "uuid": "31f045a2-0d8b-4da4-90c8-50d53e067f5b", "comment": "Malware payload (RedLineStealer)", "value": "4d8e4c810bc49970eb3629ef1c4afda1f398ba0dec199338b663d6e13a581ec93a0ba874b9ce95ff8d4f1c8a2e381690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134987, "uuid": "ff10fa54-2251-4792-9984-c35c5fba3626", "value": "T1C5052302BFC88472D5F657B49CF606472A3BFCA1DA78531B2B816C1E1DB2194A63173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134987, "uuid": "5ba2b0e1-bbff-4149-9668-8bae5587417f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134987, "uuid": "dfb47fd1-a1ec-470f-88fe-262ce20dc250", "value": "24576:ey1P9WRC+o1O6UZPULzp0NooY+MWdAqzR0fu:t1loC+7FZcLzpI7MGAqyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134987, "uuid": "7361753b-74f7-4843-bcf9-482db686f526", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134987, "uuid": "6f16c780-b856-4d0b-b2ba-6bfbd93e7977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134987, "uuid": "14cfd7a1-ce7d-4244-91e0-f79d6db3e13f", "value": "1cebf7cf538866c48bbd0543ef494d7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b456a5dc-452d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693177309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177309, "uuid": "e2f55c42-44eb-4777-9487-e452fde01850", "comment": "Malware payload (Amadey)", "value": "2219ac54d35e15083193265e3abfb7c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177309, "uuid": "a66c42b9-7433-478a-9471-db8e2c0ed78e", "comment": "Malware payload (Amadey)", "value": "909403455e535843cf805af8efe3d64f62b3de37eeaa15bc7211aad67e4d0c50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177309, "uuid": "6abae799-4d36-4f66-bd10-a90be10b6901", "comment": "Malware payload (Amadey)", "value": "8595e7d6c22495e7da9d7dd4c10721bdf6ddbee8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177309, "uuid": "ddddba7f-1099-43ae-b6bb-8d43c02a8ba5", "comment": "Malware payload (Amadey)", "value": "2f40788c90a7d56f729129dcc8f20d5ba5746774782640e39176c8a42c4c34de159ae58a6c73d688964b076ad139de6b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177309, "uuid": "3487218c-58f8-494d-80cb-570d4793d382", "value": "T15903F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177309, "uuid": "9913e422-c137-43f2-92ed-51e679b66c4c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693177309, "uuid": "714bad7b-69b1-44d3-8a33-aa597bf30d65", "value": 40898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693177309, "uuid": "08cfa147-f35d-49af-95ce-618929712269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177309, "uuid": "f8a64964-3d05-4bba-8ec9-70ed0edf6b45", "value": "2219ac54d35e15083193265e3abfb7c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2354bf2d-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131969, "uuid": "fde5a137-c4d9-4b3d-9d9a-8496b13aa747", "comment": "Malware payload (RedLineStealer)", "value": "85300c499d833bf3841edec2030860e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131969, "uuid": "9f2fcd03-00aa-4270-b5a4-cda390a23b5d", "comment": "Malware payload (RedLineStealer)", "value": "91723a8acc66a2d208a571eb64ac83f96aea0500832cae74aed16045b8177904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131969, "uuid": "15b63381-6d17-4eda-8204-8a7be22f9b8d", "comment": "Malware payload (RedLineStealer)", "value": "e1fce4ba5981e7a5c1ee31c6e97581860d699462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131969, "uuid": "6612d973-98d2-4979-9a46-2d7f55f42d3b", "comment": "Malware payload (RedLineStealer)", "value": "5d24d378c5b8f988604c24e9b548b18615e04eecad398f18d7b37b8dda7e4f242ad0a17530d056fb56da37103c2f051c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131969, "uuid": "f15e1c17-9cbd-4fa3-9a2e-b840361a884d", "value": "T192052202ABE84136E9B22B706DF603D74D313CA24E38875B53966D5B4CB37C9553273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131969, "uuid": "1aee4bf9-f498-44af-b07f-e99044404ef1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131969, "uuid": "00bbcff9-1c1f-497c-8548-8348ae233e29", "value": "12288:JMrry90GDsYofwnbnK0EOt8VWFjL4kpl4btXSFKKKD6tdSobBPRB4ecSJM:GyPsYoAbtn+JRCoxDMBPsbsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131969, "uuid": "10b2824e-c211-4c42-be52-b1ebc5a9ff9c", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131969, "uuid": "4240ac4e-36a8-455d-9255-f6bceb44885f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131969, "uuid": "c2507200-993d-4b06-bad1-3815ea91101f", "value": "85300c499d833bf3841edec2030860e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628f8fa7-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169441, "uuid": "173da2bc-ae17-4c92-ac9c-b65a61e63633", "comment": "Malware payload (Mirai)", "value": "c372b5868b0abae5c71ab1ff971019a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169441, "uuid": "b3f3bec0-abc6-41d7-b765-b28081f04967", "comment": "Malware payload (Mirai)", "value": "91b2b079148f40e34fcc16409064243a3fb5ef596485ee646ab7926eee15a355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169441, "uuid": "0c0bae94-f971-4acd-ad27-8e53a726517f", "comment": "Malware payload (Mirai)", "value": "7cbfe58e4812ccb76a4fe6162ad612a4991c4773", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169441, "uuid": "ead7cae1-762c-4291-b8e8-a90b5556ed2d", "comment": "Malware payload (Mirai)", "value": "c149294e436f6000ca0fa72477872033c965115c61da352b3ce9fb965d65bb5cccc3374bc53e7aeb979f78b48f83ce44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169441, "uuid": "d55bd607-28d5-45bb-8960-24031b95cc10", "value": "T17FD2D08877D353FA8C8DC6BD735E003A309AB4E9A6B29373B306D5434766180F691E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169441, "uuid": "f74df228-22cf-4aca-b97b-98969ed55699", "value": "384:MJd/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BKejU/KpNyY:+lxKd21RhxEnsD16IHE4RlY990Bj8KaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169441, "uuid": "2c79bc52-0499-4a0b-92f5-1b197965595e", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169441, "uuid": "ac775daf-b95e-4e0c-93e6-40b8a5f342b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169441, "uuid": "e93bfa75-2e67-4cb6-9ad5-33a3b618d2a3", "value": "c372b5868b0abae5c71ab1ff971019a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12821585-448a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693107030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107030, "uuid": "5d7d013a-2c39-4d3d-8bb3-5747ac688287", "comment": "Malware payload (RedLineStealer)", "value": "03a22b18d73a847a6f271c376259438e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107030, "uuid": "c2477e11-e031-4e10-a016-29cd6d1b355b", "comment": "Malware payload (RedLineStealer)", "value": "91be2b647d943fe9ae094744bdbc59a496e4a35ed0c4f764d58a785466408cbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107030, "uuid": "a6001500-fe6f-4857-8861-2a73fe26f5a8", "comment": "Malware payload (RedLineStealer)", "value": "43d4325886e11d6482351126a6cf6e4e812e7984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693107030, "uuid": "06bc7ab8-a30d-4e5b-97eb-72df7faf7490", "comment": "Malware payload (RedLineStealer)", "value": "aa5b4078f6ebf132ef628489d136caf0e26ea221c287e7ecf42cbb113a94d11c46d6a8426964c1cb08733fe645bba415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107030, "uuid": "89532ac7-7637-47bc-afcf-5895af5f429c", "value": "T14B23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107030, "uuid": "500c41f3-446b-48e9-9b2b-901a86f44800", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693107030, "uuid": "a3e63f45-bdc5-421d-b721-77a80f228f6d", "value": 49085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693107030, "uuid": "888e1a3c-41f0-497e-bfb5-cee3a83681ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693107030, "uuid": "78f3ac93-e4d8-4d37-ad7f-9ce9ed05f8f6", "value": "03a22b18d73a847a6f271c376259438e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6326ca1a-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693103729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103729, "uuid": "fcc12f5d-593a-4468-90c0-3488f5ed9783", "comment": "Malware payload (RedLineStealer)", "value": "8f5cbcc58ed01c7ba1ae3960abac7631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103729, "uuid": "6530fc43-579d-4a34-829f-b0015cb659b7", "comment": "Malware payload (RedLineStealer)", "value": "92334114bd06e338628d83ea777f0ef3a1e8ac68e6791289e7b468e05c6ccba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103729, "uuid": "93002a6b-0da7-4e5d-95e6-79e7161e6cfd", "comment": "Malware payload (RedLineStealer)", "value": "46a894e4d3cd6fc07fc91620f982658ff19a830e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103729, "uuid": "f0c6ede7-e6d1-41a4-8c4f-460a3e9f8d63", "comment": "Malware payload (RedLineStealer)", "value": "29076dd1955d5c99f709297828a1f5493e3144c37e6a29c17e54a7d18199f2e6f0dfd44da365e6f27a769929cfec41b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103729, "uuid": "90db26dc-b3e6-4e90-a224-afe334e640df", "value": "T19E652342F6F684B1E9B55BB44EFA46834B30BC910D301AEB6245BD1B2932595FC7233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103729, "uuid": "11b91cb7-407a-46aa-b126-3129a5024dda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103729, "uuid": "54336fb4-d56d-48bf-b5bd-2f3781a8a38d", "value": "24576:hyMKKu4aENXdJNl64zbkPxieNKqb1RCpuM9sQfjuACSg2PVEuIVeYKA3nHtcekb1:U/8XBX+xKqb1RinjNCSg2Pq7t3Ncekbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103729, "uuid": "cb40d60d-cab4-4424-843e-ee7ac7b44af4", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103729, "uuid": "0f44f3d4-4b42-4bca-bc93-fd326e5e99e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103729, "uuid": "6a8aa143-e661-48f0-9877-90a24cffcf01", "value": "92334114bd06e338628d83ea777f0ef3a1e8ac68e6791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80387969-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693149734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149734, "uuid": "2d7ddee4-f9ed-4e7e-9138-e4e6031cc26f", "comment": "Malware payload (Gafgyt)", "value": "ba4badb7317ae3991e184f2d3af23e8e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149734, "uuid": "a078a604-e11e-4d0b-8148-801dc4e591d2", "comment": "Malware payload (Gafgyt)", "value": "9252f62d6f5f92a46d44950f78967c77630300ff9f00ff0efc3afedf034eda35", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149734, "uuid": "49dc877d-300b-4444-89f4-f6419c31d207", "comment": "Malware payload (Gafgyt)", "value": "88c9d9b0c05e233e635fb088524b928b3c88a37c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149734, "uuid": "1a0718ff-6f99-443f-8b43-4753d4ecdc66", "comment": "Malware payload (Gafgyt)", "value": "9112c66f8c7077fa1890d6be6bcb9f2f553bae635318296b3d282cc681fa0464a4176c01cef270d6175e373c77d300cd", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149734, "uuid": "e8b5f062-719c-4645-b8a9-6f3429d600f8", "value": "T174935C23A661CA7BC08757F42BE7D5619823B4790B33320A73D4BDA96B19CC96E5E301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149734, "uuid": "7f65f47a-344e-4c4b-8ac5-c390c18c8deb", "value": "1536:oQ7gq+66XdChtAFThWVuDPRvCb4tWcSp3fiMmoIGuOVjeDlOrQ:omgxXdOtA5JDPdjAcSZfvmrGuOVyDlOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149734, "uuid": "e6c7c946-e02b-4627-a521-f6d508d51ee7", "value": 93129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149734, "uuid": "58eab30d-8c27-42e2-926f-4a9961f7a14c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149734, "uuid": "48513998-878d-4cda-9f04-c7c3a9e0f2d6", "value": "ba4badb7317ae3991e184f2d3af23e8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c8a0c8-44ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693122354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693122354, "uuid": "aa8225ce-7223-40b2-8aa9-44efe4235228", "comment": "Malware payload (Amadey)", "value": "ac7c2a321198c7727efa33dad41d910f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693122354, "uuid": "2c0dc3b5-73df-4523-ab1c-62f70b0ed6bf", "comment": "Malware payload (Amadey)", "value": "92d0f994eca55a5b0f90fb99a3dc85cc566ae426cb5f568b2b2a4e08f5cf540a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693122354, "uuid": "594f5b7f-f50b-4556-b478-dc5d155ff34a", "comment": "Malware payload (Amadey)", "value": "4233a6efbaaf30b1ea9ad8cf35034747c429e145", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693122354, "uuid": "5413a5a2-fb0c-4700-87b7-73cc6e6f0734", "comment": "Malware payload (Amadey)", "value": "e8b49020e7701788f8e32cbed8c73e7da345b38809c0205e7332b8f90e065b32a000823caa9c80b0a9018db4fee15a7c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693122354, "uuid": "2a416ca6-a8a5-4aa8-b660-a381f0a1b3ff", "value": "T194152352ABD68532D8F6177049F603D72736BDA64CB0C7A73A5A894B2D712C0E97033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693122354, "uuid": "bd0aa053-5d19-403c-91e6-d4f2cb801325", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693122354, "uuid": "3ab573d0-78b2-4071-a4b2-edf6301b3876", "value": "12288:2MrBy900v3//il7T/kDEPQdLnUkx1/Mf4TDsgQppEkw7JBtEkij79HvC13ndKhf:7yfG2cQdLnp4VPpoKhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693122354, "uuid": "f86c26ea-5f02-4f70-83d1-7f590fb2862f", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693122354, "uuid": "c2817e75-e0a5-4db4-9ead-f6e8a25002c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693122354, "uuid": "c4903cd1-8510-45d7-a177-a12db9cc359b", "value": "ac7c2a321198c7727efa33dad41d910f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3227e3-4521-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693171898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171898, "uuid": "76893cd9-03b3-48a8-9e14-2b021da5f7c0", "comment": "Malware payload (RedLineStealer)", "value": "6cdc4aa93c25c0f7d72b59b62da50bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171898, "uuid": "602f59d2-9b89-4e2c-8090-b19b78de157b", "comment": "Malware payload (RedLineStealer)", "value": "92d704b7ec9a79c13e4cd5d973289068d70eded5e25f409a4729e358805b21fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171898, "uuid": "0bc02eaf-a00c-4d78-8769-fb7c68a8ea57", "comment": "Malware payload (RedLineStealer)", "value": "5e1070ba176a2f9c85150c9d57a50664618e19e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171898, "uuid": "b4120314-9f85-40fd-a52a-3e90f9747073", "comment": "Malware payload (RedLineStealer)", "value": "8b40e9becca3891107fbe2a1236c7200ad8754eddd79108081944fe6d28f6650d0c2fb26bf8dd10ab4f1c4b93e12c52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171898, "uuid": "05170b36-8ed3-4da8-a125-71150f1562cd", "value": "T1EC152222EBE99072CCB22B7088F253DB0E323D91AD69C26A57509D5F1C727C4653277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171898, "uuid": "591d0789-1cfb-4180-8369-3061eaddd277", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171898, "uuid": "2297e8c6-c612-4144-bf04-7198d433f07a", "value": "12288:HMrsy90hfrxKv02F6OL059zGV53JoDBjBCC1pqBaRT2Wafalv8hmXWGt0nr8t2w:nyCDyRtWCVlyBCukatEam+Ws0nr8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693171898, "uuid": "ddc1f546-563f-4091-963f-283703b71604", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693171898, "uuid": "bc3ea736-f91f-462d-973a-38c066e5c2f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171898, "uuid": "423fc5e5-0fae-4c1c-836c-f032c6e4974e", "value": "6cdc4aa93c25c0f7d72b59b62da50bcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adfa02d-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693174904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174904, "uuid": "70b45e76-0fb4-4f3b-bc84-074effac41b4", "comment": "Malware payload (Amadey)", "value": "62539aab8a71a7ec023b000f15d261cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174904, "uuid": "6d408d3a-3723-4aee-8506-325147fc1edc", "comment": "Malware payload (Amadey)", "value": "93755f58e05874dff1309a8990b0b9da6e5173ceeaeffc8425cd81cd5426786f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174904, "uuid": "72e3736f-fe03-4702-bd44-7ff287401839", "comment": "Malware payload (Amadey)", "value": "8e6af29c0c76641b9a0b9481a46a527399050df6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174904, "uuid": "0347d32a-9f45-4b42-a530-924871065757", "comment": "Malware payload (Amadey)", "value": "d6a64335208346b18e0f9c67466de9b7934847e57cecd80b2c67ad0cc2ed8fa56c7181023411ae572a3752159f1d864f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174904, "uuid": "42314101-8fd5-4d9f-b59a-4ae85f9b7772", "value": "T1571523936BD4E532C8F02BB25DF203830B363CD15DA5061B279654EE45B3A88A87777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174904, "uuid": "e486a058-bf24-445d-9534-1f3f4977310a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174904, "uuid": "84f362fc-a9f8-45e0-905f-ef7fce7580d4", "value": "24576:byfqf/nj3ZumQosnvbCaZW/62LK5YeuHY:O+NgvOgW/6225YeuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693174904, "uuid": "c33efca3-28be-4820-88a0-a86efc8e53b5", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693174904, "uuid": "c67ed44b-1c69-4f6e-ae09-6da81bc1f38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174904, "uuid": "a280527a-382d-43a9-9554-94ac85c948ec", "value": "62539aab8a71a7ec023b000f15d261cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66dbc9b-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110338, "uuid": "70165de5-9326-4c4c-8e0e-519a4d7601fd", "comment": "Malware payload (Amadey)", "value": "e7f17c483fbdac5423dd1bb3098d9985", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110338, "uuid": "8f94d85a-0b57-45d1-a5fb-9ca8378523a6", "comment": "Malware payload (Amadey)", "value": "945084dbe654f4950d321344ff1084d836889070657c2ba123f751211eb897f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110338, "uuid": "7e1494cb-97a6-45d0-ac1c-59bedb518d8e", "comment": "Malware payload (Amadey)", "value": "4373a24af222d77abe1fdda4d54c1806fe8aa8b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110338, "uuid": "dce061fd-8ffa-446a-b27c-c7c0eabfcef9", "comment": "Malware payload (Amadey)", "value": "7a801927389998cbce33b41effaf20c9fc872ecf74500a40282b7bec7c921b2401eaace62e53480dcc7c4f611d3df834", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110338, "uuid": "8cd657a0-3040-43eb-8694-aed46b0c8ce5", "value": "T180652307EBD64097E5B52F30A8F616831B36BCA10C6D969B32E76C0E08327D09576B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110338, "uuid": "d95e8cfd-d4a1-457c-b442-6fa8a7c3d02e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110338, "uuid": "33594a2c-0c94-4cd9-aa48-aef6f6627661", "value": "24576:cylqKHWdIKBkndIE5JkTEv7vO6aZ4FPBjiBD5kbziIcEGhwxM5tVG99k9x2Ub:LlpHXKBknDJVvC5Z4FB2lk6xEwwq/GgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110338, "uuid": "50d50fa1-5caf-458b-b66b-a357a231f2f6", "value": 1469440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110338, "uuid": "88ddd3e0-7210-43d5-b8b6-19638fb0717a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110338, "uuid": "ee2e3b55-5e86-4f8e-9d46-85ea59a5c562", "value": "945084dbe654f4950d321344ff1084d836889070657c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a76b3a-4494-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693111546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111546, "uuid": "f65dc708-707f-4edb-9b8f-57673cf1caa2", "comment": "Malware payload (RedLineStealer)", "value": "26a95e457500c3abac6d020c22ebe66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111546, "uuid": "452b7f58-7952-4eb8-a179-de4b3cba5533", "comment": "Malware payload (RedLineStealer)", "value": "9460fe54d45446e6c26ce6a0fe186692b99d85b87d02d9be72777ead52669a1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111546, "uuid": "3629b33b-5273-44dc-b033-1f0ca4433bef", "comment": "Malware payload (RedLineStealer)", "value": "70d60891916dee698685f3ee842dd654aa7fc644", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111546, "uuid": "0d87e61d-176d-469d-aa61-3055815502a8", "comment": "Malware payload (RedLineStealer)", "value": "e46cc7944b3b6aa84cb175e7041764593a163b4319823e0cbcb7080bd73219f1c60a97ce710e5c26136452eae9d3a421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111546, "uuid": "e8f0df29-a9cc-4af5-a2c2-e71653aaed74", "value": "T100052212ABE81433D6B52B309CF70A970F377C518D79A39F214A6E455DB2684B23633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111546, "uuid": "1b646631-d50d-40f9-b82f-494b944bb83b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111546, "uuid": "55fc6849-3d7d-4eb1-a5dd-679003176d34", "value": "24576:Oyp50RyLMEfGGdVsDJx7vEx4J7WFmhXsHDD:dJwoG8sDJxY4Ji0hXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111546, "uuid": "c0b15493-c74d-4400-928d-bbd48dfbc6d3", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111546, "uuid": "3dc3cf4f-6218-42da-b287-9a19e1fe0590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111546, "uuid": "4227dc43-bef6-4b0b-9ad7-b11bd291d363", "value": "26a95e457500c3abac6d020c22ebe66e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62b47ab-44c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693130470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130470, "uuid": "207d54bc-3b0f-4102-be98-be60b02efd33", "comment": "Malware payload (RedLineStealer)", "value": "fd6a2c044e56f469b51d80eedbfcd121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130470, "uuid": "e7844e8f-e823-4bf6-a80b-bd83ed595997", "comment": "Malware payload (RedLineStealer)", "value": "94668dc28b9997ed211e68362e737b19c093c358d5aecd0e717fface153d5fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130470, "uuid": "56f8f4dc-4729-4d35-984a-83cec7e92fd3", "comment": "Malware payload (RedLineStealer)", "value": "1f38abbf5d205af11b992ac78f75929c8035f643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130470, "uuid": "0db6edd5-20e7-40bd-a6c8-76955283b06a", "comment": "Malware payload (RedLineStealer)", "value": "678c109fd81f1e14613aa1c996b797167dd65f333af9ab2255437716df6277290e1134b2d6e76a77018646b3e7bf13c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130470, "uuid": "6e586b37-7d57-4399-ab68-d379069a0ca9", "value": "T177E41252ABE88522CDB123B058F717871E357DA15D30C3773B41EA5E1872B80B6B276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130470, "uuid": "de7efb86-ed92-4eaa-b5f5-065587f2cc65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130470, "uuid": "a5e9f621-a7be-48ab-9a80-b3c1c4bc49ee", "value": "12288:rMrhy90sIk7NMDRJvv+nkXyLyWaoF3g9k1aCFMe9I4uUdQzF+8:CywFJgkXGyfoF/b19I1M2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130470, "uuid": "accd568c-3daa-4f41-a97c-a2f4a9ad1d15", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130470, "uuid": "6b0bb0a3-0dd8-4473-940c-f3dc43b72eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130470, "uuid": "60a8a2a1-8d66-4f28-968f-7c3feba50110", "value": "fd6a2c044e56f469b51d80eedbfcd121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6782fba5-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169449, "uuid": "4e4ef0e7-ca3a-4d2b-9ec7-fa36ff47c2ed", "comment": "Malware payload (Mirai)", "value": "e24e475fd54c30feb04644fe78490bf8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169449, "uuid": "111f93bf-0653-4cf8-a38b-aa2245442697", "comment": "Malware payload (Mirai)", "value": "9476f776ee5fde149079a074fa70c33abe8266ce1836b79cb72b7201be0b3798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169449, "uuid": "f05bd266-9601-4fa3-a2ac-243f37fb8669", "comment": "Malware payload (Mirai)", "value": "0e08b4c53275d4ec240695d8ac2f2f1fdb543a0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169449, "uuid": "76a9224e-b325-42d7-8a4c-cc6747d3404d", "comment": "Malware payload (Mirai)", "value": "437f9546f5c01c5e6b410ffc7f9fc9101afa9f3214981d60847c6178dee6de739e64653aca5b1f9200448289cbaac3ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169449, "uuid": "6f43c1fd-ea0f-4620-a0ee-b1cb9a8ff6ca", "value": "T105536EC6B4119E7DF5CBE7BE84224D0EB821722150531B27BB6FFD83BD721A48946E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169449, "uuid": "2004d9b7-4f4d-42ff-949e-0ef5d7651521", "value": "1536:kPqRg0FGTbSX5xpLepSGorsF7QhOx2X/ZOqc/yA8u:p5VHV8I9cKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169449, "uuid": "c48d266a-ad41-43c6-b435-3a7d3a2d3a88", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169449, "uuid": "dc2a8e04-c090-4df9-b18d-25516bd2e4d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169449, "uuid": "13778548-0f32-472c-ad19-b665cc58fd0d", "value": "e24e475fd54c30feb04644fe78490bf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be648c77-44b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693125357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125357, "uuid": "8b6c78ec-6750-4c53-a4cb-8502f76d018c", "comment": "Malware payload (Amadey)", "value": "5d1066764f55834be718b3d5b7e26ef9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125357, "uuid": "bc82a96f-d3c2-48fd-a37d-33efcf445662", "comment": "Malware payload (Amadey)", "value": "94875390ebd3276de89cd5acf96a043f39c3d449ddd13d750b5294ee6a271c0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125357, "uuid": "d8c4f778-89eb-401a-91c8-0e8b66dabadc", "comment": "Malware payload (Amadey)", "value": "7bb12b3d855a217ebd983d8ab2d37b16875e2d69", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125357, "uuid": "9eed8478-9850-43d8-a05c-1aa9051771a1", "comment": "Malware payload (Amadey)", "value": "a7d102d1d1ff5b14ca6846e5d35fec0f2a15f9f8fad6133cead2c8397b80758b2888d1b622968a644a916ed088165c5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125357, "uuid": "2345f432-5da7-42a6-9aac-5d10176331d4", "value": "T16C65231382FE8021EEF82B7060F21BC71A7978E91ABC57AE574E95491DB3594E631333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125357, "uuid": "e889c517-8c91-4f9b-839f-8dc431c5227d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125357, "uuid": "87624ef8-a47c-4233-8bef-28b5c7eefd9e", "value": "24576:vyXzCWaiIYPvjtcOe79yKyRTny49JyHyzS5Vbb+ZugHNCx18DWaYAvtXEKVbugtv:6uFwztcOe5yKyRTnr9J9iloKx1QWdmiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125357, "uuid": "4747abd3-9fd3-4bb6-b619-30646e25da16", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125357, "uuid": "f562a89a-6d88-4a34-8e07-36f9db0cfc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125357, "uuid": "3ffeb6d4-67c8-4d84-bdb5-1af565000a6d", "value": "5d1066764f55834be718b3d5b7e26ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e6f187-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175085, "uuid": "7faff4e4-d0e8-4187-a487-98e5500d4064", "comment": "Malware payload (Mirai)", "value": "a55858d9c7aa04c37d2976cdb79b2f47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175085, "uuid": "737cc46b-9b2e-48d7-8969-b38e9be54c28", "comment": "Malware payload (Mirai)", "value": "96f78b83514aab04c66b513c1a29d6dece169308458b67de1396418a84a513be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175085, "uuid": "a7763319-f40b-4239-837e-5971242ae77d", "comment": "Malware payload (Mirai)", "value": "976ec7699be20d15b0d3cf763aa4f6a8959dda75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175085, "uuid": "de27e2e2-b1b6-4794-b022-a3bd537b8293", "comment": "Malware payload (Mirai)", "value": "550b45534e2605aa6c9bc20078455701744138bf32192e6637aa0de602b25691a02cb351045c552d84f9ae7b1bafc271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175085, "uuid": "cbdd5017-0238-4eb6-9d64-7e01a2738e41", "value": "T13C536DCAB4119E7DF9CBE77E85220D0EB821722150931B17BB6FFC837D721A48956D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175085, "uuid": "42692b28-ba02-48f4-bdb9-05bbc9a0d46f", "value": "1536:sXyRgQFCTbSX5ZBLepSGYopegQxcFpqhON2P3B+qo76E8N:R1BXGpegQV8E9oOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175085, "uuid": "da784e6e-3acf-4800-ac3f-05fe295a692b", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175085, "uuid": "3ca6a56d-f380-45bb-a984-db5ba97f1e2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175085, "uuid": "81c9f85a-c209-425c-bd1d-94711c7d8a8d", "value": "a55858d9c7aa04c37d2976cdb79b2f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9d5493-452f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693178049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178049, "uuid": "66c156aa-069b-47ac-845e-ee486d719b7c", "comment": "Malware payload (Mirai)", "value": "96b097a34666a9ca4641d1dec04486cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178049, "uuid": "ff979904-a259-4344-bf1e-c0a3b2bec2a2", "comment": "Malware payload (Mirai)", "value": "970914b5272201016b4f287233dcfd178de9443b886d46c62c6f644298a957b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178049, "uuid": "b43426e9-c866-418d-92a2-ed8af8500ae1", "comment": "Malware payload (Mirai)", "value": "a996bb9e289f57260645ce57c1c8963dd9332075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693178049, "uuid": "bb0a2220-5209-4b82-97a5-d4c553ab9da8", "comment": "Malware payload (Mirai)", "value": "6e6e4b09820b3eeed4d808eaf3e2ce8c34400cb6db6a4228aaf3ec75801654863abce87a55d9d8685040be3ed093ad80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178049, "uuid": "70d46dd1-d2d2-4d38-8103-c8aabf0ec95c", "value": "T15B73399BF400DCBDF84AD33754570606B530E7A10A821F767393B577FABA0952826F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178049, "uuid": "7ef465b4-ce9e-4d61-b34e-049319c776ef", "value": "1536:HqiXJib9uvRq/Pm6zXd8B2JhWrJjEWGrTMV2WlzbAiaR3:KtuJwPm6zXJGJgWQ+zbAiaR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693178049, "uuid": "34c48eb8-3bd1-4e2d-ba95-cb723ef306cc", "value": 77396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693178049, "uuid": "f7464175-c643-4f3c-9890-6a40fd18dacb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693178049, "uuid": "4104802f-b036-451c-bf05-215a96471d82", "value": "96b097a34666a9ca4641d1dec04486cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf3b916-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110351, "uuid": "b79650e6-8541-4d90-83e9-fd56ad7bad9c", "comment": "Malware payload (Amadey)", "value": "9bfdff794b52c429fba297cd0dec6e74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110351, "uuid": "4369dc5c-c2c9-41d1-bacf-63c0119e5419", "comment": "Malware payload (Amadey)", "value": "97a50a8b075d92e5c88765d5c0aae3aaa9ec328f670cce9457f9e5a61ea9611b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110351, "uuid": "f617f6a5-9b00-4d9c-8730-9e50f044e9e5", "comment": "Malware payload (Amadey)", "value": "d7da176b7c96f626a669712485cdc38250873324", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110351, "uuid": "80f7c1e0-7de3-4422-a195-0d0d60812875", "comment": "Malware payload (Amadey)", "value": "088b5fa836445a931a4fb2e2d754cba83c3d61f2d09edef8ce3e2cb9e7b80a365e0808bd52449a0ad75b229c61636a31", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110351, "uuid": "2690c1ef-b02c-42e7-8743-675e93a382bf", "value": "T133E4230267F48462DAB91BB050F617470F35BEB19879836B234A9D6D1CB36E4E83173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110351, "uuid": "1af7c26d-104a-4fd9-a2af-3f24c160195e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110351, "uuid": "8b2f4ba4-bd59-4880-b6c5-02b6149b0828", "value": "12288:jMrXy90xCiDb8lzEvgUY1Gt7oDo7KmpJpItQD/XAHE6JYrv:Iyk0snY1dDWKAkUXx6Wrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110351, "uuid": "c3ab967f-0e80-4c95-9810-4624407a1638", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110351, "uuid": "36444c47-4253-42c0-9d86-74ebf4a5c55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110351, "uuid": "dcb3ed29-c9cf-4d13-a548-06aea31400cb", "value": "97a50a8b075d92e5c88765d5c0aae3aaa9ec328f670cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2574080-44c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693132289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132289, "uuid": "e1c11981-9e69-4307-bfb7-f3011d7eaa41", "comment": "Malware payload (RecordBreaker)", "value": "aa32d2c62a75a34ef83e584ab3a448f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132289, "uuid": "4d56853e-f20b-42d6-8403-36de7db1c853", "comment": "Malware payload (RecordBreaker)", "value": "9803731e075df4e1c00bc1e62794f1cf8f68158681020b50d37c008e03ba723d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132289, "uuid": "987aae77-a83a-4f78-bc11-fec3e6b7ffbc", "comment": "Malware payload (RecordBreaker)", "value": "698f65cc06f7c460a6a19d7b4690dc412d26b963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693132289, "uuid": "df3f2702-ef20-4005-b89f-8481e542b062", "comment": "Malware payload (RecordBreaker)", "value": "155671bf7ac9a1c7b8498f4fc8c25a988eb1ff7f3f2eb3599d90f019aca41aab8539fe24c6ff3279f76a7cb9e3ed323e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132289, "uuid": "7f86e1cf-a1a7-45a4-95c3-b08490284ee3", "value": "T1AB8329D295B0D40BE5C0D873719EE9326279FC3E0A24B9536385C312896DA935DFB3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132289, "uuid": "8344f15f-ba1c-4c42-bede-121157fe8a25", "value": "9a4ec0dad65bdd0dc1e6a802e6362fd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132289, "uuid": "e99920df-d849-4849-a594-c28be6d90a51", "value": "1536:7MDtfn4xngxeMcBWaiUTyBS4/HXdS34WgPhZIK4wfAet27B8FnQ2Xxubl:oBfnbROWai0yBS4/Z55x4iAV7m5rXxuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693132289, "uuid": "3470555f-7fd4-4f67-89be-018ab745c860", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693132289, "uuid": "889d0f18-0476-4115-b750-1fb80cc0e655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693132289, "uuid": "54ca6466-0c24-43f2-b258-e3daf6aa9922", "value": "aa32d2c62a75a34ef83e584ab3a448f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18441ecb-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110046, "uuid": "19d48192-016c-42d2-a87a-e1c42f132d53", "comment": "Malware payload (RedLineStealer)", "value": "4f1c2b3f7674ebdaa62f0fc443ce6a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110046, "uuid": "01debcde-2f01-4756-9362-fd1f9e294767", "comment": "Malware payload (RedLineStealer)", "value": "99234f3044fe808dbc939e4e0df4198d7aba7a589054dec06df6391dea6a4c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110046, "uuid": "eb90dedf-d3d5-45d9-bc3b-98a8a63239af", "comment": "Malware payload (RedLineStealer)", "value": "93f9f0f59f52bd049031cdcec26891a8c9e223c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110046, "uuid": "9a12a85e-bda8-417f-a85d-247dfc601959", "comment": "Malware payload (RedLineStealer)", "value": "0b7c52d8680bdc8f13059dee10d192c7a69b7953daa49aa2d40f0ac546630d5daf9b2c08d76757edc31e68eb98c40065", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110046, "uuid": "e2a5931b-7df5-41d3-9cd1-1aa9df18f9c7", "value": "T1AC652302B7ECC457F9A2237014FB07E30E71BC225979566B3191ED564C22AE8B636B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110046, "uuid": "b3a29957-aaa7-476b-ae90-a27bfc296d92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110046, "uuid": "38c05be7-3519-49f5-a6b4-84e3559ee64f", "value": "24576:fygYgLRJLB8amwAKCjyZo8eouTxGhytnAyxpqajmo1YABI+3oHnYK/587Yw1J:qf+VBpkKCjyZobZiEdxwDwY0I+knl88E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110046, "uuid": "4215de9f-9e56-422b-8d39-e78a972a04e8", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110046, "uuid": "d49d3837-9a0d-4c86-9e9e-ec7f5a911ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110046, "uuid": "3321c449-d17a-4e2a-862d-5a4c5e6a592d", "value": "4f1c2b3f7674ebdaa62f0fc443ce6a30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113d6e90-4483-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693104021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104021, "uuid": "27f16447-eb3e-4890-b4a3-49e90fb726f4", "comment": "Malware payload (Amadey)", "value": "0b2245b4c1e0787f8e47cbfc8584fff1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104021, "uuid": "2f17e41e-e374-4a28-b6cd-13e0f92d1a6a", "comment": "Malware payload (Amadey)", "value": "99d49e1d94ffc97c8ebacc12998caea22819c0f0a3738eb151a033d50e461b28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104021, "uuid": "a8797271-8131-4beb-bce9-6ea7c8ac0670", "comment": "Malware payload (Amadey)", "value": "4d930078270a50fd40e0a5b4f8bc57a4830b96c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104021, "uuid": "d85d3611-1d65-4663-b284-808f2b134971", "comment": "Malware payload (Amadey)", "value": "87722e4ed0a41f0fea7265d310ab27f6501d8345a3ba8707dcdf209bcc0bdcaa0d3d66ed2db3cc3dfe068089bf407b40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104021, "uuid": "5bc349f2-b6c1-48ee-b32e-e964b647b1db", "value": "T185052292FBE48577C8B613B088B612D71B317D925D3A921B669A4D4F18737C1E23833B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104021, "uuid": "e5d1c3c8-e976-46c4-b05f-d6c688b93006", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104021, "uuid": "e72485e6-c085-46ac-a2cc-72024af5b4cd", "value": "24576:Nyq3TPMYH4RF0AJhnLpu+X+hXQiiWclYYynq:oq3TPMYH4vLpV8YW0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693104021, "uuid": "9771444f-11d5-4f22-b2a4-19ca19b5eb3c", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693104021, "uuid": "8042b2f2-e0f1-4d43-b758-bdf8f6a1f90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104021, "uuid": "7c41b978-479a-4e45-a759-1eab2fe8bf59", "value": "0b2245b4c1e0787f8e47cbfc8584fff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ccccce-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Socelars)", "timestamp": 1693126312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126312, "uuid": "999b99ef-a47a-4eb0-8015-36a6ddb1a46d", "comment": "Malware payload (Socelars)", "value": "4991dbb29f6f702174e974e8c2224c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126312, "uuid": "c31bd780-08b9-463e-b7e4-e06ceb8a6dd0", "comment": "Malware payload (Socelars)", "value": "9a84a9001644e7200e984dfc45884e3e9e87bcbd5b3b212e410dcdaaf71336c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126312, "uuid": "bce12e28-e202-4785-b810-86886e671742", "comment": "Malware payload (Socelars)", "value": "15b4874d3b8ee4c54aa44d77b92f4032be33a936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126312, "uuid": "7f9ad610-ac2c-46bf-9adc-70e0e3c15fa8", "comment": "Malware payload (Socelars)", "value": "01076b18c0c3bba95bdbd38a0101a8151be51fcbe6855b57a51e7381dbf035f76370cd190b0b70e349b59b9b81c1c211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126312, "uuid": "eeb345f2-613d-4e12-a68d-3bb3d7db339d", "value": "T18D659E11FE426036EAE3007382BF4AFE9D28EE25131850D7D3C47E695A71AE33637656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126312, "uuid": "4bcfa6eb-9751-494c-9e9a-cb0b4b7727e6", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126312, "uuid": "51f8fffb-851c-4ca2-9f3e-ba981d2895a3", "value": "24576:IJSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjVt5qBlzu:Iup62ESMTjTPjVTq/zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126312, "uuid": "6409dc2f-eca7-49b1-85c5-624a2410a6d1", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126312, "uuid": "d4b6347a-426d-40c5-ae66-6ce73ed9f9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126312, "uuid": "6f162d48-aae1-4939-9b28-fb89b2c4d0c8", "value": "mp3studios_6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3a0a05-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693103717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103717, "uuid": "d4691cd8-6ce2-484e-aafe-9ef018232eb1", "comment": "Malware payload (RedLineStealer)", "value": "483c462fb85b78ce4b1005323f16a620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103717, "uuid": "eabecc4e-5df1-4495-9a3a-79638169d480", "comment": "Malware payload (RedLineStealer)", "value": "9abb94407f7bc5d48aa29254dd0bef8cbdb925febda7fc159db70a1819193b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103717, "uuid": "705ea747-ce6c-4337-a726-bc6296373d1a", "comment": "Malware payload (RedLineStealer)", "value": "99dfd354dc76dbf43eceb4e7940f81193c61fa1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103717, "uuid": "3ba360e0-c37a-4e8d-a5e2-6d00af3a2afc", "comment": "Malware payload (RedLineStealer)", "value": "1d7a14b477d242e90c4ed2cbd6d3c3bd80ef3cb5291d6237abd252269fd38aacca909c40b9b4047f00d91aa18eea09c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103717, "uuid": "01c18bf2-3cb1-45e2-a524-3fbd97c319eb", "value": "T195152352BBE89472EDB107B01DF507D74B393C61592C93AF3B59A14608B2E92F83136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103717, "uuid": "9feed636-20b1-4f29-9507-6513a083271b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103717, "uuid": "4f609fbb-afe3-4a96-a54d-33670b78ac86", "value": "24576:3yBdDSH4a1Ki5GLoPfspr4M+HZChXmVaLDjhjdK:C20i5GEPu1n9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103717, "uuid": "ec0a9348-5012-474c-a60a-2bdc00a99cad", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103717, "uuid": "347f3e8a-6ddd-4e0a-ac85-eeb50a871d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103717, "uuid": "8ce89c97-9939-49a9-a5ca-ba9e656b3ec5", "value": "483c462fb85b78ce4b1005323f16a620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d2b974-44e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693143992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143992, "uuid": "f9ad48bc-e468-40d2-a853-3774517280c4", "comment": "Malware payload (Amadey)", "value": "dde3d51855b908fb7010dd226e86e2f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143992, "uuid": "871d2e1e-66be-4e67-a64e-d0f0cd7867fc", "comment": "Malware payload (Amadey)", "value": "9ccb9c94bce92b679c1aea1db4e4b561e16555b34e712073e8f4f302d83778b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143992, "uuid": "6b2c5e4b-975c-4e90-8633-5f1da2b82d46", "comment": "Malware payload (Amadey)", "value": "40b32d26429fd0e076408fa61f29c3fd3e9d19fd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143992, "uuid": "4191d8d4-25e8-4fd7-a055-3134818fc589", "comment": "Malware payload (Amadey)", "value": "4885c8ecf9b52568f928b788aab43ec798bac1bff07d5dea2d83938f964575549513ee742916837e314cf9e93134e4fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143992, "uuid": "fc35a84c-debf-4d08-8e0a-afb32cd03965", "value": "T1E574F153ABE98171E9B91BB058F603C30B3A7CA15C78835B2355684E0E73690E87277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143992, "uuid": "c3ce3369-7700-4b9d-8168-ddd25cbd3366", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143992, "uuid": "fc1d539f-463d-416a-aa37-509582dc519c", "value": "6144:KNy+bnr+Kp0yN90QEaUGKZQ0dkW2nZNWhfTJWBn43l0gDJ77O/HX00LUP:rMray90IoW0PfTYB43l06s/HEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693143992, "uuid": "0cba5a79-8861-4c38-ba5b-588a09ab4baa", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693143992, "uuid": "f8a5fe7a-a8ff-4eab-8232-dc01afe5661d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143992, "uuid": "30c19a8f-3b19-4953-accb-f35f8e6d0380", "value": "9ccb9c94bce92b679c1aea1db4e4b561e16555b34e712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562d32b4-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169420, "uuid": "c16574bb-0ce9-4efa-9487-39d1c93b5132", "comment": "Malware payload (Mirai)", "value": "266a3deee48c59ddf03b0eba3d7f5140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169420, "uuid": "c3a8dc93-8c67-4511-bcda-11f7b455f7fe", "comment": "Malware payload (Mirai)", "value": "9d8a5a1d9c01a7188f083c5b0d578f14b31ed288cd72ed81a2580f4d9fdfd09e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169420, "uuid": "90d73869-5dd0-41a4-be32-139a8aafca2a", "comment": "Malware payload (Mirai)", "value": "c60b5c7142830fb38b8a42a7e3ca64408ef2d482", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169420, "uuid": "124490c1-152e-4546-9bc3-92a15227c003", "comment": "Malware payload (Mirai)", "value": "5c8430f2dd518a01ec7a1558076ffbabe924df74fd3036a61dbab5d69fc7a04d55e021f7c78a573234e6c041cf4e6d0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169420, "uuid": "e51c666f-80c0-4a5c-930e-0a0ff6771b1e", "value": "T120C2E048F0419E45DEEB68F02D44DAD7FFA06F5EAA228E80769413D25E4D2674306ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169420, "uuid": "d6bf25a4-07da-4826-b5a1-0bf5ac1256b4", "value": "768:wVdafO76jpmNJJKehmA7trpfIX9KeA7Pwr7Q6S4uVcqgw09u:Aam+AnKehPRa9aK7E4u+qgw09u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169420, "uuid": "8ad2727a-cac2-4e4d-9e45-21c29b3f1687", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169420, "uuid": "cfa136d4-edbd-40fa-ba54-9ec6aaae0aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169420, "uuid": "8e967591-d810-42ed-83af-6470b278b8d6", "value": "266a3deee48c59ddf03b0eba3d7f5140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c804cfe5-4532-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693179490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179490, "uuid": "46f3b51b-548e-45c6-a841-af225e79ef45", "comment": "Malware payload", "value": "30d33bd5d9ab22160d2b2701f9817844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179490, "uuid": "46fe1b58-6082-46e0-b1f9-38cf6c0f0e43", "comment": "Malware payload", "value": "9f3154e4f37ebd257119f4ae53522594b9d9f8cea1688472dd60fd14a4016fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179490, "uuid": "d9debc4b-b7d2-4050-aa2b-facfa572f0a8", "comment": "Malware payload", "value": "22261ffd08c3721559016ae1c2185fed14f3e29e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179490, "uuid": "097b52a1-3b7d-4e68-b234-498d226c5772", "comment": "Malware payload", "value": "7324af49b9a33a2ab76432f4d66f4486047cea69fdbb46328035071bdca940782598359f5fb7672d587668ca2b0683dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179490, "uuid": "4a93ffa8-5360-4d62-9b3c-9fea91896f51", "value": "T11BE4121ABF68A95BCA7E87F4913100744B30A3AA6503E7DD0CC165CB1FA7BC9C158B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179490, "uuid": "dc520acf-edbb-41c8-aac5-38b36b65472f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179490, "uuid": "2081ca4b-5be7-4cd1-8dfc-3a9343420fe7", "value": "12288:9YeLarxJX6wQaMpL5RGc35pOuBz3bfQUkWAmCHK9V:CTJX6wQaot15V02pCHK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693179490, "uuid": "e1d61544-b8a3-45c3-a61c-6132ea17a1a7", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693179490, "uuid": "4022fea6-5ccc-4da3-8c18-11e5a8f3e857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179490, "uuid": "e392272b-3611-4778-b9cf-5d55ade33e1e", "value": "SecuriteInfo.com.Win32.PWSX-gen.24624.3295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce579c1-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110349, "uuid": "c619d38e-27d9-4fa4-9117-1fb72bdd3b13", "comment": "Malware payload (Amadey)", "value": "58abad0ec958c6eb12fd6226475f6100", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110349, "uuid": "1da5f98e-7e11-4307-bffb-1166348a3cfb", "comment": "Malware payload (Amadey)", "value": "a280890ce5b841957f5a590584aa29b41e7bfa629ee14c048301dc2f855b9d2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110349, "uuid": "00fadfd1-9976-4212-b29d-5bb307e52d21", "comment": "Malware payload (Amadey)", "value": "e41d5c7a0b3d475f8bd34ca6c9565f723d919424", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110349, "uuid": "c2daf61e-8284-49e7-8ede-a26efc978338", "comment": "Malware payload (Amadey)", "value": "bdba73d105f97bcd6184dbc4d5f46fe3a13a117d0ca438f5d08fce1b28a04c368471816f8c1282d979777baee9beaa84", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110349, "uuid": "0b05b29b-af21-4ab6-9412-acb95ac201a3", "value": "T14D652307B7EDC4BBD9B51730DCF202872B357DE25DA8E99A2283698A9C316C46530737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110349, "uuid": "90f84a6a-3548-4710-8b82-cc54ee541214", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110349, "uuid": "bc87ebec-b243-42a0-9ada-2b0c1dbdab01", "value": "24576:RyDlK6kZNntywCvDVRqbxKM7Lo99QJiIFU8AhgkLvuIceCrZaM5IRG991671:ED7kZNOv/8KM7LkIL5kSxecZBeGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110349, "uuid": "0d38b87b-7264-44f3-8723-150570379cd5", "value": 1465856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110349, "uuid": "3bae0fcb-aade-40ac-a036-275c7514d909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110349, "uuid": "502db927-323b-4caa-a0d4-21c1c72d0c47", "value": "a280890ce5b841957f5a590584aa29b41e7bfa629ee14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bf1b89-4475-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693098019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098019, "uuid": "4453f956-655c-4af2-89f6-c129747072b4", "comment": "Malware payload (RedLineStealer)", "value": "306bcb6f69e7d8e311fb4411803f7a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098019, "uuid": "798fedf9-5437-41ad-8b89-1ee18279c020", "comment": "Malware payload (RedLineStealer)", "value": "a2a06cfb08e9672f6e3f33bf17c570979cb966f9ab1c7c420eb2a0ff1c387bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098019, "uuid": "ecc15787-9041-4cac-8915-6a987b90c718", "comment": "Malware payload (RedLineStealer)", "value": "7d6d3c19c3288bf7694a9a49133a2448310fd09b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098019, "uuid": "37377875-17cb-4dd8-8cae-8a51ae8bb556", "comment": "Malware payload (RedLineStealer)", "value": "8a0b2e7c77dcec89c35902aca2439ed5e9681535b4f7f1e812150c1d3b41368b32ab8f5f7bfa8530fff1825fd1ade360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098019, "uuid": "d77d15b5-e540-4d0a-af05-eb215e86562f", "value": "T12423F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098019, "uuid": "97a7c214-b768-4300-917a-18795bbe6c0d", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693098019, "uuid": "49e3290b-7dcd-49ed-8f3c-f48194aac0f3", "value": 48956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693098019, "uuid": "42e2e26a-0b11-41f8-99ee-fcf968b4c31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098019, "uuid": "b009c96a-98fa-4f62-8ea5-b832c63ccca2", "value": "306bcb6f69e7d8e311fb4411803f7a29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e4ff06-44c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131374, "uuid": "3200afd7-43a1-44c7-8dd2-74782f9370f4", "comment": "Malware payload (RedLineStealer)", "value": "d2b36ecb13bea5485e11c8391913b658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131374, "uuid": "4c36d67e-c778-47bf-98a0-54c7c6dde6cd", "comment": "Malware payload (RedLineStealer)", "value": "a2ddc9a812ef124b685b33cd064ce6e5cbacaff71fe3cce0bf3a511a20eee0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131374, "uuid": "3cb1ccfb-f59c-472b-9335-7bb18019cb4c", "comment": "Malware payload (RedLineStealer)", "value": "bb4e2a2ce0fe32705a51a7a92f6b0cd85e57fa0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131374, "uuid": "bcf0bd00-b4bb-4caa-8ff1-b4fa0c0d09ed", "comment": "Malware payload (RedLineStealer)", "value": "3f76420d769294ac2f8f68869e995671a79ac315cf3a6c4080f2e3735ca9801e09e23c51386b6b8caff5e02cf4cdb620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131374, "uuid": "d95fc5f1-7aca-40ef-936c-80f232b10f7a", "value": "T184E41226D6E84031D8B61B7044F616E30A39FCF25E74866B3789AC4B1CB36C8D976727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131374, "uuid": "50b8f4e6-b402-4906-9e38-8c593005c1dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131374, "uuid": "799f2703-465d-4a2a-891d-3391cefc5cff", "value": "12288:8Mrhy901dbBZyqUrJdhM2tT/dE8iKDwvO322slu2anXIzJoS:VyofrGR9tDdE8iywvjyWKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131374, "uuid": "558bccf5-1b0b-4307-9204-b0e7ba69613e", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131374, "uuid": "20bc6925-f1ce-42d8-b64c-aa5868069027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131374, "uuid": "a65d5ab7-f6bd-4cb5-8273-1c812d52b568", "value": "d2b36ecb13bea5485e11c8391913b658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98589f96-44f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693151922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151922, "uuid": "0908b623-1c86-48c4-9224-59a39ba9392e", "comment": "Malware payload", "value": "8a620dd344dfc5b6fec4e6902748b49b", "object_relation": "md5", "Tag": [ { "name": "pw-1111", "colour": "#581939", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151922, "uuid": "56964165-2871-4494-a101-5affdfc759bd", "comment": "Malware payload", "value": "a342176ba19085a68ccb25363001ede0ad9d5302fef17ef4efbd4543c4c57782", "object_relation": "sha256", "Tag": [ { "name": "pw-1111", "colour": "#581939", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151922, "uuid": "13804305-241d-4ed0-b898-6de51407a0bf", "comment": "Malware payload", "value": "3a8c328e6f79946b5dff3765465fd7488216c629", "object_relation": "sha1", "Tag": [ { "name": "pw-1111", "colour": "#581939", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693151922, "uuid": "ebde4ed6-e1c3-4daa-9742-cd02de2709fe", "comment": "Malware payload", "value": "1562374b23176bc6823e2ea337bcae64213311abd9bf72ab7dec0e9f68c44ca9f6c54001ea3fb11bb6046bff545156c1", "object_relation": "sha3-384", "Tag": [ { "name": "pw-1111", "colour": "#581939", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151922, "uuid": "d5b23ed6-730d-4f54-b3f0-2127f01612aa", "value": "T15205239324E05675A31E35DED7DC2C67AC4C2CFBC3808DABA51A097848D12DB2597ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151922, "uuid": "c16d04a1-2789-4c7a-b3ae-cb8a33f634a8", "value": "24576:RJPk5KAZdQ6aLPWQNWaQkkiV5hS7+KoDqZl:nOZ+JWAWaQRi74FZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693151922, "uuid": "573d13d9-96f0-4294-8a00-af0ec03148d5", "value": 849758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693151922, "uuid": "ec04b4db-7daa-4073-a03c-4e74cb50ca69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693151922, "uuid": "e1cdec15-4292-4b34-a5e4-83fa05780fe2", "value": "BeatriceMillerDaughterAllergyList.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dd0f55-448e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693108832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108832, "uuid": "e0d609c7-f27f-4497-a92f-dcb2f7f7dd35", "comment": "Malware payload (RedLineStealer)", "value": "2a7916a17af41e62c70bd8f3439c640b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108832, "uuid": "52cb777c-1d70-483d-a629-3a285cc95bb4", "comment": "Malware payload (RedLineStealer)", "value": "a346604f2200cada2456d6add6e105e16f0a019373ad6f9b9d071752ce7af9ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108832, "uuid": "26156b84-7597-44bc-80ff-ecc819edc805", "comment": "Malware payload (RedLineStealer)", "value": "a607cace0a5756840dd65cb2d8a722c2be15d2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108832, "uuid": "77ee06dc-c07d-4dd1-bdac-2053b0fd102c", "comment": "Malware payload (RedLineStealer)", "value": "264d0636de57200c749ceefca2e59dfa780522614805e80ffcaeea62846aba3f753c9748bd609a56c68ff37bd45f7b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108832, "uuid": "ea6e5224-ff5b-4a1b-b154-692e3917bbc9", "value": "T17E0523157AE58033C9B51B7064F602D31A38BDA29C78536F16489C4E24F3BC5B63A76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108832, "uuid": "7288f0ec-e4ed-481f-aa4e-5d3aae0f2f01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108832, "uuid": "e79a5917-2b55-462a-872f-7b5037dd320e", "value": "24576:Ky11Q/nKLKWput/qR1KpWYqi20zRtwdipx:RzI38uxs1KpWni2hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693108832, "uuid": "1755a743-fa26-459b-90a5-7f0ff043c6ff", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693108832, "uuid": "c4781225-246c-4bbb-a73c-4bec8818e74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108832, "uuid": "03ea8edb-9f8b-4b3c-b973-2822513c0347", "value": "2a7916a17af41e62c70bd8f3439c640b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab982e0-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110345, "uuid": "5df2233c-e7a7-48b8-a3cc-69eefa618f9a", "comment": "Malware payload (RedLineStealer)", "value": "e9176d40eb4cab3019c8729a7e189248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110345, "uuid": "92b5d17e-f685-44bc-a085-9de8f4cd5bec", "comment": "Malware payload (RedLineStealer)", "value": "a38509141c482dd5c93c8b6fd3b3bbb467ba4f4a45511e9a3408f4c638493faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110345, "uuid": "87a661ba-9fa1-4021-b590-4b9e33e50769", "comment": "Malware payload (RedLineStealer)", "value": "ba5d3f7d7fbb7c7a4007bd3893f902e59ed0316e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110345, "uuid": "d48f4cbf-573c-41fa-80fa-0bd47d26492e", "comment": "Malware payload (RedLineStealer)", "value": "4a1ba4a3782e338f9500a404a3ea17fe7f5f3b1d3778ea86ae5292351006ccdbecd4e8a230bae61c683080b8bb67cc9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110345, "uuid": "32b9c217-79a3-4e66-bc5a-abb3143b67b6", "value": "T16A652303F3D99465DCB857B05CFA13870671FCA44DB842A6BB92D85B1C3AB44B23673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110345, "uuid": "2fe9658e-2656-4de1-ad3f-4a9f0757b14c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110345, "uuid": "e622588e-bd5a-4e9c-befd-f118b6961f8c", "value": "24576:HyMRoM5A1rxWhLNZKAiDwZZ9kFFSo1ohonhhf8kVJyQBzqi6g1dEOZxBN42N:SMRQYTKAiDWZ9kFJhf8kfzqi6grPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110345, "uuid": "1b0db458-0554-43b6-ac9f-8b86e6db53a2", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110345, "uuid": "1c974d1c-45c0-4b8a-8c45-6fa327e283e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110345, "uuid": "507f030f-d1b6-4564-83c3-b019064689c4", "value": "a38509141c482dd5c93c8b6fd3b3bbb467ba4f4a45511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b138f6-44c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693134385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134385, "uuid": "ca856af8-8923-4785-a696-a88cde1772ec", "comment": "Malware payload (RedLineStealer)", "value": "befb970a62bd1a464278e2c3e7ab5348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134385, "uuid": "5a064020-78f0-48c0-a90d-86b4afc45fcc", "comment": "Malware payload (RedLineStealer)", "value": "a557c6c107b6bc572e4809b2f9e673566da0e7fbcb2419f69ef0836d7f711454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134385, "uuid": "d6fd1cec-c1a3-4fd0-82c7-1881e0a4445e", "comment": "Malware payload (RedLineStealer)", "value": "df1ad52bef1b4a82523e114f13180380a680996c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134385, "uuid": "0ccef948-daf8-4b6e-9647-d2667cf74cd7", "comment": "Malware payload (RedLineStealer)", "value": "e3b90d0e2fd3916c74cdd35ad00a44bfc5324eea22f03a279feccc50b331ccc5edc80204a9332ab75a41ea672f091678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134385, "uuid": "adb92418-cbac-426e-b041-7eab4da8c29e", "value": "T1A165238BE6D89022CDF617B084FA1E435332FC955D78874A2395BA6F2C727C4A831776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134385, "uuid": "289a0f6d-17bf-4c70-b6db-0c160e0eca69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134385, "uuid": "e8a081d5-1835-4368-94f0-a6bea91282f9", "value": "24576:Ly6UAouf6OlCcTwr3A7/cxqrKea690n3qj6Qo3AOMiJXGBranr5LlEKdrTSDqUzz:+huRBMr3kpKea69OPjdWBO5LJdrmmUza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134385, "uuid": "561df05a-c851-4173-a31a-baee132be311", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134385, "uuid": "951adc1e-d5cb-4daf-b40e-05fb90bb1eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134385, "uuid": "63d52d39-edbf-4e67-8395-bfa1d706232d", "value": "a557c6c107b6bc572e4809b2f9e673566da0e7fbcb241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460cafa6-448e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693108834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108834, "uuid": "1cac2d29-0bd8-4d3a-bc3a-ea51e01df84c", "comment": "Malware payload (RedLineStealer)", "value": "c797a8948cadebb71e6485b5d27eaff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108834, "uuid": "29c18d1e-6c39-43fd-8987-d6f20d7c5648", "comment": "Malware payload (RedLineStealer)", "value": "a8020b0133f627710e54fbdb0ec044fdfd08a0865d6f8bed98924db7f04718ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108834, "uuid": "7f9ae11b-2799-481b-9065-0909448b35e4", "comment": "Malware payload (RedLineStealer)", "value": "283a337c4a4868e3cb0f673c9a40cfaf767affa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108834, "uuid": "f151b252-2dd2-4e72-9968-98bbed6f47b0", "comment": "Malware payload (RedLineStealer)", "value": "e9071d617336dfd11fcfafca2af6b21c32ef8fba75b048cc9704b70d9e84ce55e58ea9a34d44f173cf185fa8c4294cee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108834, "uuid": "b755a26c-0ee8-4092-afb9-401ea802f12f", "value": "T1CC0522B1EBE405B3D9F11B706DFA058309367DA098B5C37B2B893D4A1832695783973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108834, "uuid": "8fa26366-3f75-4f9e-b79f-4fe844fda882", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108834, "uuid": "a288d9d6-7ff7-4c2b-9ef9-e67355be832c", "value": "12288:JMrpy900T56seqKRkGt98DT0QeHsLtwb3EaLWSARewlRfY45dZ8/KAGgxb3GGzt:4yh6rjku9UT0QeMLSAXfYAU/bWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693108834, "uuid": "49df9ba4-ae64-44c7-ad84-eb7c5e793d31", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693108834, "uuid": "c5ca3319-8831-4091-8cc0-143718ebbe52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108834, "uuid": "dbee3f9e-3360-4a55-b1a6-7080db6a8da9", "value": "c797a8948cadebb71e6485b5d27eaff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f85cd4-4479-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693100113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100113, "uuid": "8fff6394-9c81-4671-b954-1ecccf791cd3", "comment": "Malware payload (Amadey)", "value": "19105c26d5944b481255da0a74b41258", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100113, "uuid": "00e730bf-775b-49b9-afc3-6a6687f508c3", "comment": "Malware payload (Amadey)", "value": "a824980e12eb3d90a3eb21d33664799ffb2008b7a43febf4a4bc73287aa915d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100113, "uuid": "baaf46fe-4219-4964-a54c-97b483a5ffce", "comment": "Malware payload (Amadey)", "value": "0ebb7e605c412e14bc21724fe6c587cf4b3bb2fa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693100113, "uuid": "94faacc0-d806-4c69-ae3f-8da7f6d17143", "comment": "Malware payload (Amadey)", "value": "7163b1372a6ed5fd406872558c30045d801a8956d84744261bc86e5064d5207b0cf2b45485df34e697dce698eaa98797", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100113, "uuid": "02e610f4-b328-41bd-9fc2-ef57be86bbb1", "value": "T1A4F4125263E84573DCF51B7068F702430B35BDB25835876F3786AC5A0DB3AA4A83A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100113, "uuid": "882600d0-fc68-4930-8b52-1d2940109448", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100113, "uuid": "dd8d777e-5dca-43e1-a6b3-497b37a7a8b8", "value": "12288:4Mr1y90GWlc9zi9clUPuSHLjtmnwQXHjpQJDFlPjRARE4fEO45OOARTcA3C:9yAcRi9cMNmnRXHjpUFlP1ARE4f3gpA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693100113, "uuid": "3181e062-2bad-44fd-a141-43a453e977cf", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693100113, "uuid": "943f2f02-0cd5-4b5b-85f1-57616a53bf5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693100113, "uuid": "e0e8592a-e17a-4ac5-a0e5-c33456da3876", "value": "19105c26d5944b481255da0a74b41258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89838724-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175090, "uuid": "2a466407-9223-4b4e-921a-4460155ea722", "comment": "Malware payload (Mirai)", "value": "5dad5f2dc74319f0ac36d618785c3400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175090, "uuid": "8ff26d98-e672-47fa-919e-02b7e043b322", "comment": "Malware payload (Mirai)", "value": "a831044bffebe0bd60a1244a0660f4adf7f81c7bba597ecca71e29294ccd6c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175090, "uuid": "763428b5-a600-4888-803c-c44f0674b219", "comment": "Malware payload (Mirai)", "value": "89179d234ef7a01bbebb0def355ae8c64d713c65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175090, "uuid": "d631762c-09a1-4578-b55f-397cc38ee9f2", "comment": "Malware payload (Mirai)", "value": "4b9a09e44fddb954817b8feea8d0831d4053d9ebebccd2fff4748d51e7e8681c5d73f6557b573bff66cf5329783fb9ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175090, "uuid": "fd2c726e-3f89-4e5f-93b6-f53c9c72b5c8", "value": "T1ED539FA5C5ACAD58CB1445B8B614CD388723F408A5E72EFBD646C796800BEECF1587F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175090, "uuid": "56276f94-fe86-4256-8ee7-56f26c34d719", "value": "1536:XaoJRnrB/mUU5XtiYmG6u1KUDYofs3Qb9jQrNUxb9CH:XHJRrBeUUfw9MXBf+QJjWNUxb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175090, "uuid": "31cbff56-0d9e-48dc-a56d-167c24c7e7c3", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175090, "uuid": "b93e45f2-276f-4e69-8e93-f21c81483923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175090, "uuid": "f6d5e51b-033c-4f19-85c2-8f9568d951bf", "value": "5dad5f2dc74319f0ac36d618785c3400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa158305-44ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693136490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136490, "uuid": "b9517c72-edfb-4f6b-9e5f-7b48792125ef", "comment": "Malware payload (RedLineStealer)", "value": "024fb8b9eca22be56246210fc49b2b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136490, "uuid": "fd8ba7f3-d6fc-41f2-918f-325eea339575", "comment": "Malware payload (RedLineStealer)", "value": "a8a932d2c475bbcda7bb5939b9c7a22831fc45a4353add6b6bd7548eae8b9e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136490, "uuid": "7172dcf1-9121-4e50-9e2a-af505ce6fb5a", "comment": "Malware payload (RedLineStealer)", "value": "dcaa41b241d8cc5f9ee2a1a0115081b78e425087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693136490, "uuid": "c66dbcee-eac1-4c90-b4c2-1deae8c259a1", "comment": "Malware payload (RedLineStealer)", "value": "1649326175d2d24fa0196b4ef0829261342cda7653b17eb0eb43cac326147889b23406af781b4db6e45786c6672feeab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136490, "uuid": "7b6ebdb5-a4ea-4e52-8344-6e6172307c28", "value": "T174653393B6C68417E9B223B058F907830F367C954C3957BA3785F8264B73A91B6313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136490, "uuid": "8e77b391-f535-4f83-a9a5-211739067973", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136490, "uuid": "c43a4302-f173-4a2d-8df4-c284cf4c837c", "value": "24576:yyHpc/ypnax2LKnPlD/61182JxuvM0j3UFketoPuUEL5O7F7z4AzOWUBkdFf0:ZJkyMMKnPlD/6HLJ800jEaGWuUQ5YF7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693136490, "uuid": "a1151df0-6eaa-4cb3-9d6d-21c33f4ef1f5", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693136490, "uuid": "b53e407e-5dd7-4359-a2c7-29029ca5a9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693136490, "uuid": "b2443f04-9016-4dbb-97a3-eb63928c5c49", "value": "a8a932d2c475bbcda7bb5939b9c7a22831fc45a4353ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5a6bfc-44df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693143689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143689, "uuid": "e5aae4fb-caf7-49bf-823e-c79ec9dc82c5", "comment": "Malware payload (Amadey)", "value": "970ce3917ec04f1886900544a0ad84e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143689, "uuid": "36e6ffaf-97fe-488c-9130-866419d70d9e", "comment": "Malware payload (Amadey)", "value": "a8cd534bc310d41758ca3b8cb7a0ad2c45bea7ed6f8367c5869aafac84a0831a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143689, "uuid": "08f25e33-617b-4c4e-a69f-ba6f82353b82", "comment": "Malware payload (Amadey)", "value": "4e87cf45c64299be81f85ac6a5e152eaea9bdb38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143689, "uuid": "3f95b716-4c59-4efa-aaee-9ffbaa2a3b6a", "comment": "Malware payload (Amadey)", "value": "312091847f6b00edb27e32816ef136786d356b7fd5a58939c8217d4851963a655f45e9ff97568728b3a445de3cc39876", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143689, "uuid": "86760c51-cfae-418a-8441-a2f675a6681c", "value": "T13B652301A6D805A3C8B52FF159F303531A357C725978CBBF6A1558EA0A33BC5B83637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143689, "uuid": "6f8d11b9-a649-4acc-be17-77783c217b8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143689, "uuid": "7294020d-8486-4dd1-b4fc-c8f20f80d4bd", "value": "24576:7ydY3q43To+u4NVKp4tS7Lm2av2tPGfIO/Y6gUxnfKkdzRbSy8b7il1f2ofiRR:uEq48bgKp4tSW22wPGD/Ngwi6zV7mIV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693143689, "uuid": "b24193c4-879e-4ae7-bbcf-4c57f22a3578", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693143689, "uuid": "4bc1c5e5-152b-4803-8d5d-3aa03c5daef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143689, "uuid": "6dc00214-26f3-4ab5-8746-86e59044de76", "value": "970ce3917ec04f1886900544a0ad84e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b21555c-4495-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693111849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111849, "uuid": "cd47adef-eba3-4dac-8c31-621432f0ca3c", "comment": "Malware payload (Amadey)", "value": "ddc8a04fdd13ba0acd77dc3eba762146", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111849, "uuid": "ed9fa5b4-3eff-49f4-bda7-f91a3b730cb1", "comment": "Malware payload (Amadey)", "value": "a8d4826c1da6642df5afe2544e7a101e4fedfe15f89b136785fdaf66e61d9315", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111849, "uuid": "4b275446-5fd6-4a18-9b25-1c7c98e72dac", "comment": "Malware payload (Amadey)", "value": "b052adabb6f6335d0be7844d3f67a3c63725b4ea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111849, "uuid": "cf75fa08-a1b1-4308-bccb-03b0bb2718d4", "comment": "Malware payload (Amadey)", "value": "78035aab94800af5c7ca52c8db42e700a5d28f995eb8b8fc6c06693d9146999bd9f9f810b6ac5e67879ff7f6e8adbd70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111849, "uuid": "e96ccc8f-bbc5-4677-9522-f4c62ac19bf7", "value": "T1DF652307EAC98412E9B9677088FB07C30A36BC614D7592DB3715A45F2E3369098B3B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111849, "uuid": "f9802c07-9c7b-4bf7-b873-a6391ba81e06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111849, "uuid": "0e421ef8-5c15-4562-b611-40f5ec9d1c2f", "value": "24576:Sy/yHqgTMlTXn9pmhxEK1Ga2c33kCQcxg46WL0ybPnlcUqP5xPS36m4iLvq:5/eolTXnPIxEK1GaX3RDwYpcFPjSZRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111849, "uuid": "b27da18b-131c-48fd-ac1c-86e340d49eee", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111849, "uuid": "0df61586-11f0-4947-8052-85e5cfa057d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111849, "uuid": "9e429307-0dbf-45e1-a073-be479b5202f1", "value": "a8d4826c1da6642df5afe2544e7a101e4fedfe15f89b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7788efb-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110340, "uuid": "babaec73-3f10-4e79-af55-1845db676667", "comment": "Malware payload (RedLineStealer)", "value": "fb751ead5d91e36af5534d55611e66dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110340, "uuid": "31c623be-ea1c-408d-88d3-854475b05b2f", "comment": "Malware payload (RedLineStealer)", "value": "a9b568f641c14a7801feaa74cc02b99333dd84592d2c53033e818b221015ac71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110340, "uuid": "766121b1-57c4-469d-ab54-6e94359c4176", "comment": "Malware payload (RedLineStealer)", "value": "9c821b5bb93aeca5687e8059c65ea835a590c3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110340, "uuid": "f35f6324-0232-40fd-8b7b-b1507ea89b0d", "comment": "Malware payload (RedLineStealer)", "value": "24eb0bfe67e96af2f19e76bc6ce19e2909c6decacc792a8e032cf8899534833ff01f690339569c43d2561b8a3968c80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110340, "uuid": "7947c070-34ce-472a-8854-0b264460cea1", "value": "T10BE41347F3E85532E87927B058F707830B397C625E3481662B99A44F1DB3AD4A93633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110340, "uuid": "62d8d5ab-d486-4a32-af2e-d2a01deb3e37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110340, "uuid": "9350515b-c6dc-4c5f-8877-288f7d0eef65", "value": "12288:4Mr3y90VZnT0h5WlQ+8ksEtDBxjdJ9pjcsOfIbAurr8FZs789NZ5ysO6YLL:fyABk5Wlr8ktDNWsOfIMucQGNZEsOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110340, "uuid": "ff6c2fad-a5a2-4ebf-9826-fae2378658ce", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110340, "uuid": "829717b5-3db7-4b3f-bc5e-b2b48c74c915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110340, "uuid": "4ebfc9b4-7e23-4af7-8a69-c4adbb039454", "value": "a9b568f641c14a7801feaa74cc02b99333dd84592d2c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a9a59b-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175103, "uuid": "dcbea9a6-5126-43d3-842b-27e273e91c1b", "comment": "Malware payload (Mirai)", "value": "9412969e2a2fd958164a9a9b36350f14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175103, "uuid": "fedd497e-3cd6-4042-a32b-02fa647d0150", "comment": "Malware payload (Mirai)", "value": "a9b56934e17aabdf5fd542cd2f334b366b31f8eed1bc3cf7190ed62ef24362f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175103, "uuid": "db761f53-743e-4800-b5ac-cbdbacea5790", "comment": "Malware payload (Mirai)", "value": "44a8e8a22193d08d17274cb572bbdc8841f3e9c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175103, "uuid": "a16e03c2-3a76-4813-ba18-e264c1cab1c6", "comment": "Malware payload (Mirai)", "value": "4bc1231757005dd496fb23e9f9e13bf78d37240ecee2afa3010f53a453c9add5b9e977065f8706d74788b91c3b83c3c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175103, "uuid": "d3e8d5c4-2cb1-4096-8bc5-57db1d410660", "value": "T1A2D2E0AC3AD5EAF7CCCD8679B61F5079700E74ADB2F29332B705C9835A5A200D622D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175103, "uuid": "ee0551be-b4bd-4a85-a39a-b1794c938b00", "value": "384:MPd/PxEDLd2Tw0/zK6lowYcEaqsN9OLC4t0LomNw2XYyXhUEWaRm942ENyF:0lxKd2F/TxEnsNY2OQNwqrWakqOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175103, "uuid": "77684962-fa82-4f67-bc93-26bbb31496c7", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175103, "uuid": "a1180070-3d3d-4a75-be59-18d657e8a70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175103, "uuid": "c9fc7b74-8093-43db-b4f4-9d58b781c611", "value": "9412969e2a2fd958164a9a9b36350f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49549341-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169399, "uuid": "9e75e88e-5fa5-44cb-941a-5c3e2cf03d43", "comment": "Malware payload (Mirai)", "value": "7d24defd84a0772c0af915003cc1f0ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169399, "uuid": "fcdcb13c-2101-4e94-a4fb-5a14a45a3138", "comment": "Malware payload (Mirai)", "value": "a9d91deb57a7f2df540bf19ef96198fbf3da2eddbf094ad5e31f261e73aa83ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169399, "uuid": "32e15eb7-e722-4ba6-b84f-89d0d6cb1556", "comment": "Malware payload (Mirai)", "value": "90d28fa4381a53d130a59e6de2e2b82a4a9c6e57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169399, "uuid": "25bd046e-5d3e-4941-9819-bda18783e09c", "comment": "Malware payload (Mirai)", "value": "e0ef6b71a27a0eee3b78019367d6883a64aa5088ec1c86f7b9d7002139cf7a83b9eb8a2fab22370aacf850fcaf34f894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169399, "uuid": "d626f82e-836f-4c02-ab30-70dbd7555c88", "value": "T141C2D07096AD1CF5C6500532E7B856C9BE434FBDFAFE3890214047BB79819052AEA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169399, "uuid": "7c968fda-0ac1-40ce-b1ed-8429e2695126", "value": "384:Elt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEIvrgCX7UsUhymdGUD:EHsoTAZ3alkXLvFh8nNEIbrYs3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169399, "uuid": "9c3d6b16-cc2b-4798-bab5-fa34c9276b5f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169399, "uuid": "0797a143-c0d1-4c23-8046-d1e8948a0800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169399, "uuid": "437e9088-3bf4-4f46-82f4-3ba7e6764137", "value": "7d24defd84a0772c0af915003cc1f0ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe60cb7-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148197, "uuid": "73824706-f5d5-4d82-9811-b7b2b2b77874", "comment": "Malware payload (Amadey)", "value": "af140db55f27ba0da1b4d5693859fac7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148197, "uuid": "416141c6-343e-465c-940f-d8669078af03", "comment": "Malware payload (Amadey)", "value": "aa4d4d1de666870d49ff542b95d935dea9beec8e88163b96a30e549a98365369", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148197, "uuid": "0a1b8f8c-e057-4255-b5de-0280141df073", "comment": "Malware payload (Amadey)", "value": "6517627a105c548299181455f25febf69470e8af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148197, "uuid": "fa300b09-d325-496f-b28e-b4197cecc50d", "comment": "Malware payload (Amadey)", "value": "194c2f4cdeefd17a2456939cffe1d16cddfa3697868ff62bde8d1b778c29078b57a91006d21d8f99258052bd79e4c95a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148197, "uuid": "f95fc895-75af-401f-913e-a91e3e60162e", "value": "T1D1452383FFD94072E9B227F019FB53832A757CA148785B1E7792948B0D3229161B637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148197, "uuid": "a77de722-ce46-4b40-bc86-197392a38e8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148197, "uuid": "36058483-90aa-4bdb-83a6-ae72d5c2fdfe", "value": "24576:hyO9NoXzvebTo/4di4KhzZPTM/IaO41Nrvc4SwOojw+lqFmU9Ht:UDjQ84KhzZw/nvtSak+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148197, "uuid": "f6e82de9-fe6f-436b-9cbf-d26a0b7abce5", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148197, "uuid": "07037092-3ad8-4b5a-8a11-609a4895fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148197, "uuid": "9263f87d-38ee-4b25-8b5c-900041ea92a0", "value": "af140db55f27ba0da1b4d5693859fac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fee5725-4489-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1693106730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106730, "uuid": "973e1ddc-7326-41f3-b1f0-7b988e2c6b83", "comment": "Malware payload (Gh0stRAT)", "value": "1b9679811077ada32d3ebae3a22f4b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106730, "uuid": "1ca6f0dd-968b-418b-8d56-2d92389b1db6", "comment": "Malware payload (Gh0stRAT)", "value": "ad054b7da89bc9b79659fa19a87f51ed568062b3c7a0918e2db01b3e6f1a62c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106730, "uuid": "650ccb04-dc23-44d5-b3b9-bd2ef9aad1da", "comment": "Malware payload (Gh0stRAT)", "value": "cf4dd6f6851f62288efb642ae6170777a1ba7a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106730, "uuid": "6e73a1f5-ed21-41cb-92aa-099ebd4c3862", "comment": "Malware payload (Gh0stRAT)", "value": "503f17fe5653d51adecc25b78b42297dffa5ccdc773c95d1e7a33be3bb9f7a546c3927fea7271a56af4d496a2a5ded1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106730, "uuid": "48affd30-e012-4daa-a908-646b75b776db", "value": "T1B1C37C02F68540F9E5A5657C14AB3B37E63BB8A44B094F837B39EDB50833554BB2234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106730, "uuid": "ff37c8ad-4aa6-4d4d-ad23-397657e50570", "value": "6c726cd908868e58ce86922d0f0bba51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106730, "uuid": "6f14dad2-7882-4af6-96e5-93ccaf8815b7", "value": "3072:6FYbEAxEIiW32nsHtoanTDDYjtRmyJgmDcbZhxM:6ySI+sHtTn/StkPrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693106730, "uuid": "1fd58377-28a3-4cbd-a856-70914fa6616a", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693106730, "uuid": "4b8d4419-9751-419f-be06-49bcd0c6e679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106730, "uuid": "2b410856-b459-4f30-8975-7f93c5dfb9a7", "value": "1b9679811077ada32d3ebae3a22f4b55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38599fe2-4523-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693172806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172806, "uuid": "f05e0726-92f7-4a1b-be54-cebbf1c7b950", "comment": "Malware payload (RedLineStealer)", "value": "56f6e9dcad58458d3975a095cefbb20a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172806, "uuid": "45a39345-ce19-46ed-a41e-120b964af3ca", "comment": "Malware payload (RedLineStealer)", "value": "ad4be18a02f7e12088e87c3c8a1139c583fa1d08dd3b7c162ef2e90b3022eb69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172806, "uuid": "7b82b851-e75c-468f-81cd-628e9eab4ec7", "comment": "Malware payload (RedLineStealer)", "value": "96747b89dc1dea18c4dd06a18720bbabfd3cdb48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693172806, "uuid": "00d3dc68-ceec-46c4-a1b3-3a3745cdbc4e", "comment": "Malware payload (RedLineStealer)", "value": "1d2ea2d9031879a95bf9c3273809faa22ef933c7bcad296ba2da69e457dfa82bb36926f07ce1d30ceadec7e5bc0b65e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172806, "uuid": "7c40d068-47c9-4435-87d8-1364c8618b41", "value": "T10CE41253AAF44073D8B977B014F703930F38FEA199B4426F3B84985A4A73699E431B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172806, "uuid": "8ae076be-35d9-48e6-a9c4-41bf3a91078e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172806, "uuid": "6998f482-f027-4b4e-aaf4-482158ea7683", "value": "12288:+Mr7y90ruUE6ugfYUJtOFuENlzyR85adWQXMjgQ9NrNdcnNOn:dy5UXNfZJcbl1tgYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693172806, "uuid": "319b7645-83b5-42ee-87e8-403ca9053677", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693172806, "uuid": "eb9b4c37-394f-4fe1-884e-1db9efb61639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693172806, "uuid": "6d19dcaa-aea5-476c-a3c1-86f8c33b2450", "value": "56f6e9dcad58458d3975a095cefbb20a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203062aa-44e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693146996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146996, "uuid": "c1f598b7-63b5-440b-abad-7c10046ec528", "comment": "Malware payload (RedLineStealer)", "value": "1d20db8d338029dd7be21c69bec2066f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146996, "uuid": "3709596b-4608-427d-8080-47684eafaaac", "comment": "Malware payload (RedLineStealer)", "value": "afeb270bc61fa472baf9f30b1ef6ebb94cac66ad3539eeecbde8a085583752c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146996, "uuid": "2858d68a-6d4d-494c-a752-edfb6b6d9a2d", "comment": "Malware payload (RedLineStealer)", "value": "d4d051a70b2f9e208601ed718ec286094b89cbca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693146996, "uuid": "e9bb4a0a-60db-4755-8fdf-21ded24b9061", "comment": "Malware payload (RedLineStealer)", "value": "93d231cee528762a704ceb362b7b5e653d4dd84d39ab1ef5e4eb2319a6536c3fedc941417d413e08fc4f3aa2c7a63119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146996, "uuid": "94b0a31b-e52d-45e6-a8ce-69f815589f87", "value": "T164B41242ABD98432E9F5177018F713C70B3ABDB16E74922B77A2991D0CF2684D435B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146996, "uuid": "d549d2e8-ba92-4b83-bb3e-747a0d3388d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146996, "uuid": "ca45f6ac-1957-496c-a2fa-aa34340cfc2b", "value": "6144:K7y+bnr+Lp0yN90QECargBUeEO0bc6bcmx5MIA2jqae5op9DwKQHoAOX96xTlMEl:lMrjy90aUBbbbToEfe5opeH1OMTfl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693146996, "uuid": "6665836d-304d-43df-b5de-aa7e1ff0a946", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693146996, "uuid": "5f2642eb-c270-4fa6-8a5d-ea147e84a367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693146996, "uuid": "88b928f3-1ab7-49fc-9b90-04f81ec9c530", "value": "afeb270bc61fa472baf9f30b1ef6ebb94cac66ad3539e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246ccd5e-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693125958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125958, "uuid": "4c7c3893-c249-474f-a0de-3b6f5e873ab1", "comment": "Malware payload (RedLineStealer)", "value": "03d4d4b7b822165dc01aaa6f3756e8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125958, "uuid": "821adf9c-3cf9-40ae-a5d1-1c7c3868b385", "comment": "Malware payload (RedLineStealer)", "value": "b149c90d59d836cee69adbe80a3a4ff3b7a8dbd9729bb7689a7096661eb294b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125958, "uuid": "19722e62-8c6b-41e9-91bb-08fbd296480c", "comment": "Malware payload (RedLineStealer)", "value": "1b79da419d326d31a87b61d40bdc78d9c50e5aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125958, "uuid": "f3dfb0b7-8586-4d50-b6ff-6c76f42bea40", "comment": "Malware payload (RedLineStealer)", "value": "0a1f1819e8087391451f8b2276954e865cc95d7b3f17f44c547e719bfda3b68760fdf2fd198e83d1da0f9248ec195613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125958, "uuid": "4d92cea4-dfe3-45a8-8306-d6cd07cc197f", "value": "T105052352DFDD5023E9F927F058F203530A36BDE1C97C83AE2740A91A09B26D4E5B17A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125958, "uuid": "478525e8-5261-47c0-8be4-c42c666a2e31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125958, "uuid": "ec329b16-9068-4bbc-9a7a-605f7e489592", "value": "24576:cyovFMpTgjsBhC+N7RVucF/lne3dYqYIQIkU:LXgQBhC+N7Rf/wNYqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125958, "uuid": "526b2277-9d2f-4447-9ba8-9799469b2432", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125958, "uuid": "1914f663-e0c3-4d8f-93fd-eb2db0976a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125958, "uuid": "f854e075-e581-4853-9438-8df619a498ca", "value": "03d4d4b7b822165dc01aaa6f3756e8c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ed8b05-4486-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693105525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105525, "uuid": "90ebee82-a9e6-4fe3-a659-0113d7c602b4", "comment": "Malware payload (Amadey)", "value": "f330260811d3a830e4e5f66ad614756a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105525, "uuid": "d2e373ca-52c7-4bb8-8023-cc25f1108eea", "comment": "Malware payload (Amadey)", "value": "b192059ce3958b9b7437bd659e646091de3d8d155a8f8c469463f6acc97b578c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105525, "uuid": "a0809399-a3b1-45e7-837d-5791032636d2", "comment": "Malware payload (Amadey)", "value": "a8fb8cc26571484017a36740fdc90c96df1a0755", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105525, "uuid": "5719680a-488a-4749-8062-d10912596cca", "comment": "Malware payload (Amadey)", "value": "ebdf611f1c30d3b6b42dbd9650feae38520407b565102adffa55db54b56c68187c7fb1661d35c4da5e08ee466eb4c230", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105525, "uuid": "6a03cb05-f5c7-47d9-9975-11549c1aa13f", "value": "T138652357FBC100B2DCF01B384DF613D32B34FDA06D94522627EA9D8A58636E9A436727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105525, "uuid": "e856bc44-5938-49ae-a4e8-eeb35693a6fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105525, "uuid": "a450310d-e18c-44b9-96f7-c253a91ced09", "value": "24576:7MyeS98bYKzUo/cDKFM22c58aZgihluAg6n3gzbjLDDk8ZB:ve68bBohKFM2Z8aaa6b3NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105525, "uuid": "c5e465b2-9570-408d-8e3d-23fdf6a14e2d", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105525, "uuid": "c1872cf7-771b-469b-b7b8-7fd68a2fae3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105525, "uuid": "48874311-455b-4d0f-b553-871c28140436", "value": "f330260811d3a830e4e5f66ad614756a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c84301-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693174902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174902, "uuid": "6bcfbe1f-6568-4d60-92e9-83085459cd63", "comment": "Malware payload (RedLineStealer)", "value": "959d79dbb9b9bdb16178aa9fc9339985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174902, "uuid": "7e6548f8-668e-4f27-a186-d24dbbf7aa67", "comment": "Malware payload (RedLineStealer)", "value": "b21d4a3c5b1589655459140ccce7ee8b26d290a11f10c9576ab23eec097a0873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174902, "uuid": "9d3eb2d9-bb0c-4062-b893-ca2a76e83118", "comment": "Malware payload (RedLineStealer)", "value": "0f398f36fcd82c3aa7cbca04a19528615d33c475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174902, "uuid": "08c1f47a-f518-4c34-9211-fc703c9bbfb0", "comment": "Malware payload (RedLineStealer)", "value": "a32d600cfe059f6f7c7876e2d01d32b42afb9b007f3a12f80ca40a414f6a6471e2aeb1b7066711b02d1c7854f6b3040f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174902, "uuid": "30077368-d55e-4196-a5bf-b8992e50cfc9", "value": "T12065234392E48077FAF4637484F72FD309357CA059981B753646B85A29B3AC0BCB2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174902, "uuid": "855e01cf-29b6-47ea-8ac8-008db98ee819", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174902, "uuid": "91dc0db7-a0e9-47ca-93cc-bef44288f914", "value": "24576:8yEkOG8M6Yj/SA474RKskOB/o+K65jE/RcSrmrrfJnsBodM4pBMesTJgcQJW6rDa:rEkOGcMSA4kRKskOBg+K65/C2fJsBcFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693174902, "uuid": "78232cb9-9377-48c5-8cf2-c5b1382d1662", "value": 1498112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693174902, "uuid": "6eb464e7-8988-46d7-9356-d39ad18e0555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174902, "uuid": "fadbd0d2-3c0c-4d54-954a-3f8c11c11b58", "value": "b21d4a3c5b1589655459140ccce7ee8b26d290a11f10c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2221a1df-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110062, "uuid": "aeaf2271-1f8e-4eb6-bbab-b24854a26c5b", "comment": "Malware payload (Amadey)", "value": "e75569400fe6729b25ebae1232a5df1a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110062, "uuid": "517e5650-437f-4abf-bc8b-e9cc523918ba", "comment": "Malware payload (Amadey)", "value": "b264b9fc19407a37fc1e4095263ffa25c71a25e7c9aaee276e2050b6698d750f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110062, "uuid": "206dd379-9ab2-420c-af16-e3032c2b1d21", "comment": "Malware payload (Amadey)", "value": "bc75330d9111a3dccfa87d79eee4e167144d2b15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110062, "uuid": "5ec7639e-380b-44dd-b90f-c8bf75db172a", "comment": "Malware payload (Amadey)", "value": "9adace17130fe28cd391be485f8a03f901d5ca8ac32bbb78ab5f0fcef1910fc896a7d909ec47f79a9af8f51d8a595058", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110062, "uuid": "dc6a3266-8d8d-4ba3-be2a-7a334c04c403", "value": "T1D7652346BAED4072ECB147356CBA130B1A32BC6869B4525F62D36B1F1C336D06932B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110062, "uuid": "4342de84-7f3b-4220-8724-6aeb88a2f933", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110062, "uuid": "e95636e1-498e-4567-8629-c390930b53a3", "value": "24576:uyXdCGN8kxJ1pJF/OIKB9VmHgr0hTt/KVbuKo9o0R4W5O2dS3j/aWLk:9NCyhpPmIKB9VmAghObuKGvrhdS3j/a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110062, "uuid": "60c412ac-31d4-4ae1-9c97-bac25141fdb6", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110062, "uuid": "627d4673-c5f4-4eb3-bf4e-6335ea2eb68d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110062, "uuid": "7801726b-d013-4df8-8013-04ed2a919bb3", "value": "b264b9fc19407a37fc1e4095263ffa25c71a25e7c9aae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc2d61-4495-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693111847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111847, "uuid": "1f92304f-383e-4855-8354-91852f6fb6e1", "comment": "Malware payload (Amadey)", "value": "50907f5ca2601ca04bd664c96de463d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111847, "uuid": "b22490b0-2117-442d-b200-d71880e5941a", "comment": "Malware payload (Amadey)", "value": "b2bc1ed2477f32632f4d22c004acd6de6906db9353a5f0ec67d53d282b19cb84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111847, "uuid": "c2512c28-afa6-4036-873c-699063e28a01", "comment": "Malware payload (Amadey)", "value": "dc8358dddff6a53dcbf71a8b3ecfdf505d836215", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111847, "uuid": "c4de4418-4519-46fa-b1e6-1368a4070e73", "comment": "Malware payload (Amadey)", "value": "833b9557e506a330ee4072fa73162694d57cb08abc070dbf4e427348cb3f32583d220423c933621508ab994642c9c23c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111847, "uuid": "2c259205-ca36-4cfe-9a28-b812619c84b0", "value": "T1FEE41212B7E84477D8FA273098F702831E3A7CE19E78D3576349A99B0C73A90663571B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111847, "uuid": "1926af52-ef8c-4580-90e0-1dac967e11c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111847, "uuid": "3e38d0ff-324f-48b5-acb9-4557d3237eab", "value": "12288:YMrOyy90t5lR6qdqWpeC04JsvEDy/+E8eHQNNCS/WsKI7jo16izJE1/Ld4:pyml6Me1Q/WWd0b6RM16MJ654", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111847, "uuid": "b1bf7c77-d80b-4a8b-93c1-565a39ec2327", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111847, "uuid": "26414ad1-787b-4fb2-bb56-3bcf28cb34dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111847, "uuid": "f16ce7eb-4cae-42a6-ad1c-7fdb6720c36f", "value": "b2bc1ed2477f32632f4d22c004acd6de6906db9353a5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99019317-4532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693179411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179411, "uuid": "5097e8b0-b5bb-4eea-8f3e-9a890b8a181c", "comment": "Malware payload (RedLineStealer)", "value": "8aa52b7cf6bf4ef7769bc7ef810e4872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179411, "uuid": "332c2301-c65c-4685-9774-51363fbddf8a", "comment": "Malware payload (RedLineStealer)", "value": "b41420f8ed6819b46913a73a597f3cbc480613bd664cfa9a33a2650a919fbd81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179411, "uuid": "a78e2e04-abea-4f97-a232-99653dd09c53", "comment": "Malware payload (RedLineStealer)", "value": "24411beb8381668df228be45d0df33e5e872fe9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179411, "uuid": "191e796b-2a2f-4e61-8adc-f205c93f40b8", "comment": "Malware payload (RedLineStealer)", "value": "586ab5076bdecb5166ff4557e34e4dbdc522c6b48707eccd0c02d1499bcefd3eb4f4b2cfddd9bb60cc5fc9c91fc74025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179411, "uuid": "60715a0e-bb16-42e5-b352-c31469f1483b", "value": "T1C6E41252FBD84132DAB123B04CF617C30A3B7C919D6893663B815A5E6DB3A80B572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179411, "uuid": "d506f301-2aa3-481f-ac2c-e4f42e2514a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179411, "uuid": "6a02df41-8a66-4123-a8c3-f09f3fe9eaef", "value": "12288:uMr+y90LcfSo7MjrEmbYnJWy+WjRLGlQ+vzNUnJR+MeBZiWsNOrTS1xOVHB0h:Qy9So6EXnsy94LvJIRVe36MrTS1kVhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693179411, "uuid": "7d4f926a-d6bd-4593-9683-07b1e53531e1", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693179411, "uuid": "d88a9ca5-5972-47b0-b743-5ff5903223ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179411, "uuid": "f33fe6a6-cbb6-4002-9962-44f32c99f738", "value": "b41420f8ed6819b46913a73a597f3cbc480613bd664cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c9a74a-44c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693131067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131067, "uuid": "feee88b4-c469-4857-bd3f-a3cfb92fe3db", "comment": "Malware payload (RedLineStealer)", "value": "fc7f0cb793e78eee2b224c09d221977a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131067, "uuid": "84ff6179-5243-46da-9d0b-e240d1836fd3", "comment": "Malware payload (RedLineStealer)", "value": "b4249e03216a1a13765369046a78afe988ce261afd4ca45feac62737fe22038c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131067, "uuid": "e2f42da1-ed24-42dc-ae95-d15300698119", "comment": "Malware payload (RedLineStealer)", "value": "251641edff69c40f4f2218b08f94f9f785ef5c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693131067, "uuid": "bf26db8e-e2a3-49e3-b01d-cb5e60834c69", "comment": "Malware payload (RedLineStealer)", "value": "804329592143fe277172903767519da27d3c4eb40eaca20469413e404235a3aac01afb86a54f2de96122579e15d6a4aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131067, "uuid": "be32d807-bb0b-439b-9ab6-2b9defffdd78", "value": "T1DDE41243ABE1E133D9BA13B018F506931F367CE15CB9479B2792584A1873B89E43973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131067, "uuid": "95d28ef8-1760-4e60-af4e-65ac46dae258", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131067, "uuid": "c2064f34-9acd-4f06-8922-2788b9168674", "value": "12288:UMrry90tJP/EOidbTLqeMWhGC/zEZ2UNy88Hge5aG7lE6LPhDMZxQh8:fy8p/EOCTe+788Hge0G7RPh4T9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693131067, "uuid": "bf49cf59-d209-45dd-8145-6b19877f4911", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693131067, "uuid": "1a0ea215-417b-4b55-ac82-ce3a221141c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693131067, "uuid": "75f21272-cb16-4754-b3ad-e8dc1907ac19", "value": "b4249e03216a1a13765369046a78afe988ce261afd4ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf07f0e1-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110352, "uuid": "563bbea9-dd50-4cae-8e53-dab6f4bf2563", "comment": "Malware payload (RedLineStealer)", "value": "962a8cafd79734d76b1ca58e07b0333a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110352, "uuid": "497c9bbc-4946-451d-b009-35c0a18e4f44", "comment": "Malware payload (RedLineStealer)", "value": "b65826cfd7087c8ad51e5bff5f5e2bb371d9be06e4a48ae5d9b60b874781ace3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110352, "uuid": "af47621f-db7b-4169-b669-83707effd2ea", "comment": "Malware payload (RedLineStealer)", "value": "d6324eb4d73b371d2ba76ed5f1c488b1057e592e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110352, "uuid": "f6b8737e-1f15-4f6f-b128-04e67cb95656", "comment": "Malware payload (RedLineStealer)", "value": "6349f2913f430dbe91452f073d258ff482796e6c85af407349886a83305d4ec710dee908557820fa3f0197bcbdb1dbcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110352, "uuid": "5590a83d-2e47-40e9-8ea3-06a17b10e23e", "value": "T10A652342E5D544B1D9745F3008F623532E3ABCA12DFE934B27C7994E0973AD0A8727AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110352, "uuid": "0f97c7e0-52f4-4b9b-8d17-a4251aff8e06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110352, "uuid": "000c6c91-9fbd-4c1d-9945-9381484d054f", "value": "24576:Xy5B0DXYqtdTYMqBw+FXOgKFYUsKJtJ3Lq+6pw/4TWS8iPtEIpJwlI9V/V9ZVZRH:iX0XpY/pJNKFYU3LIbZ8iPtEI3wOr/VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110352, "uuid": "012310f1-fe48-41b5-8595-11916b793f8b", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110352, "uuid": "e54a705d-c0a0-4a0d-bc77-384a2cec8c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110352, "uuid": "eb648607-aaa0-4402-be0a-395a1bf023c4", "value": "b65826cfd7087c8ad51e5bff5f5e2bb371d9be06e4a48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04224633-451f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693171001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171001, "uuid": "dd5c1bd4-f037-4e4d-a161-d50cbd39b4f9", "comment": "Malware payload (Amadey)", "value": "84f1442c4fde613597e93dbd2ec79c91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171001, "uuid": "eb6a12df-b5e5-49e9-b0f9-dfb4fa1e84b9", "comment": "Malware payload (Amadey)", "value": "b72d4716e46bccdcd0a00a93e689778a4a0f0e638e441471dc97c5e670f1854b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171001, "uuid": "7c55ef45-6066-433a-a0dc-d5f0618f9f84", "comment": "Malware payload (Amadey)", "value": "12bbdba262d4e0ab2942b1a0b63c82edfae3dfd3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171001, "uuid": "23a88434-b86e-4f49-accb-48cc24112831", "comment": "Malware payload (Amadey)", "value": "78fc60f662c8736bc7651f38b8e110e60d87a7e9b3279c9058cefbd305b507d69f25eed684aba868ba7e506a30828215", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171001, "uuid": "33c42cb7-694e-48f7-bd79-ffa881490dad", "value": "T199652303F7D26062D8FA2BF158E357D30B3AFDA14D784A1B2659586D0D73294B63232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171001, "uuid": "6ccce871-6289-4f5a-9325-78801caf9b88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171001, "uuid": "3a5e3ada-8bb7-48aa-a7d8-9542d2a74847", "value": "24576:VyAI8fQkQesAyqKprUBP06cbp+E0ri5eRf8vBV20b2lJnAswBK/mbBfRpdCM:wr81Qk5KprUJKoso8p3b2jnIppd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693171001, "uuid": "506270f4-4f68-4834-8f96-c60da8bb4763", "value": 1499648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693171001, "uuid": "20eaa60e-3701-4f99-bd3e-aedd6f89fa3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171001, "uuid": "81651b7f-baf3-4422-9c00-d5759c5bbb94", "value": "b72d4716e46bccdcd0a00a93e689778a4a0f0e638e441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99c9e9f-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110343, "uuid": "4274e25e-d2b3-4939-9afd-cd88c24f5605", "comment": "Malware payload (RedLineStealer)", "value": "23cf8a3fb09dcbb2ca45a9c19cb3daea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110343, "uuid": "71a585d0-3412-496b-b095-ea1549ef23fb", "comment": "Malware payload (RedLineStealer)", "value": "b7f0f733eded2e197059220f815d98151f53de6ed2e044047aee956eb67f4358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110343, "uuid": "159ff36b-8a3d-4b6b-a548-8c648a6b50c4", "comment": "Malware payload (RedLineStealer)", "value": "df91ff353ebf016768961a3be3dcee8cbbd4030f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110343, "uuid": "559ed65b-70fe-489d-beb4-acefc7a6e99a", "comment": "Malware payload (RedLineStealer)", "value": "60885eb85291fc9a81b60fde5465af559c4fd5f743c6a3964222dfecbc5f33839aa04a3c23f6306132a3be8612c027bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110343, "uuid": "23f209c6-9f0c-4b3e-9ae2-40f13d9d9a12", "value": "T1FDE41202BBE94432D8761B70A8FB42D30B35BDF64A34832B235A8A2E5D72544B573777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110343, "uuid": "6c3250a2-d508-4bac-afff-b1baa22e0960", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110343, "uuid": "6a4dc87d-2474-439f-927c-b0b2d9bf34fc", "value": "12288:0Mr/y90JnZngzyD4JgDpbxJYBI58w6CW4Pn8Ew4ZKWLqLw5Ad:by4nZnl42xKIKl4PPzgWmyAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110343, "uuid": "e14be4bf-ccb2-45c6-b710-67d54263ec0f", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110343, "uuid": "86b729d0-def3-449a-9e34-1b20450d418a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110343, "uuid": "0e71aa1a-1191-4dd2-a5c4-3c94e6f45ee1", "value": "23cf8a3fb09dcbb2ca45a9c19cb3daea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd03a488-448c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693108228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108228, "uuid": "da4d0a89-ced7-4e27-9931-1f85055a6b1e", "comment": "Malware payload (Amadey)", "value": "2abd8a9fcc73084b95116e35e2977660", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108228, "uuid": "da8f9156-66da-4773-8423-065ae154de38", "comment": "Malware payload (Amadey)", "value": "b855d6e0b92089b13a870b5023990097a439fa8c31201a304967d1cd53243af5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108228, "uuid": "2a891e42-4f45-452a-a470-7ca07a17ca37", "comment": "Malware payload (Amadey)", "value": "465fedb62b66ce218629ef20cc2f77a8648ce209", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108228, "uuid": "ab83b85c-8c72-4ed8-99c9-f4923ef25dcc", "comment": "Malware payload (Amadey)", "value": "9b7e5e7550e12d238586368cb57220ee6543b11a67a7e16607d5c29a5e3be4882bbaec8d90dfc47ebece3c630859f510", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108228, "uuid": "dfa016b8-d10c-4094-b403-d91372e59961", "value": "T1A323F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108228, "uuid": "d712b7f7-6cb8-4ded-95e3-a1729fd8c6b4", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693108228, "uuid": "cdd31280-2823-40c9-ad56-73aada6975a9", "value": 49043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693108228, "uuid": "c1455051-437a-4348-9298-a98da4a53396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108228, "uuid": "8c0c4ac1-142f-4eb3-96b7-989965448614", "value": "2abd8a9fcc73084b95116e35e2977660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f71672-44d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693139192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139192, "uuid": "535366e1-63a4-4c79-85ef-82c5a3016f89", "comment": "Malware payload (Amadey)", "value": "cf29d1ebeb520cd018928e2dcc9b8419", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139192, "uuid": "c135ac6d-76fb-49a4-9b45-285163719518", "comment": "Malware payload (Amadey)", "value": "b8b37dc42c4458a81d11225c29472192b3bf6f2e14ab1bd4d5e37b0e58bd97eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139192, "uuid": "84a2e6d1-0093-4e2f-bcb7-df0afc3062b9", "comment": "Malware payload (Amadey)", "value": "90172e9bd68c00119ed040f1dc9d865447134f46", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693139192, "uuid": "3e90e016-4259-427d-ada7-930c6435e742", "comment": "Malware payload (Amadey)", "value": "d048bc58eac175ab940dbc0e96f2ba03d94c693c081137b4785212544e1d4635780ab7649c789881e2fde673a9408d43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139192, "uuid": "5ef656c8-bf75-4630-8e86-5f00e09e735c", "value": "T182652353EFE949F3CC242FB455F72743073478A119BC87A71685941E0CB36AA947A33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139192, "uuid": "a4737ebe-b834-469e-ac00-357bf6767fe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139192, "uuid": "b5a36e28-3644-4072-8fb9-13614446ce2a", "value": "24576:By18w2LkLb0V4ZLMwltXKzgxUApwMpi5UM7Op/s+0A/q/dxNx0jc4aUQYemJH:0QLj4jKzgxPGUA2/s0q/dyAwDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693139192, "uuid": "702e905d-04ad-46eb-92fc-df2da6cff544", "value": 1500672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693139192, "uuid": "e4482791-4921-48dd-9642-6e83a920d83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693139192, "uuid": "22363020-07a7-4d3c-826b-6bb3678ad3c2", "value": "cf29d1ebeb520cd018928e2dcc9b8419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f164f4-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149723, "uuid": "d63efcf5-1b94-4786-bade-bc3e829e94e9", "comment": "Malware payload (Mirai)", "value": "31aec46d1e9f3e79443dd6f3a2ac5254", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149723, "uuid": "ccb893a4-68b2-4b8b-b0d7-408ef57ab523", "comment": "Malware payload (Mirai)", "value": "b90efde1abc4899471d54bfbfb76598aeceb6c494804773e6671b7e3d382a16d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149723, "uuid": "d19ac3d8-fb04-40d7-a4f0-ded16cad44ff", "comment": "Malware payload (Mirai)", "value": "c9abc8b30d00d558168c78fffe49645c98decd76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149723, "uuid": "9d02f8c3-778f-4209-865a-1b2fb558f6a8", "comment": "Malware payload (Mirai)", "value": "4bdccfdb93578377e9f163094e28f3a8f8429d1b0ec046d8336f1ab2c42a4f4491ebcbe31975da34b68ed3c50037ed36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149723, "uuid": "88ad3da2-47fe-4180-af71-c56813f499bc", "value": "T1F4B2E1B1A1853E72D770213AB97CCB01577B97F8A4E771752224B6AC4BD1C4724B814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149723, "uuid": "b331a5d6-c5f0-448f-844c-f56194aa3752", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdmhymdGUop5hKF:yX1De9kONQG5xD+jHMDzums3UozYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149723, "uuid": "4307b2dd-cdb1-480f-a825-bdd7ae714015", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149723, "uuid": "e84decac-aa85-4d05-903c-9a1f50702a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149723, "uuid": "f5f2e9e5-0773-4fed-ba2d-95be453110e9", "value": "31aec46d1e9f3e79443dd6f3a2ac5254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ebed02-44c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693133181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133181, "uuid": "ad77fa8f-80fa-44ef-991e-7ae7eb03dcf8", "comment": "Malware payload (RedLineStealer)", "value": "83026933882b49a7f2000ab4be4ecf6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133181, "uuid": "09f402a9-e571-4d01-9680-4f4308a82c37", "comment": "Malware payload (RedLineStealer)", "value": "b913598e0b05e3105e349d2a685d8e8a760ddb4a369b5ec7e186cb0e3f32ade3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133181, "uuid": "ca14c4c6-9b47-49cc-967c-532b11db8022", "comment": "Malware payload (RedLineStealer)", "value": "64f23c8b78331a09dc91f61c81caec5f2fee902c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133181, "uuid": "867fad39-67b5-4941-8a1e-091a36ff1c9c", "comment": "Malware payload (RedLineStealer)", "value": "93441f115adf1f84f94e7e50c4e725cc83a2e5df4ad6dcdf090bc50284cbde1af91e15ef9cec9a8ea006eb3cd1e53f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133181, "uuid": "2e83608a-c4b7-4a9b-b7ff-02436668a9e9", "value": "T16EE41216EBE494B3E9F61BB024FB07D31E317C929979476B234DAC5E0D72980A43532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133181, "uuid": "a36daed3-675a-467d-a6d6-09a1f4da415a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133181, "uuid": "6f93435d-d23f-45f3-820e-886793494b44", "value": "12288:VMrEy90ghdAd9HxEcu8ZsAa+PTY26XhJmt1QUrSJ6gS5JnpZSoUYrelpfEr:hyThidZunARTY24asUmFSLnSoUtbfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133181, "uuid": "d8a1bb21-8b6a-4cc2-b0e3-f3b700ab2b23", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133181, "uuid": "66e47051-f325-457a-b0a7-9a0816c036c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133181, "uuid": "e765acd2-33ef-483a-a1e4-f35ab79fd760", "value": "b913598e0b05e3105e349d2a685d8e8a760ddb4a369b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84655c93-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175081, "uuid": "61a0819a-6847-4b9b-ab30-0578d1ac756f", "comment": "Malware payload (Mirai)", "value": "ba9411a16f898d8c452e50223333d8d2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175081, "uuid": "62f9274c-d928-42fa-bb6f-625cd365bfab", "comment": "Malware payload (Mirai)", "value": "ba1d0e48b6859a8cdee21e6bd5dc42ac15e133a2a81f83c15ddecfcf9c289f98", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175081, "uuid": "5b0e01b2-11b3-4293-aab9-5bf0f5d61008", "comment": "Malware payload (Mirai)", "value": "7c1fbe1efa6e7fda59e45f75d6345138f62e7b64", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175081, "uuid": "351c3eea-7e7b-4f36-83f2-6aeeb36cd8e7", "comment": "Malware payload (Mirai)", "value": "5f7ba8fa4d0da9bb0f7e29d03c3ed0a022a8be272e1b0d7d1b7176814b21f31e9d121fc26050cc8fafdc90072e289e26", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175081, "uuid": "19eb7689-d1a1-4911-9202-7a2944236c4c", "value": "T1D1D2E0B6C3BBC730C4E9C4B55C16A100F9BC65259BA65AAF1CCDF67ADD021881930FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175081, "uuid": "3e26c721-174b-4e07-930a-737fa43510aa", "value": "768:TYSoXdJZWvSPZsftIkQJ7dUcrzrsEsDTviMlSx0sq:TYJdJZgSGRQJ7dUcLs9/vijtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175081, "uuid": "5a8c8cf9-f2b3-4dd5-9981-a5361f726630", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175081, "uuid": "63c228cc-d40b-43e2-9105-72b94ea79990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175081, "uuid": "8d80f71d-77a9-441d-9302-663961f221ae", "value": "ba9411a16f898d8c452e50223333d8d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd558854-44b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693125355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125355, "uuid": "0a8c06aa-3328-4040-a683-eac69c87ae8f", "comment": "Malware payload (Amadey)", "value": "6562aea42fc3b1208dcbb01007c6f4cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125355, "uuid": "21289398-ccbb-4c7c-8871-a500ebfb13a2", "comment": "Malware payload (Amadey)", "value": "bb56619ea40745f3a29ad68aa38d41754aa7ed8e8c15a5062af78e9fc530c293", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125355, "uuid": "7e4e4619-d0b8-409d-95c3-3463766e4eb8", "comment": "Malware payload (Amadey)", "value": "5a77598774e4a0cc84cc93e366acba746f212134", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125355, "uuid": "5e5ca5f8-61d0-4625-a61f-ee1fa65d2245", "comment": "Malware payload (Amadey)", "value": "5df3c9e42254256d477dc57fe77ba8724bc90972e9eff877b2eadeaaf2d06b43fdfbde76e01eb3e01c0d93833bf5e846", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125355, "uuid": "e1ef9f4a-da6d-4b1e-85d5-3d8782831db9", "value": "T1A0051243B7E8C022C9B45B705CFA42970A36FDB29AB84B5F2785686F1CA35D4613077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125355, "uuid": "5b75b19f-8ff2-4da1-8fc6-d7b9ff913214", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125355, "uuid": "f4135c05-8b9e-4bfd-a5f7-90ed427a3e05", "value": "24576:cyYG7gE7dkf+z13byFmMtYN59coQcWIO6p7xn6:LYYiGJmF7uj9yipp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125355, "uuid": "3b822d2d-8d72-47f7-894e-a9b097c617f6", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125355, "uuid": "f165337a-26cf-40f8-a0e6-dca07c060fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125355, "uuid": "23fce070-71eb-4bc1-b6f8-f08fef2f7f00", "value": "6562aea42fc3b1208dcbb01007c6f4cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9d33d2-4515-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693166827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166827, "uuid": "07cd1035-ab3d-4c4e-84cb-614706bac521", "comment": "Malware payload (AveMariaRAT)", "value": "2f464a9bcfe09d2ab8ae6081d1d4d13a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166827, "uuid": "50097fe9-a191-4fe4-b76e-b63d0e265a23", "comment": "Malware payload (AveMariaRAT)", "value": "bd54c011fb60ffa1cc97173178ffba67c3feeaaa9ca0fbfd08b201988a21e9d6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166827, "uuid": "3d574dac-8144-42bd-852d-997990e4fca6", "comment": "Malware payload (AveMariaRAT)", "value": "9bcf132b6bda81f29a73dfb32e847f2cc13d1105", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166827, "uuid": "00013171-fe2b-4073-b025-d30cdf8d1ab6", "comment": "Malware payload (AveMariaRAT)", "value": "f21a4a2fa955d17021e00b3d8795a8701b7efb1556e25a72b41d0cf782846cef19a2e4921eee46d218903a3568024897", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166827, "uuid": "2ca81a89-3bb7-4a9f-9c0c-8e5719171f94", "value": "T1E7B39E13F7E54835F3B201B01ABD7E79CBADF9700628C49FA394858A2D31946EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166827, "uuid": "1cce92d9-0cdd-4b87-8c91-77ed4f233e6b", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166827, "uuid": "453e6be3-8dd8-4e2e-9636-c6de43401681", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWdSfB4u0OVE01:K1VmhaH8EFvWIf0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693166827, "uuid": "a5a3ad54-7d72-43c0-bc2f-a225cd82a3bb", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693166827, "uuid": "a7bd49f0-fc36-4dbd-9fe5-2f16d7e420ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166827, "uuid": "64d54cfe-c0f3-4801-ae9d-32e8cf798e50", "value": "2f464a9bcfe09d2ab8ae6081d1d4d13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738d8a8b-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693126090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126090, "uuid": "6518f764-f11b-428d-b5b0-9c546ebb6674", "comment": "Malware payload (Formbook)", "value": "0b934c7f639398836e62a945df8bb495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126090, "uuid": "84e75dd3-fa89-41a3-8b62-b3d30db323bd", "comment": "Malware payload (Formbook)", "value": "bfd9809a1fd4485f2590bb784d5e4ccc249f04b4e7211bc9728a0fe3c88f2b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126090, "uuid": "8eb45767-249c-457c-a035-d56dcd2879bc", "comment": "Malware payload (Formbook)", "value": "eb5daaacc2bf7a967c01743b130451cb5d0d92f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126090, "uuid": "6d958e43-63a8-4a30-8cef-fa4257e5b52a", "comment": "Malware payload (Formbook)", "value": "4566b3817bd08412d351cae6f2370c332238e58aa48462e5ad2be50ea212e5baa3c81ddb716a92267413789d889a19c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126090, "uuid": "4b3b700f-1472-4fd3-baec-37e18036f736", "value": "T129738D1877F98525E1FF6BB029F17352CA35F7636A03961F24C5029A1623E88CE817F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126090, "uuid": "4fa7c25e-1f09-41f4-b779-84e7f1c9bba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126090, "uuid": "967906fd-d4c9-4bce-bd65-2ab5444ca653", "value": "1536:11V7tVcoROxpY74VMqBV7FmI9Zjumbhlfc9cdP6lOlO1/mr10q0B:rV7Hd+pPdBd9HXbLAcUOlO1/01CB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126090, "uuid": "db3c0015-f2c2-4b5a-9009-64b1075247d6", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126090, "uuid": "b67561e4-9ce7-47e7-8c08-7ee38e2e31ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126090, "uuid": "cd93ed75-336f-4e55-a628-394dee9aa613", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b10fb8f-44c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693133780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133780, "uuid": "044bfdb5-dc4b-46b4-a770-4c107e98b60d", "comment": "Malware payload (RedLineStealer)", "value": "ca9834a35e790b0789cba4d55c8635ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133780, "uuid": "3c0ad01a-ec0f-4afa-842a-6459a8203ca8", "comment": "Malware payload (RedLineStealer)", "value": "c02fdb887fe88dc7a359fdaf9f6fc42e14786da051e3c28e0a8abc9f9d590f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133780, "uuid": "fb646313-2452-4814-ad41-ce52e38f2390", "comment": "Malware payload (RedLineStealer)", "value": "88afc743390b96f15400d16f911876073d300111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693133780, "uuid": "71a2067c-394a-4fae-82ca-0d9c28333242", "comment": "Malware payload (RedLineStealer)", "value": "e53e72fbc3debac5603a265a3c407de1481ae4e00e80cb4cd94d6d9dbe8618ccd7aace9ac99f65a45c64fa01077c5c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133780, "uuid": "e52f5be6-e2c6-4a55-b079-dffaab830978", "value": "T12D652343F3E80827DDB527B41CF253531A357DE29CB8936712169E0A0832AD5AA3777E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133780, "uuid": "804ccf70-4293-455d-bf04-6dbe4f2c38b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133780, "uuid": "f6d92afd-9657-4e25-bebb-dfb3ed806557", "value": "24576:qyHzKVn/hDn7ZAKPCHokK/6NpD4fpafVcbe1js6X1cxgQoH8+G:xHO3DnFAKPCHZh8WVc0js6SgXHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693133780, "uuid": "56d18129-043f-4746-8a46-55443669a9aa", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693133780, "uuid": "89516f7f-a47b-45a4-8f2b-9a4d72e6a177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693133780, "uuid": "be98e6c8-00cb-4c37-aa77-a175c1c4ed2b", "value": "c02fdb887fe88dc7a359fdaf9f6fc42e14786da051e3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707559e9-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169464, "uuid": "4c885cb3-2f83-4c1e-b7c1-87bd9e392ff0", "comment": "Malware payload (Mirai)", "value": "12f69fbdc78d816de7212652589cb503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169464, "uuid": "3fd783f1-e3a0-4461-8ed1-16144df3d32c", "comment": "Malware payload (Mirai)", "value": "c2c5339ef6eacaa7e9713fb19f754a32fab2b194dd83f90ed4c4cfb5ddbff78c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169464, "uuid": "c6fa71d1-b98c-4856-8980-4c40ff12d726", "comment": "Malware payload (Mirai)", "value": "11a42edc2303b3dde60b8d02072811bab3818568", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169464, "uuid": "e3a795e5-8f8e-4ff0-ad19-aeaa20d28ee5", "comment": "Malware payload (Mirai)", "value": "18a5275e78f1e932c624d3c0967cecd64579b3df43cbadfbe5e7eae5841b516197b0571e1de7ff3bd4533c339c5cf996", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169464, "uuid": "0017b48f-8eb1-4528-8a06-e49a6fca3206", "value": "T123539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169464, "uuid": "d91791c1-fde4-4151-b443-49f097216aea", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169464, "uuid": "671da516-8321-4b71-bca3-0db6806cdb7e", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169464, "uuid": "61398220-fb86-4bfc-a283-b5d22e5bd6cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169464, "uuid": "44481683-54d1-4537-abf1-e4bb7a21541f", "value": "12f69fbdc78d816de7212652589cb503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a35f07-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110038, "uuid": "8d3a8393-8480-4b88-8f4f-f78593d1799d", "comment": "Malware payload (Amadey)", "value": "d6d6a123c4c84372219dc6c30959c3d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110038, "uuid": "ee40814b-ebf5-4028-99d1-dbbddcb5136f", "comment": "Malware payload (Amadey)", "value": "c2e74e34b833c3f035cd6129c850b12846f7bb5b95fb195e429ec8f027199706", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110038, "uuid": "ba5f8728-bac9-4066-a582-e475fef3941a", "comment": "Malware payload (Amadey)", "value": "d4f426b05b932bf3a354faeb4fe3c23f2e26ad80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110038, "uuid": "3584968d-d96a-476e-a931-8d24d62d2929", "comment": "Malware payload (Amadey)", "value": "1374c4353de83636b2ab9e7d8489e4a33d5ccb4c1ac5ab168a141978ee832e246826860b713750113f9da804657e7584", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110038, "uuid": "e4f8ceac-0ac7-462c-a841-f5e47e41dbc0", "value": "T1A415224ABAEC4032D8B25774B8FE13570B357C7599B89B4F23852E1B5C722C46931B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110038, "uuid": "26c65ed2-82ae-4559-8922-0e4997b2868f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110038, "uuid": "0bee9cd9-1174-4b23-a1b3-33123b27a498", "value": "24576:+yKDJ0Sk2vlKHbQaReQ44CPOnMvNkqTj3:NKt03JbQafkMMvNkqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110038, "uuid": "50cea9af-cc28-41b3-87b2-49d2350494db", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110038, "uuid": "f881400e-e038-4dcf-8a68-c0c21e730f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110038, "uuid": "81d2fa7b-b39e-440e-9558-4bf839022478", "value": "d6d6a123c4c84372219dc6c30959c3d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0dda71-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693148199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148199, "uuid": "94301ec3-bae2-411c-87c4-6a3fdffea931", "comment": "Malware payload (RedLineStealer)", "value": "b6ed2beeed5da1e0980b20f40e96da7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148199, "uuid": "d078ef33-9f9e-4dbc-9352-2f4f67877350", "comment": "Malware payload (RedLineStealer)", "value": "c2ecfc778e8656a35c7e08dd52f784dcfd344a6d833148d64a30d8c3b4fb42c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148199, "uuid": "81e40647-dec0-467a-b5c9-7a564cd64ddf", "comment": "Malware payload (RedLineStealer)", "value": "e79e6622d3f57823cc662944cf87435e734229fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148199, "uuid": "fe2abc77-c9a7-406b-8c0b-60cf28b6e445", "comment": "Malware payload (RedLineStealer)", "value": "207162d04f8bc6bdbda86a71c188bf5791f95898f4420440c469c0713536e499dbe3d3b69d59d767af217887558c5214", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148199, "uuid": "8f40f93d-efac-4f86-a12d-5b5bc95cd9ca", "value": "T172E41212BAE48473D8761B7118F717D31A36BCE25D3943AA2342AE095CB2790E57633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148199, "uuid": "ade5f48a-b876-4084-8743-57e7e58856e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148199, "uuid": "9d9b8e70-9222-4eaf-8135-793f96ff146d", "value": "12288:NMrXy90WdTztJbjJeT+pC4K0Llzo6qs7IZibiQuBxqYyTk5AnDluN9E1pz9yB8OF:Gy5dTzL5m+5fLVM2qzBxbyTk8Dw3C6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148199, "uuid": "882bfda5-fc32-4957-9a1d-538c7c15a892", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148199, "uuid": "1fe5c5a6-ce5b-4972-81f6-eb234e91a709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148199, "uuid": "e8a2dce8-53da-4f2f-999b-d50392792b74", "value": "c2ecfc778e8656a35c7e08dd52f784dcfd344a6d83314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82275e9-4496-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693112462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112462, "uuid": "024564d3-603d-4e0a-befd-5c0105ef45aa", "comment": "Malware payload (DCRat)", "value": "3e5807d3ec9608d1accd41b5ad57f934", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112462, "uuid": "b5b47e50-d457-4e78-a731-ba099669a42c", "comment": "Malware payload (DCRat)", "value": "c3715b71e4655d0269d6b9e5c82cb7d7d31942ddafdc821c9b85741ebab95529", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112462, "uuid": "f2852d33-3096-48d7-ab85-9984c9aca31a", "comment": "Malware payload (DCRat)", "value": "23b898b51d03cc59595d40a95fee659be211d8a5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112462, "uuid": "d80a7af7-b2c7-4095-be63-7ef661191836", "comment": "Malware payload (DCRat)", "value": "e4f4af7ef1705f14543b36dfe29cecc3683ee75c45421b208dc078c8b8916a3e4c8913e7e39d384b01b8375dcb7a9e64", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112462, "uuid": "e2d2e4ae-803b-4611-9569-64a066e257ae", "value": "T140455B017E44CE11F0095A33C2FF459847B4A951AAA6E32B7DBA377D25123A77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112462, "uuid": "efb7254c-934f-4a28-8fb4-513749c68fda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112462, "uuid": "f48a01f3-9909-48e2-8111-43e047758466", "value": "12288:1zMplwxICT5ObvqTUjlUCyt/MDHSOLoRq7jluoLNjl90RfPFSbAH9m+5qsTCzGXv:1UwvObvYCyt/MV8OjlpQRTdHT0GC3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693112462, "uuid": "10e853f5-3915-4dd0-8e6f-29b7511f58c6", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693112462, "uuid": "efa92241-1935-421c-82fb-325030232ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112462, "uuid": "f93cac14-f411-4dae-8898-1ff931544238", "value": "3e5807d3ec9608d1accd41b5ad57f934.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adc4995-44be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693129565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129565, "uuid": "5c595e4a-f409-4cb2-9ecb-6e7c8f0fb61d", "comment": "Malware payload (Amadey)", "value": "a808f2cc4b0970b15cbe10d4f9d13071", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129565, "uuid": "6868fe80-44a3-4978-9295-85cfc9bf0308", "comment": "Malware payload (Amadey)", "value": "c3a9f37bee519bc7ebd5c56a4e45ecd599a3d8792eb3628564d4979ad341c6ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129565, "uuid": "3b981c3f-af5b-4ba2-b5d0-7c3f0a5622d1", "comment": "Malware payload (Amadey)", "value": "2ee09ed71c3651286e47f4650939ab277b9edbb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129565, "uuid": "9c2bb85d-71c7-4dd9-ab8c-d8e69131b1ea", "comment": "Malware payload (Amadey)", "value": "3f96455aec15bba88ac474f286f84825e0af4b3bd80278aa66bb4a4aada591b9dfedd8c8a69504ee602af3129f58525f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129565, "uuid": "cae92ccd-e5f2-4519-9bbb-78da39543289", "value": "T1FD23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129565, "uuid": "f276da24-0393-4b96-8b22-ea6ec1f80c8e", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129565, "uuid": "54c2ec82-6fe3-4ef7-99f3-a8808cb1bd6e", "value": 48935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129565, "uuid": "9b6588b1-4809-4175-b380-c37aad02b093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129565, "uuid": "4e335a59-8f23-465c-a5d6-0e412459558b", "value": "a808f2cc4b0970b15cbe10d4f9d13071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f782e53-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126110, "uuid": "26c5b185-01b2-4470-a304-94a161913406", "comment": "Malware payload", "value": "03e8111dd82352ceab22be5f11a722fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126110, "uuid": "869969a7-1808-4b6a-8ab5-501df8a36d75", "comment": "Malware payload", "value": "c3f2d5937e10ca109e108de7f108caf76a367ddb432dbabb6e24861c5dc318cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126110, "uuid": "51c325e5-0bf7-4619-800e-0fe91141daa5", "comment": "Malware payload", "value": "1ec0b8d8939090c2ffdd5f263acb47bcc0249ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126110, "uuid": "2c90016e-f5b9-46ed-b399-1cbb94ad0003", "comment": "Malware payload", "value": "f0f27da46e9f76bdb360754e61a9a0aa55b9060762f1172228879a6cf92b26e17f6824943048c526b2c16bf4d5431f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126110, "uuid": "2b7e5096-7616-41aa-afef-d08a5a584c6a", "value": "T1B27562DC755076DFC85BCE728AA81C64FA1064B7630BD247A42706EC9A4DA9BDF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126110, "uuid": "60111bce-8495-4864-88b4-868a88105b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126110, "uuid": "bbe98823-f7c5-4b14-aaf5-d273e0dc15b3", "value": "24576:Z4ZpzhQCVzj5vV+ujDkqipWpLMh2FW2Q0a9t/z6eYUWwXDDzdBE0BJsV8s1rAOtH:Z4ZppemiYMh2F+BWwXDvWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126110, "uuid": "074975e1-e275-4682-8cff-9734f9521880", "value": 1688576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126110, "uuid": "fc1b5adb-8fb9-4920-b719-227a65ccb978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126110, "uuid": "7f9e9644-39b0-4a51-a537-ebe74daad828", "value": "VLTKBacdau.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8208ca5e-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175077, "uuid": "c4f08237-4bed-4fac-96e4-edefd2016521", "comment": "Malware payload (Mirai)", "value": "a531bd88e2a4f40b8fc781b935a3ee38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175077, "uuid": "a72cb592-b23f-4b4c-ae2a-4ff99f6d80b6", "comment": "Malware payload (Mirai)", "value": "c5cd9f369aeeae89271db93e3e23255eac42ec6899ae786d517ae86445d17197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175077, "uuid": "8f14cc15-8ac9-4b37-9857-2b37499d937f", "comment": "Malware payload (Mirai)", "value": "511b4c5b4638c365ba31775adbd4014c17f1173d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175077, "uuid": "dfb636b8-ebba-4738-b971-223aa8df9503", "comment": "Malware payload (Mirai)", "value": "3ba30f5badedca93dea2a929b3d853ed1d086519f8855b70b4ca360420ace382306b8fc0557a19c623bf6970bdff531b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175077, "uuid": "0142d453-979e-4994-a086-c5c44fbee9ae", "value": "T14BE2E1698B3905B2D5B0EE76CBF6CD4267603B3C715EB442125423DC9AC7A0A32E94C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175077, "uuid": "dae6347e-5192-4a86-9c67-e9471d577b6a", "value": "768:kljOHlOTcLs7Z8FviuyIENCHBhroJ4qDkGZ1vPJJ9q3UEL5t:kAFOqquyqBhEiQLCLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175077, "uuid": "c3965dab-2f02-4857-ac8b-d620e28d1da3", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175077, "uuid": "b4ca7be0-ef68-4981-aba2-14d334c5868c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175077, "uuid": "058b557d-1c8f-4f92-9bf6-692b1abf80a4", "value": "a531bd88e2a4f40b8fc781b935a3ee38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2299c438-44bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693128961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128961, "uuid": "faed229d-1d8c-4289-9faa-430bd13bcfcf", "comment": "Malware payload (RedLineStealer)", "value": "c10fbef994f376933077b27c7fe080d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128961, "uuid": "a7a2c203-151e-4b39-a670-93d1a840c96f", "comment": "Malware payload (RedLineStealer)", "value": "c5fe6a84a417e9b7890c0ca1b9f2cb3ea767b31187e3eabc5ea7dd066526714f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128961, "uuid": "57310c70-0f6f-464d-9301-c3cb61368a7a", "comment": "Malware payload (RedLineStealer)", "value": "ada6cac1cae8ec452d97611147824e3862b72ed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693128961, "uuid": "7b19300d-d941-4845-b489-4e15397f16a3", "comment": "Malware payload (RedLineStealer)", "value": "dc37b0e95a0ee4919f7057d35d2c219144320086eaa2a61fcbdf0aee50a63ec4fc8eebcf8de52d4d2a1317ba3ef67f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128961, "uuid": "192e58ae-2f53-49fb-ae1a-5b91c1eb05f1", "value": "T17EE4120773E8C036D8B917705CFB07932B227DA1996893AF2286955F1DB17C8AD3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128961, "uuid": "f430c205-b62c-46b5-90f0-af2ca5d4b996", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128961, "uuid": "f57f7e03-f458-496a-8c83-d1655a9d5c95", "value": "12288:RMrHy90bhKjMA1MuIUf3fmNyE7H3JUM3bAnguu:qyoho+Yf3EP3mM3btuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693128961, "uuid": "67d002a7-5249-4ccc-a443-263ebb37dbae", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693128961, "uuid": "7a30501d-d16c-4b9c-ad29-35d34a8f25d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693128961, "uuid": "2273cd76-ee24-41e6-b5fb-00ce0f27e1b3", "value": "c10fbef994f376933077b27c7fe080d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfa7140-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693174906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174906, "uuid": "e64a7bcb-52af-4b6a-a318-1e983e3e4686", "comment": "Malware payload (Amadey)", "value": "30de249d571c7c97a8b3fd91d5fc331a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174906, "uuid": "9051c16d-72fa-4a10-84ab-a0a9908a77c6", "comment": "Malware payload (Amadey)", "value": "c64051e096455a8e01e18ffc14a568c5654c3a3d11e3742f5a90f8315b263e0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174906, "uuid": "13b275a8-e30c-4830-a943-8151f73fcd4e", "comment": "Malware payload (Amadey)", "value": "29551405689c3dd1940c3e5a8d2e856d2df86e1e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693174906, "uuid": "b83dbea5-ae50-4e81-ad5f-d34425d1e583", "comment": "Malware payload (Amadey)", "value": "3508b78b65d9ac73d55eeb5c07c80e92351c53ac2146948af02f4b6200c9a64c6312c9e23a7752e41f74f1d1179a579f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174906, "uuid": "2fb9cac9-61f6-405f-ad5d-aeb71e9501d1", "value": "T1AC15238267C59532DCF1A77095FA03831B3ABCF1A82D938B32E5DA894D73784B53171A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174906, "uuid": "4a07a04e-7a27-4289-bb94-e516143ec84b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174906, "uuid": "d85fb978-b95d-421c-842c-7f77f89d33ba", "value": "24576:Uy4Kw/ajLlkS52xV/1kueWnUTyg9WF88Rjb4jqKynGdIf9a:j4ri3Vw1kKhoWF88R49I1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693174906, "uuid": "b76bb771-c5f0-4557-90e4-629a770d8b06", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693174906, "uuid": "9db845d7-cfe6-4a93-aad2-a01673182517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693174906, "uuid": "4d1b8e32-dff9-4ffb-a1ef-b1f2fca4ed5f", "value": "30de249d571c7c97a8b3fd91d5fc331a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b289b55-4532-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693179414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179414, "uuid": "94fe71f7-09b5-4337-9311-51d6d53927c8", "comment": "Malware payload (Amadey)", "value": "6b91c535cdd02ebb56aaa40d8d252c51", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179414, "uuid": "d10153d3-83cc-4264-8e3a-e5aa0548d684", "comment": "Malware payload (Amadey)", "value": "c74e59c4f80d18be72e275ec51b27cd4881ec22491fd168bf73facf3a9f9140c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179414, "uuid": "4b7e0d60-7d9f-493c-b328-6ec62610c590", "comment": "Malware payload (Amadey)", "value": "a300a90836679a40a79a083730d2f31a69b08372", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693179414, "uuid": "ab2887c3-42b3-4ece-8df5-8f24c92e78ed", "comment": "Malware payload (Amadey)", "value": "b771bde0ee1b014d0cd55cbdda565b570d9332e50d2c8e34b41a9da8936948e75634099ba668a759a988c1b3f47e7c20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179414, "uuid": "6415bfec-a684-48c9-bf8f-5417452d3c28", "value": "T19AE42353F7DC8027D8B62B7408F606471935BCB09DB443A76742EE2A4DB3AC6A57072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179414, "uuid": "393a7f51-9a39-46a5-93aa-bc3efc5fca29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179414, "uuid": "59a4b393-6fce-416a-aacc-566bfda26a6c", "value": "12288:nMrPy90pX13gZB/R+5sUr4s3Qwr37yr+hURNOKDB//QAc4rmj8F/x:UysV8Q/vgwrc+hU2KDBQZmF/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693179414, "uuid": "b1b3a0c0-ca93-4d7f-ba43-e8c9db98d350", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693179414, "uuid": "31556e61-4f50-46af-a38b-39370d494683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693179414, "uuid": "3faf12a7-d93a-4573-9817-311822da8e5b", "value": "6b91c535cdd02ebb56aaa40d8d252c51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b68f85-44ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693150312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693150312, "uuid": "44b13755-7d8f-4feb-ba65-79846783bae9", "comment": "Malware payload (DCRat)", "value": "217cd6ee15719dbf1dac36a55b41c2dc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693150312, "uuid": "1a1dba26-b6e6-4748-995c-131a2b77e559", "comment": "Malware payload (DCRat)", "value": "c7802d2912ed05beb0b2497338391da969aad8df55afbe7e207d094685aee928", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693150312, "uuid": "5824458a-6469-47eb-a306-29c1e0709bfb", "comment": "Malware payload (DCRat)", "value": "f593743b666266580c5959b1e713f0f9ccf9475b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693150312, "uuid": "6a312e09-f00e-47b1-b20e-b9fda1fd1072", "comment": "Malware payload (DCRat)", "value": "1e821900c869ce8a82978b0ac5dcf5e4dd0b260f353926c48cbdeba2f3263b23237a9ce141a1542573ebf69289794774", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693150312, "uuid": "cc6d810d-69ca-45fb-bc88-41c1b5897218", "value": "T1E5455A027E44CE16F0082633C2EF454887B4A9556AA7E32B7DBA337D65163A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693150312, "uuid": "9a046e8a-de0f-4608-beab-a73ec462f09c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693150312, "uuid": "6363a142-89f9-488d-bdb6-895198716652", "value": "24576:8nWUMCU+GFTG+fnAQuO0vekZQ1YVWe/7:8WUMYMnZeekZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693150312, "uuid": "f03ae004-2c69-4a94-bc83-3f1f31847318", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693150312, "uuid": "3d53de77-b395-45ee-8acd-306c77b5bc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693150312, "uuid": "f57dc7c1-cda1-4204-91a4-e243a1981f03", "value": "217cd6ee15719dbf1dac36a55b41c2dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f8d8c3-44ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693148406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148406, "uuid": "087696d2-4b22-44d3-9639-0faa57111491", "comment": "Malware payload (Mirai)", "value": "004230e43f00c50948d0f0511de86a7b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148406, "uuid": "5488d068-7078-48cc-8ab2-fcb2746d121f", "comment": "Malware payload (Mirai)", "value": "c93dcf3baf8572b4dc51fd4ee100c142a2e6f831ac893f489f27ca9adb8732d6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148406, "uuid": "97432052-46f5-4ced-ae84-2d6e226bff8c", "comment": "Malware payload (Mirai)", "value": "02207e15cb19a3b8dfaaed116578071c0b91325c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148406, "uuid": "46f912a4-3bc8-47bb-b1aa-7efe81a726fe", "comment": "Malware payload (Mirai)", "value": "afa1625811a0c8e20c973b87415b3e32c40399270d02c67a4b02d350e65a7876ae414b14dbea8105eff501c128e39a7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148406, "uuid": "189563af-dcfb-4fef-9971-de279b172ec2", "value": "T1E8D33B86BB419A13C0D61B77FA9F424933129B54E3DB73068D185FF43F86A9A4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148406, "uuid": "899af146-64e6-4f14-a539-2c3ffc141134", "value": "3072:6h7um7+ONhLmiTHsSTjpI3SyRTaAO08X6GsM/9/sW7m:6h7um7+mm0jpI3SKTl8X6VM/9/sW7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148406, "uuid": "55e2a086-23ad-42ca-a80c-2dc947c4f4a2", "value": 138499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148406, "uuid": "ffbd0853-90b7-4135-a86e-3ea9788dd750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148406, "uuid": "705b2703-106d-4f53-8d8d-61fb55bba9bc", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644d1bfa-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103731, "uuid": "c434f4c5-a742-4dac-9b3d-89b7422ebc7b", "comment": "Malware payload (Amadey)", "value": "8fe5a99838e6c36fdbc061c93a2fecab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103731, "uuid": "acb10163-92cb-4a7e-a406-5b111556ba65", "comment": "Malware payload (Amadey)", "value": "c95e14ffa9d3869b5a0002b225dbecebce3cdae7f58941e47d9e85924f7dcd1c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103731, "uuid": "a979a22e-d9fb-4dd3-934a-883a79f252e4", "comment": "Malware payload (Amadey)", "value": "bb7ff773fe50feafd8aef4f3bc2badb464cdefc2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103731, "uuid": "e9f2635f-7ca9-4434-bf5e-1c89189ae649", "comment": "Malware payload (Amadey)", "value": "211ed47f3e6e2f5cd958c087348ec528c9a5f3352b6e73c4e5f75b836278d4155cc6a5d8336dd0faf1f172ccc3d5e9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103731, "uuid": "795abc65-be8b-4d7f-96ac-6a4a38c4c1f8", "value": "T19FE41253BBDD40B2DDB917700CFA03DB5B367CA2AE24172F2782A9590C729846D3573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103731, "uuid": "a9326959-0da0-4d86-8eae-a3f6f44757a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103731, "uuid": "80f6c5da-7aca-4264-8812-2788a8a14239", "value": "12288:lMrOy90VPoIhCu5ORllm8IUvPn5qkT9MLLG7LYFnftze0Z3z/tAyop6RPJdClSzJ:HycoITMlnT79uuLYRl7Z3z/tAIcC9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103731, "uuid": "91f4cbd3-9493-4fb9-8e22-926330a5dbe8", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103731, "uuid": "350bcfeb-82e0-40b1-9506-1f83c4fab748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103731, "uuid": "fe6814db-926b-461e-bdf0-380eda56c635", "value": "8fe5a99838e6c36fdbc061c93a2fecab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ed74f0-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169395, "uuid": "aa4b5815-951b-48b9-8262-0b8121b3036d", "comment": "Malware payload (Mirai)", "value": "6299f893c3bd0e8e3ab8724ae7f62071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169395, "uuid": "0b3545c5-bb77-428a-b8af-7aee74a0f931", "comment": "Malware payload (Mirai)", "value": "ca609995d5a18ea06988d13e42c939bf4a3decac3584d9569b61d8626cf11449", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169395, "uuid": "57e9a696-22ba-471c-8ac2-0cde67e27060", "comment": "Malware payload (Mirai)", "value": "2766590af10c0e4b4fb7ba0dfd3ff71025d7a276", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169395, "uuid": "387e9be2-e77e-4564-9407-cc3dd9b0f30c", "comment": "Malware payload (Mirai)", "value": "94679a460f766e2c9b0d1af1ea6bed33a9620d008dc4f08101def9174b8c68a14da49d026f2f32ecaa7d98a7046b6feb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169395, "uuid": "37aeb4b2-0c2c-4ab1-8c54-1287126e0763", "value": "T1CDC2D030A6ED1CB5C7500572F7B856C9BE530FBDEAFD2890114087BA394290929EA9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169395, "uuid": "50883365-15df-4e44-8b59-a662462e934c", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEQ/iBhymdGUop5hc:A7soTAZ3alkXLvFh8nNEHs3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169395, "uuid": "c435ca31-d416-4089-afe2-d29874761dde", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169395, "uuid": "cabd6ffb-cbcc-4d43-9dd7-15e807ebab6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169395, "uuid": "57e4703d-e92d-4e2d-8d1e-20eff6d89c84", "value": "6299f893c3bd0e8e3ab8724ae7f62071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c42c33-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148210, "uuid": "6799a26e-a4f4-4c73-8d45-027a87cf425f", "comment": "Malware payload (Amadey)", "value": "a7f2116c2d227fab87a24fe50d5aa7aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148210, "uuid": "1ee1cf7e-5335-47c0-b44c-c6f11a7472e0", "comment": "Malware payload (Amadey)", "value": "cb4df3da40d14958775890bda6f63c2a7e070b22acd8edd14a1a0b16946cfc9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148210, "uuid": "93c5cc64-1b01-4692-887c-925337ad39f9", "comment": "Malware payload (Amadey)", "value": "89a29581536f904dd1135eb7030196335edb2df4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148210, "uuid": "1ed7eb2c-be6a-4243-8b4d-7482bff27cb7", "comment": "Malware payload (Amadey)", "value": "d2c0b345ec0447ca3bd00117e214f2f27d1b4709847a71af309c98fc50694417a4979f78868c9c60bcf12fb1b72d72a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148210, "uuid": "49d53951-4c17-4ff4-bc43-7f0050e7bb4d", "value": "T1B5E41283FAD85073E976177064FB07830F36BDA16874971B2294AA5D0CB2288A57773B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148210, "uuid": "7ca52db5-039d-4be9-a12a-236df9bc7538", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148210, "uuid": "f0f0c98c-d3aa-47de-839e-0c8c07eca079", "value": "12288:uMrzy90UM7dy6Dbjx2pAENUNwkH7aTYVSQPym+nHuCZ6LXsP:Fy+xbdZE4nH7qYcQPmnNEXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148210, "uuid": "f8c64864-8723-47f9-a497-f61af87b531a", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148210, "uuid": "2355f8de-848f-46b4-b645-e84048989a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148210, "uuid": "3febbb44-c417-4e23-a2e8-4c53c70b3d11", "value": "cb4df3da40d14958775890bda6f63c2a7e070b22acd8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db74664-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169433, "uuid": "deef93dd-9462-46a6-aae3-fd1e2acdff09", "comment": "Malware payload (Mirai)", "value": "e2f2d3cb3ac1235ee7952b1ceef062a5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169433, "uuid": "748f2d0e-6d17-468b-a89a-27dffb127148", "comment": "Malware payload (Mirai)", "value": "cc88f1f2673bd8b925aba44494821fc1481d5dc0182daba7d3e3e42dcbddebb1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169433, "uuid": "222348e8-591f-45a0-bd8c-f2fcc0f68bc4", "comment": "Malware payload (Mirai)", "value": "1aabb3bebfc2556a481ca7c1b4e9823b254a4a47", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169433, "uuid": "8db10483-c5e0-4d77-ab3d-cb672662a9ac", "comment": "Malware payload (Mirai)", "value": "47e35b74825b19108c7aacef4af59b2f5e42a07203c9a6f41f98e536bb1b91602edfde1e0d7b68e649d21d03ae738304", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169433, "uuid": "93406b6b-9f54-4d8f-8d59-2739e47c8741", "value": "T19DD2D0EB64BFF273C076A874306455D4FA383913D32D871B0CAAAD6C56F66D12A20E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169433, "uuid": "8def7114-c4b3-40c7-8a4d-1bcc6d771203", "value": "768:UYSoXdJZ5U05VxmHSSc+H2c+lPB2dYSx0s1:UYJdJZ5UQVH/+Kot1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169433, "uuid": "097dc803-89c4-4dcd-8b7e-0f80472ee339", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169433, "uuid": "fbaf09d2-6048-445a-a1dd-e7a76a36b098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169433, "uuid": "9021be45-fa07-43b2-9575-38c5ac2da0e4", "value": "e2f2d3cb3ac1235ee7952b1ceef062a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fd068e-4493-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693111247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111247, "uuid": "5230546b-6eb9-407c-abcc-4f3c0ecc8a11", "comment": "Malware payload (RedLineStealer)", "value": "3bbf0e6528ac1eb41ae4c33abb0b4604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111247, "uuid": "34b20774-de98-4ab0-a2aa-051aac812695", "comment": "Malware payload (RedLineStealer)", "value": "cd929edfe4d189d9efff50515f22334635d09b658fadb1b07d0e0f4ee68b851c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111247, "uuid": "35c9c80d-741a-482c-9351-d2eb31a44ef0", "comment": "Malware payload (RedLineStealer)", "value": "bc33305f468678a509c341f683a6a635c99d6c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693111247, "uuid": "377954f3-3851-460d-83d8-d96c11894433", "comment": "Malware payload (RedLineStealer)", "value": "8eda3be80c18ada03a7e614c1493a74d8f3bdd57646e222c5d000c91e4c88cb6a66a996815ed33bba282e81eac3a46a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111247, "uuid": "02f00e9b-811e-46f0-b0dc-805678c38306", "value": "T119F42242A6E84063D8B517B01EF516C31B3BFDA16EB443AF2B846D1A6CF26C4743573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111247, "uuid": "a189c9d5-84fa-41bd-890c-8728dee6229f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111247, "uuid": "97deae1e-de72-4d88-9269-9356ab136be4", "value": "12288:bMrD0y901Y8YaclbUWDpOuXQtWv+9xyTFsFNNZnyTq4piIk7yV+Pg41K/DX:ny8c6WDAuAtFxosnnyOykmEjaDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693111247, "uuid": "6e0d8b4f-bb13-4d7f-99ce-5d6806a3a970", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693111247, "uuid": "5426c5d3-5870-4e8e-8351-3bd04a89f8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693111247, "uuid": "aca80354-1d46-4e41-93e4-441244dfa3d9", "value": "3bbf0e6528ac1eb41ae4c33abb0b4604.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785f0339-44ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693121374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121374, "uuid": "62ac968a-b7df-4c18-a337-9780c6e43d4f", "comment": "Malware payload (Mirai)", "value": "6396bec435244a1b654cec7817a02f8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121374, "uuid": "944bb226-f2be-44c7-b992-46d5643d0412", "comment": "Malware payload (Mirai)", "value": "ce61d07df6fb118eb625f13fd9d042a338006c92ba4815c1169309b8c03fd04f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121374, "uuid": "fb1b195d-e2d5-4805-be6b-f3b7cb67202d", "comment": "Malware payload (Mirai)", "value": "91ea1b4316c6f536ffc43b41e5ddcdcb9dcfef8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693121374, "uuid": "a2c3c366-f78b-43ff-8308-2f5c59dbf4a8", "comment": "Malware payload (Mirai)", "value": "6400cd186ad44665f6e284e61d30952b364297467f9012dacf720129062920de4a59e5622621159fd803aa3401b0dd6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121374, "uuid": "d073b39d-94e6-4148-ad89-8c9720c2c0dc", "value": "T104B2D0A48B91A707C2B07476E2788F926E3755A0C5F63937272092BCDA8509633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121374, "uuid": "2cbd9d3c-f41b-4ae7-9032-24c4585a3aa6", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BmiMeZbFkhymdGUop5hua:4GHKQFH0rs3zWoDDRsjt7LB9U+BmiMeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693121374, "uuid": "e625087c-d073-4397-8d8d-fb1ca256027f", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693121374, "uuid": "59866171-db58-4ab2-8512-75134db49392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693121374, "uuid": "1ed76f3c-41b5-4709-b635-80acbd372402", "value": "6396bec435244a1b654cec7817a02f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4ffb47-451e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693170717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170717, "uuid": "e4f7679e-d7ba-499b-977f-8a32f716b89e", "comment": "Malware payload (njrat)", "value": "186dde15cbddaba43334f5f352726a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170717, "uuid": "1f668c83-b100-4e86-8541-76d335b088fa", "comment": "Malware payload (njrat)", "value": "cf80d5e55a7f3196fd98723a86e2c14e8be18ff26463663eecde056abeace018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170717, "uuid": "c67fcec9-20c8-4092-916d-d4cd1b8dc6f7", "comment": "Malware payload (njrat)", "value": "21eb209066e1660b443a0969948140f2c96a7137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693170717, "uuid": "22899924-2840-4549-bf64-734492061c28", "comment": "Malware payload (njrat)", "value": "dace424b0fab93c78e857a9176dda845851f8b425c21269290d5d13d9d9b8220d7c53b2cd08c8589495ea1dfa9c84c3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170717, "uuid": "cf9bc86e-5f3f-46bc-9324-9729b52a404a", "value": "T185B3F150B88CC81BD34C127CD6DBDE5103299D2EA9A6E7972C9DB49A8ECB3D3311251F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170717, "uuid": "1d6fe7d6-c87b-4670-88e1-e826948fe8bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170717, "uuid": "cc899612-5d45-47bc-a187-3c9df37949d5", "value": "3072:/zSG4PxkEv5rq3hE9pQmy0eTDDTGjI6m:LSGexTrihkemyXXDi06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693170717, "uuid": "ebcd891b-8c47-4cb3-9c5d-d418b98ee2ef", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693170717, "uuid": "fb71251f-d1a0-42ef-abb8-3099cc8f42d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693170717, "uuid": "b4f9ad30-9633-41b2-a92d-3edb05944efc", "value": "186dde15cbddaba43334f5f352726a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbde68ff-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693126239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126239, "uuid": "abaa7c6c-db18-4938-a8ce-2f39f9c2db5c", "comment": "Malware payload (Formbook)", "value": "ef97449725c24018df3ad7fe90a8de42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126239, "uuid": "5848f10c-53a3-435b-8db1-df43dc7b7502", "comment": "Malware payload (Formbook)", "value": "cf9bd7a688d15055e1e1106d42187bb5035153b08b45dd50aabf4565ee80fa77", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126239, "uuid": "3460248b-b036-4f07-a920-f5cab1cd8258", "comment": "Malware payload (Formbook)", "value": "26357e081d376815498975914024e121de54bb3b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126239, "uuid": "45597391-77ea-49d7-8820-62d3d5929805", "comment": "Malware payload (Formbook)", "value": "1a86455711081fc5b67f2f8480cf36ca2390a61f99aa04a67f864b52d755dc57c0d0a2acfbac80999150fdea8327e537", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126239, "uuid": "7aa8d769-541b-495f-a5c3-d8cd01b16899", "value": "T173C423380A503E44ED1DB57DF8FA6F55F5ABA34C3142C8B5C2C36DD16188B1BA086A7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126239, "uuid": "c16f56cf-4172-42ab-9ee3-cfabd7343544", "value": "12288:hWHdCvSA+8Yl6dnaui8VKjes6SrGINEWfwR01/CXuL:gT8YkVMVjeArVEGwR4/guL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126239, "uuid": "5a072389-ed6c-4369-9de6-def57e26b9d3", "value": 575777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126239, "uuid": "0660724c-1f0f-41ab-af4d-fb80830b358f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126239, "uuid": "3467df2d-8eb1-49df-ba98-01dcd37be117", "value": "BKBMO989768223.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed6ce98-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110057, "uuid": "96a692d7-dba2-4dbb-9752-186a63528045", "comment": "Malware payload (Amadey)", "value": "90431f0409657a2ee06391eb76573750", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110057, "uuid": "3710ae79-8db2-4d81-9660-a04f1aea4d92", "comment": "Malware payload (Amadey)", "value": "cfa5a380fcbdd817cb4753a185e59403b0a22f31ba8e7c2ce9beb015b37d19e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110057, "uuid": "b366a5cc-b3a5-409f-b2c8-58946576ef6f", "comment": "Malware payload (Amadey)", "value": "86170db0eec606fe570853ce3f6b4d43ce7ffecb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110057, "uuid": "5c86e474-9b9a-44ba-9269-9d81439186b2", "comment": "Malware payload (Amadey)", "value": "ec9de087aadf6bc1c1148229fffa03354da5eee05d2afc553fb1de84311c03ed310d6ff0bc542ee6c76748e26b612201", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110057, "uuid": "1609f428-e76b-4700-af4e-ed4170b60bed", "value": "T1A4E412533AE55432C8F52BB028FA13D30B36BCA65D78965BB7954E1A2CB3084D971B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110057, "uuid": "c1d8cafe-ef62-47cb-a6b9-d4e20e203a6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110057, "uuid": "2af8a847-a8ec-4af2-a02e-1a2e9874d142", "value": "12288:dMr7y90Zc6kdO2JZl0tu1vohqOv05l+JBU1LkKX4s2kQOJUnU4Qf5fxVsDxIcnl:6yoc6oO2Dl0tuVDOvC+JBU11X4OVRfmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110057, "uuid": "6df2fb50-c415-4518-96ce-8b482394c55b", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110057, "uuid": "d0a3087b-d437-4881-b005-b64b3897ac82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110057, "uuid": "74eaa327-de4c-4c9f-a00f-e16e27490326", "value": "cfa5a380fcbdd817cb4753a185e59403b0a22f31ba8e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560951d4-44c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693130765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130765, "uuid": "c4fd6bac-1e0a-4ae8-844a-a2d6d62cbb26", "comment": "Malware payload (RedLineStealer)", "value": "026aa098501939407699d2c985e00393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130765, "uuid": "b282a8e5-1337-4c9e-8e68-bfc2585d97f8", "comment": "Malware payload (RedLineStealer)", "value": "d100fcb409e9117c14802076d94b62239db6c1c2d126e9b0ac43eb59de0fd451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130765, "uuid": "495cc259-edba-4103-b364-1ab0abaa3717", "comment": "Malware payload (RedLineStealer)", "value": "3a4819393561ba9b57fbc41083053b9fa364f02e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130765, "uuid": "66831799-15b7-4ae8-97e9-fba865da8a1b", "comment": "Malware payload (RedLineStealer)", "value": "35f2040eb66bd57f9fc79a6b959d1b9662fb18277dbe270c33c0456b4dda539c976c3a266e89f1c6ea430ff4c2b2f710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130765, "uuid": "c3972a80-f5e0-4aee-b586-69999d4a99f4", "value": "T1B5152342BBDC6473E8BA1FB049FA16831B357C954A38B75215C9BC4A18B33A4F93171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130765, "uuid": "f10c6383-ac3f-483e-b21a-09bebc32ee88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130765, "uuid": "355700e4-25dd-445a-95f3-8b12c2b2d0a0", "value": "24576:ByZqcax+eytFR/yVty5s9HUTACcMAYqD/QeQ:0Zqc/eyLdyVQ5AaWYqD/Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130765, "uuid": "3db98ff2-5729-40ef-bb07-94decb712a8d", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130765, "uuid": "20c5e0e0-3743-499d-93af-fa6da6829d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130765, "uuid": "8796913e-f8bf-4e00-ad4d-0bac9040d5cf", "value": "026aa098501939407699d2c985e00393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18fdb9a-44a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693118973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693118973, "uuid": "49e90470-bc70-43ed-993b-322a74a449f7", "comment": "Malware payload", "value": "d13dd0c2e6e80e64fa3cde87d3a5a572", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693118973, "uuid": "5c29cf21-ab74-4138-8d46-2ffdb1974539", "comment": "Malware payload", "value": "d1091a64f035cd1f00517daaf8db0683b2539d9bb98e97d13d512067c4a26ffa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693118973, "uuid": "aa4addeb-523a-43e6-b1ac-5bc4afefd3c3", "comment": "Malware payload", "value": "6056e2e614d210ec766bf94504d940d0fd2d194e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693118973, "uuid": "b5904caf-e447-44a2-a612-e6b578686ecb", "comment": "Malware payload", "value": "184af30f7962c9a4c2e8c0d39e29de41a6f98ec8c371f97dc4f818d2b10486f360f98004fb9ae85a5b3a5e970efe0d3a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693118973, "uuid": "b00655e8-87fb-48b6-beff-6039a0c20d20", "value": "T1E7F5333F73E2BFD5E7908ABE7A06284293D4A56978D0F78CB9145E231F846C97706E01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693118973, "uuid": "6828299b-8594-48d2-a62d-a986aeb0117d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693118973, "uuid": "3898f71e-532b-450c-9247-be09c83f32b0", "value": "49152:1Abgv6QXm2UUYiMwWfij+/lXgGTkJZ9HBEl3cv3gjX7jvH3tjdKVNFzUDZvmaLIi:uAugPU1/lQQpJjXzq9U8SIknuOU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693118973, "uuid": "b7da9e44-ebca-4ed2-8e3f-aab23f00bc57", "value": 3386368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693118973, "uuid": "199bb5ad-094a-4758-8aeb-56805bcf7414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693118973, "uuid": "a2e448d3-9c41-45f1-b836-47f4b84d7b8d", "value": "FirmDriver.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff0bd82-447f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693102516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693102516, "uuid": "df214b76-6eb8-4e2c-bf82-beef7ab7f835", "comment": "Malware payload (njrat)", "value": "07a21f58fadf865991cc47e4c3428ea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693102516, "uuid": "099efbc4-6925-4a96-b556-6f95cde53b34", "comment": "Malware payload (njrat)", "value": "d2b38c64e744d4965fae1d7d8c2bbcbd60002859b7648c3b6379bf12ec0f4ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693102516, "uuid": "1aca2965-d165-4327-83ce-73f83dff1c62", "comment": "Malware payload (njrat)", "value": "b0e2f64485585327fcf3ed664c56f60b1a53264f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693102516, "uuid": "da422f34-52fd-44d2-8581-9b66031e927f", "comment": "Malware payload (njrat)", "value": "e750c02e74de355db483b034fb564d86f5bd9d0f15256b678394e422c9754e4ac12de52d6a744df66aa6f6c8cb66db9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693102516, "uuid": "00a69ef2-a141-4d23-87a3-c5d28801ca7b", "value": "T1A0448D969F651D8ED60B793DACED9E3CA0F888120507CA26FB35ACEADFD47403952305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693102516, "uuid": "792a135a-99e6-4368-836e-5a6f73ead93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693102516, "uuid": "e736db7c-f022-479a-8c38-22cc66338f8a", "value": "3072:qsdc0T4zpGolvFztvavvavXjaLXHvvAvvvHvE/Lwnavvvvvvvvvv5vvvvtvvvCd8:P4zpbjs/kiulugQkcBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693102516, "uuid": "59f9074f-e26d-4836-8287-b5d60f2eada7", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693102516, "uuid": "a0ed5ee8-ae24-4561-bc13-edb5757a64a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693102516, "uuid": "32886e32-417b-48da-9dcf-ce2e3595d9aa", "value": "07a21f58fadf865991cc47e4c3428ea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dfc9d0-44e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693144296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144296, "uuid": "65a4a36d-ec9a-415f-87c4-547079219260", "comment": "Malware payload (Amadey)", "value": "ea8056af24fff03ba9b85fbacec731fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144296, "uuid": "40baeec2-e3eb-459a-8164-cb825df5ac0c", "comment": "Malware payload (Amadey)", "value": "d3f278d463efbd079e7b9bf74a34a844f0a6968cbf8ca49d41e339e6ac67a3d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144296, "uuid": "5567a9a7-7980-42f8-adc7-dd2a52524250", "comment": "Malware payload (Amadey)", "value": "4bfa404898aed34d7f503fd7f24fd324e15ce366", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693144296, "uuid": "9d4bc997-8ba8-47be-9789-93752c4c4c10", "comment": "Malware payload (Amadey)", "value": "cabef9b82bb365f22031f34acc52e1f2ba6133c30ba28dfab813c19f8cc9fb8c4dcd8161a4cd1f470fd8ae83e111ea41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144296, "uuid": "2219eb04-d216-4c13-b9b2-40c48253264e", "value": "T1F1E41253B7D89172C5B96B7008F917C30A72BCA18E3447AF3341E51E1D727A4A972B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144296, "uuid": "2ccd3a8d-8a49-4861-9eb2-cbd541837562", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144296, "uuid": "c594b938-5295-45b8-b79b-889ff58132fa", "value": "12288:fMrfy900cKtltXsCbrEZOn+y/Op0Rnar4Icb6BTrVcWomZ23CeruJKMlpp:oy1ldsqAsFRnadWCVcBmZQprukMlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693144296, "uuid": "2e914160-a466-401c-8fa3-8e8bf48fb3ed", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693144296, "uuid": "076121d3-491f-4b6c-9ff3-b9037e9ed06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693144296, "uuid": "c68a8a2d-6877-40f3-93fe-62d75f3ae96a", "value": "d3f278d463efbd079e7b9bf74a34a844f0a6968cbf8ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25328a77-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693125959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125959, "uuid": "ee41559c-870d-40f9-af3c-e0597a2a4e37", "comment": "Malware payload", "value": "64f060c870dec890d907b7c799f59b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125959, "uuid": "16337ee3-5faa-496c-9613-dc7e47bd3592", "comment": "Malware payload", "value": "d406765cd031824b118169be8d9516e79aeac60e8b197472a664207730f20275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125959, "uuid": "c401fea0-95d9-48fb-a02c-b01f7a93c71c", "comment": "Malware payload", "value": "061b6a7d94c6f4b7e1c1d9f879052b33a2287e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125959, "uuid": "31202940-e947-4e84-9b85-f73d7d5ef9b4", "comment": "Malware payload", "value": "0bd8c9548644774d1fde4e45455f958f8abb928fd6aec1922718cb4eb125c3d25b3bd0fcfc96da3526ac423becf9d3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125959, "uuid": "e9f17c7f-ed67-4da1-b2ae-a85d12ba333a", "value": "T1C0852312B6C155B0E8721E754DED6B71653C7C20AF344A9F63E82A1D89706C1EE31BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125959, "uuid": "703991ee-3ceb-48a6-a03e-093e0d048c78", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125959, "uuid": "0a3d5807-9fa2-4e87-8e52-4c78810496a8", "value": "49152:pyf7xIiGrvoWu3geB1zs7orAGN9hCtNWA6UjxZn3:pyf7eiEoT3geDkszhyN5rjxZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125959, "uuid": "79bbe88f-3cf1-4f9b-b739-b0813c251dee", "value": 1851185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125959, "uuid": "50654cc2-be6e-400f-aa52-a9d31b9c82ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125959, "uuid": "c813afa3-a826-41b0-bc62-d3c18cf68919", "value": "data64_6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f8b708-4476-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693098613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098613, "uuid": "48f55b8f-06af-4b2b-a234-c7eb228e013a", "comment": "Malware payload (RedLineStealer)", "value": "4faec6e23f7e6bbe91be6fe395248f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098613, "uuid": "46b24e41-4df2-4465-b785-52fc72aae33f", "comment": "Malware payload (RedLineStealer)", "value": "d4c558b46f2ac5b7a9560db22184e2168ec0e78286ca75a81b392b22e7ca6fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098613, "uuid": "fa1c3c88-9376-4278-82b1-fc827b7afb05", "comment": "Malware payload (RedLineStealer)", "value": "7a9cd588f0ffe91cc9ffddffaf1b78473263b76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098613, "uuid": "03574466-7a3c-4c35-a6d2-30c2ab71fd22", "comment": "Malware payload (RedLineStealer)", "value": "8e099a0b7e6fec0706b0f0ae211919b8f39488739c61d76cbbd1888dee19ca952a9778f5a49559341beee5ae0892b00c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098613, "uuid": "777c4771-3e8f-43ae-886e-6b10e37c78da", "value": "T152052356BEDC9076E8F12F3428FA0BD31C357DA24974525B13869C8E0DF2B9092B2767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098613, "uuid": "ee752654-951c-4b5c-ab29-86a53b4dd148", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098613, "uuid": "28c9c9c4-310a-44b0-a801-2fb191e17d11", "value": "24576:py5RtLS2cHegCjmnP4x05Aa+Npi/tJX8y:c5r9megjnAx05b+Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693098613, "uuid": "8c22fcd1-956d-41f8-a4f0-fc1f87ea872c", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693098613, "uuid": "da54104a-6803-47e1-b509-8c7c8f668d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098613, "uuid": "3d665117-8d48-44c2-b550-1ec9011e19c8", "value": "4faec6e23f7e6bbe91be6fe395248f2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656db5c2-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103733, "uuid": "f78d8fca-28ae-4143-8078-e7fe82588a7c", "comment": "Malware payload (Amadey)", "value": "7901e2eeb06f9cf2e4178087469d63df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103733, "uuid": "feeec054-9889-49b9-965d-9b4456076e6a", "comment": "Malware payload (Amadey)", "value": "d56ac9923a4a980c0c80658be85b9c247f808eaf889bea6c32014462b5048358", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103733, "uuid": "a301337f-b31b-46ff-943b-d9f5363bac63", "comment": "Malware payload (Amadey)", "value": "a65fc15f9f244ac1ec8ded45f3416bcd796aac7a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103733, "uuid": "7131511d-5b4f-44cd-88cd-b7c34ca11612", "comment": "Malware payload (Amadey)", "value": "a7e4d9f37474a12b8a637fe24e5751c7288ccd77c32da82fa09bd90e2c3413ec3d02c20c53edd8739817061491e8ee8e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103733, "uuid": "4479a5fd-a73b-4a50-930e-53efe87dd19a", "value": "T1D1E42262FAE89072EAB6273204F523832B34BD505D74D36F3504A94A1DF23D4A87A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103733, "uuid": "190d2fa1-2b71-48f9-85d0-c78876e42cd0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103733, "uuid": "cc2eba2f-5246-41ae-8f1e-94a26a67a1f5", "value": "12288:7Mrpy90YuWlLAusT/y+4d1vKwk6BAgLri1Mw3u86w/A+gdu469:yyNuyLAHT/+SILri1Le866R469", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103733, "uuid": "bd2a4900-3db9-4047-aba0-f2c867ccb320", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103733, "uuid": "1c18ea23-b875-403e-bd23-bf317abea987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103733, "uuid": "9e13e07e-4aba-41ff-9319-7e5f088eae51", "value": "d56ac9923a4a980c0c80658be85b9c247f808eaf889be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f91824-44eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148799, "uuid": "66a10dab-e62b-4597-a4ae-f6d5dca444ec", "comment": "Malware payload (Amadey)", "value": "d4d2a2829c5e765fbcfe0c7905c7355a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148799, "uuid": "06e6da4a-b9a0-4079-98cf-a78bdc428124", "comment": "Malware payload (Amadey)", "value": "d6cd765d1dae29b953e769cdd9af44838d97b541e5e2aeb0d58f22e4d6935a5b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148799, "uuid": "786b79ce-8062-4c97-8b37-fa62ff5d401b", "comment": "Malware payload (Amadey)", "value": "b416ab56bd5d54c67ed186d894694e73dd9d40d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148799, "uuid": "e659448e-ddf0-494f-99b2-22e812dba4e1", "comment": "Malware payload (Amadey)", "value": "77bf7179f1d188f53e48950649c97fe10e567ab75943a7c1711c4a01f902f4ec6219fb87d6638833b823957b87718a6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148799, "uuid": "c160c393-fa15-4805-8420-beabc2b0c89c", "value": "T1F1652383DAD5485BE8B02F7018F747935B30B4816CB942265BF26A2B1DB7BD4A170F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148799, "uuid": "b83c8075-5883-42ad-9708-a12f780c83f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148799, "uuid": "93f5a2af-832f-4482-a2bb-0b5e99d0aa74", "value": "24576:Cyw1dKTabyx0XkVSjAKJZKNoWl1tHEP85rW1+68/VFJFwdJQd2resiv8y1Ce+558:pkK2byxQkVSjAKJZKhn2PgG+6y2Tresl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148799, "uuid": "f6d1e537-bff1-430c-950a-30136cb6c4df", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148799, "uuid": "894a9fe0-8632-474d-ac86-ecb312978718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148799, "uuid": "51651d3c-f8f1-4fa4-aa24-c5ebd1eeefc7", "value": "d6cd765d1dae29b953e769cdd9af44838d97b541e5e2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2e5c35-448c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693108232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108232, "uuid": "1414eddd-7153-40ba-8cb6-179c25b91650", "comment": "Malware payload (Amadey)", "value": "2ddde779fade4d98d0b8ef2a6c18d9e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108232, "uuid": "8a5439b3-ded0-4541-be76-106431668c81", "comment": "Malware payload (Amadey)", "value": "d6d8c2a3133a4decbb9756c4190cc287f5bc39728271241f32512443b3433054", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108232, "uuid": "0392ddf5-767c-4ac4-921d-04dee206f82a", "comment": "Malware payload (Amadey)", "value": "88001cf5876cb6bac88c33796fe83173f62f9c94", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108232, "uuid": "c84a94d1-ece9-472c-ad3c-7c0f761a97dc", "comment": "Malware payload (Amadey)", "value": "7369cc619f2b9508ec8cf47cf0044721495e02c8b7a9567e0cfd457e70e44733cbddf4dfb8d2df5de2aad7e414bb1b0d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108232, "uuid": "fcd8cf53-1162-43d4-9a45-4cead2c369ed", "value": "T1D7E41242AAC85473DDB42B7115F707D71A3A7CE18D78A76B22D2D90E0DB3580A97233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108232, "uuid": "37bf4ef4-f664-41f1-855c-d33d36e5a58f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108232, "uuid": "a962d60f-3eab-4670-a9c0-cf2673eea8a7", "value": "12288:6Mrmy90pZ9KGKwRHhoU3Wv6mMqxrBe4v43Ryq65iSdkCAjzTvZ3a:Uyg99FHq3Smhei43c5iAkCAbR3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693108232, "uuid": "d9d95afb-39f4-47c8-aa64-770469505912", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693108232, "uuid": "b05e770e-37d3-4d83-b386-381636aa7bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108232, "uuid": "d40e5398-7ffd-4896-a5de-9c532139deda", "value": "d6d8c2a3133a4decbb9756c4190cc287f5bc397282712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc6d4d-44ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148499, "uuid": "153a62ed-2554-4afc-adf0-778dcecd891c", "comment": "Malware payload (Amadey)", "value": "6430993ac334c7bd550b04c5f17b8a34", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148499, "uuid": "1b6fda13-20ac-490c-96cc-a42d8aa349ba", "comment": "Malware payload (Amadey)", "value": "d70b22cdde7db0aae8c53f57aecc9ff6b5c21dfd687e2f3ec281cf50fa34d83e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148499, "uuid": "3a33420c-da15-461a-9961-d32f6e11cbfb", "comment": "Malware payload (Amadey)", "value": "37105bfefc9c4a6f5a6a1c4e156c1874d4442740", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148499, "uuid": "97b12bbf-4495-4709-a40f-591095b03a0a", "comment": "Malware payload (Amadey)", "value": "b97f6f98955d70ce4d7afb0e561c42a094efab4c2f2a44d0e53219d851b1c4f7e77fedd9052247b06b90ec73489e1c3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148499, "uuid": "50b53b38-09bc-497e-8be3-266a5b1a5436", "value": "T168052322FBCC8072D8B577B054FB13830B39BE92257886A727819D494DB39944672B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148499, "uuid": "f042052d-8e8b-450c-a394-86b69feb00f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148499, "uuid": "0547f6df-93ee-4ad3-b065-175ad981978f", "value": "12288:1Mrmy90AWzZsKxlrjCj1tqqGIR/P0unz0dopsZgoMWplsAlfSM1+rO/cHAzqbQ:nytWFsolrjCj7gIR/PBAlsOqARELbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148499, "uuid": "e72cbc1b-7834-42cc-bbe0-865593eb28d0", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148499, "uuid": "8f88fd2b-93d3-45d2-9971-fb0110e1f6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148499, "uuid": "98002930-e1c9-4ad9-91be-31f5ef9453eb", "value": "d70b22cdde7db0aae8c53f57aecc9ff6b5c21dfd687e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f554462-450d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693163503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693163503, "uuid": "1da8ab6e-a4a1-4fe5-90b5-a2a16746cebf", "comment": "Malware payload (Amadey)", "value": "37e52a0c8e760dfffb0053fbe4729679", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693163503, "uuid": "5dd909ff-3ca9-4256-9a1d-8cb765d9abb7", "comment": "Malware payload (Amadey)", "value": "d80a73c624073170e7704f95aa6842338192dce6478b2689240b7d24b3286a1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693163503, "uuid": "5e0da32f-eb92-4354-ab99-3c3be703b50f", "comment": "Malware payload (Amadey)", "value": "4b3701ab509762bdc89d83384740483062fb414c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693163503, "uuid": "3e1b16bf-c85b-416c-9df4-9d75a64f3272", "comment": "Malware payload (Amadey)", "value": "8b2f1e7747d72804333c513920b92b5a36f9f63a9d14227258d0bc38bdf27d2d75ae538b960a4e93bad8e2f4739e92a2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693163503, "uuid": "1dcdf917-d700-4fc4-940d-ff9ed9b92901", "value": "T10923F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693163503, "uuid": "668952d6-479f-4845-a607-cac1a18c5830", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693163503, "uuid": "8054961f-5ae1-4359-80a9-464ec49388b9", "value": 49296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693163503, "uuid": "6b6d3680-90dd-4341-a255-71d12368f845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693163503, "uuid": "353c92d2-737e-4745-ba1f-93463f002a79", "value": "37e52a0c8e760dfffb0053fbe4729679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f075870e-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148204, "uuid": "25f55ce8-5099-465b-ac5c-4e10c7c43b7f", "comment": "Malware payload (Amadey)", "value": "5bbbe7ee47f10aa03e982636fd959cbc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148204, "uuid": "72df98c7-8409-4039-8a03-45f1a86580b4", "comment": "Malware payload (Amadey)", "value": "d82bd93fff04ef75b21252e95bdbdc85d19329d52b9fbaf7a9c4aa4f79dbdafd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148204, "uuid": "e0f5a266-9bf4-42b9-b04e-d08b19a610bf", "comment": "Malware payload (Amadey)", "value": "38874d55fcb10d57e7b04a55baee040e387a69a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148204, "uuid": "26e46818-1635-4c70-87d4-e87535c3f989", "comment": "Malware payload (Amadey)", "value": "087e91634fa783e783cfd26d868048c5f61ec5fb722fc49ca464999702b22edb9220ccfe5c95eac94331864cf54c7ec9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148204, "uuid": "85064cfe-42ae-49f2-aeb4-5235de8b51a7", "value": "T198051213F6E480B3CCF51BB599F642830B367C928978DBAB36951D0E48B36C8657631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148204, "uuid": "57984973-881b-4aa1-8980-60138cb623ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148204, "uuid": "08983e09-6fc6-4bc7-8886-7338a441a853", "value": "12288:gMrBy90aH0EE4hrxuZUpcdKxUqIH+RAvpdewnsH1YwfMMD9M3KkewA5gWG:Ryy6xuCtG+R6pRne1XX9M3KkewYgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148204, "uuid": "5e33437d-8e60-4383-974b-a3b985addfb2", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148204, "uuid": "835c45f8-bb68-4797-8695-9f63750966b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148204, "uuid": "ac2456a7-7980-432c-ba5d-1a6174a8937f", "value": "d82bd93fff04ef75b21252e95bdbdc85d19329d52b9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398df1a6-44b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126423, "uuid": "5c8079aa-ae2e-4ac3-9d26-50656520dd9f", "comment": "Malware payload", "value": "3fed85e71f93552ee0845ff1f641f4d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126423, "uuid": "bfa57ad4-558d-4d58-ae0d-d7b85990c6c8", "comment": "Malware payload", "value": "d95bb4ad04a812ecd490a4846d0e7a4a464736815ce26570fa416ec198928fc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126423, "uuid": "219f4ac2-9f9b-4890-ae45-c0db608e4ed3", "comment": "Malware payload", "value": "595cbb5ea17e21b44e68e752f22fab7c015ec66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126423, "uuid": "253628f8-2bd2-4217-b50b-65385d374841", "comment": "Malware payload", "value": "e4faf1e72abb1c263befa7a15b4bf298c62df5134f673f0c41991997bd9a9a5ee5c6f29af82e4f143cef9b3f7291b407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126423, "uuid": "e47b642b-107e-4a0d-991b-0efe364a8fea", "value": "T151653382F9659963D51E8435F23B9929D460EC2630F06397933B3F473FBB1E8109A1B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126423, "uuid": "379796d2-d140-4000-8228-deb8982b5b02", "value": "023e39c05185ab45562339252435df21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126423, "uuid": "7a85e31a-f5fc-4ce0-a42d-c2676109902e", "value": "24576:R5Td75nUoMNp7COt0CKyb3HYJ+HYclxnhlXTbB72XXQxqmGAHu:R55tnUomCOt0CHYDcl9hlDbpuXQEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126423, "uuid": "3049e6b5-d482-43f8-8fca-416bf96a0cd7", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126423, "uuid": "39b5f0b9-2fed-49f4-81c6-e4c88594dec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126423, "uuid": "daf9fce8-7912-4994-a977-9747fab005c5", "value": "so2game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35e109-4521-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693171900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171900, "uuid": "9a687180-4df2-4a64-adc6-43e50fc44d3c", "comment": "Malware payload (Amadey)", "value": "15f8c8a73e3e79c625e8909cd257c061", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171900, "uuid": "7c040c26-e9d9-4a8f-a256-03147efabeca", "comment": "Malware payload (Amadey)", "value": "da2da56f74781525856175d3076f3f73c06da79c39b7c3e72a42bd1ebbb002e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171900, "uuid": "df2ab761-a315-4e57-a4ca-d2046fb45883", "comment": "Malware payload (Amadey)", "value": "1a1879d75dc485cc9756765ff0b5aed891f2f4f4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693171900, "uuid": "bf982611-507d-437b-af09-dbb9b30617f4", "comment": "Malware payload (Amadey)", "value": "42cb87f199921ceeb338e387b103c239f63d6a76266298906913acacdb84f3ff24cf454dfceccbdb90fa8e5068989271", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171900, "uuid": "23310045-cc4a-4c42-a333-b745121bf26f", "value": "T14E23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171900, "uuid": "81fe2665-938b-4f69-b027-5ebcd585a119", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693171900, "uuid": "3200eed5-1f67-4ae3-a485-ca8cc5f273ff", "value": 49165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693171900, "uuid": "bd1dac74-3daa-409b-beea-9f2f0a2ac43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693171900, "uuid": "64a1a28b-7814-42b9-88ac-9cdaffbab924", "value": "15f8c8a73e3e79c625e8909cd257c061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbd35d1-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110055, "uuid": "1f4772cc-0d5e-4322-b72b-2c1be6ff3a98", "comment": "Malware payload (RedLineStealer)", "value": "a3ed0e1e2c49920ce7391fab7131d285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110055, "uuid": "190fb605-c1d7-4ca9-b36f-98c95d670050", "comment": "Malware payload (RedLineStealer)", "value": "da7fb30bf785c8c9473edbb5fa728b17edd715215e5cffe9bf3230c2cce93a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110055, "uuid": "c5b5b114-7efc-4b49-a2aa-f2bf2e40ecc3", "comment": "Malware payload (RedLineStealer)", "value": "72e45d7495fddfdfcc500b6c18a2b01367a34204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110055, "uuid": "c68866fc-e5d2-46eb-9ffa-7d4708aaa33e", "comment": "Malware payload (RedLineStealer)", "value": "c46a2d95b42acb0a08122734c5fc9fb672616aac11c7b1f1db4d2635a768592cbc5d6a58775b04775178b77b3778b869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110055, "uuid": "f6873080-35f8-4773-bedc-f2bef7366759", "value": "T16B652302AFED9072FDA22B7158F76B430A347CA61C758B2D6743AD5E4872B807432776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110055, "uuid": "80f45ec9-5ca2-42d6-89cd-dad2c9fb5dbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110055, "uuid": "d019e49a-f6d1-4ef1-8afb-a2877d0e679b", "value": "24576:my3dqN5QPV5toj0LNbKhXYEpvOFZFOYiXDNXiitMBOEVN8zGmfk6mr8Vl1vAyB4:18CPV4w9KhXYEhajO9XDNyitM0Eglmrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110055, "uuid": "d125a023-77f3-4b34-86b6-432dfbc36968", "value": 1488896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110055, "uuid": "2a29c3a8-941b-4045-8b12-1b118d07930d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110055, "uuid": "c6127380-6d28-4b67-95ae-0eb116b11df5", "value": "da7fb30bf785c8c9473edbb5fa728b17edd715215e5cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b7137d-44e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693143990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143990, "uuid": "357a9d06-ea82-46d6-8b73-38b3a4ed574c", "comment": "Malware payload (RedLineStealer)", "value": "deb2d397829306aaa29b90733adf2191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143990, "uuid": "2bb43960-a338-42cb-8e24-eebd2d239de5", "comment": "Malware payload (RedLineStealer)", "value": "db2f85959ae95c902298a3b67f6907975fa18a600aac3d9251463cdd06ede717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143990, "uuid": "08e8bad4-0db0-443d-9e9e-96ae5b73e7b4", "comment": "Malware payload (RedLineStealer)", "value": "bfb6a11ed8e2901fcfc8321039bc14b5a3b45e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693143990, "uuid": "2e044f62-a70a-49cf-8865-be572c6bace8", "comment": "Malware payload (RedLineStealer)", "value": "721e6fec1f7a0bbea790595095a10c879fa52eb2497dac13ffdcd355d478c695fcac7b3c1cafcc51d83708fc5e42fb5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143990, "uuid": "4a101e62-1628-4b2a-8813-f01049ed2dd5", "value": "T1C105239A97D4C122EDF6037048F662932E35FD619C7CC25B2B8169AE0C72694E1B473F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143990, "uuid": "858ed731-9792-4cf4-9137-af8f5e482a32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143990, "uuid": "61d24d5b-b927-4b43-a14f-90e81de69ec4", "value": "12288:fMrry90N2e0qxw7MOOf+n4na+oQlgLEQNyEoJGQmRECPAFN55KWshp8n88hKo9Ma:0yS2Fqys+camCp7plPoFKWUS88BMblQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693143990, "uuid": "b548fb15-6e16-40d3-b103-503e9bd718ab", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693143990, "uuid": "2aa6b1f2-0ccd-465e-a294-f72df490af63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693143990, "uuid": "71095766-864d-49ed-b5d9-d05e390f0775", "value": "db2f85959ae95c902298a3b67f6907975fa18a600aac3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c38c5-44b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693124155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124155, "uuid": "d4585959-463f-41f9-8f7c-179d7c556d1b", "comment": "Malware payload (Amadey)", "value": "c7606234a067c453c83154a8322c9c13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124155, "uuid": "b29b1502-0c09-41fb-ab17-0ea3da18c173", "comment": "Malware payload (Amadey)", "value": "dbdd5921c45695a0f7f66cba77e7ee5494b5150852c1d91caeaafa65ac765577", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124155, "uuid": "8f4b27e4-0ebd-422b-9807-b56ed064e25d", "comment": "Malware payload (Amadey)", "value": "3bf8951a2f6a1f814acca471a7b0ea83789011ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693124155, "uuid": "5016d98b-d8ba-4b20-bf73-6d32856fa8f2", "comment": "Malware payload (Amadey)", "value": "d9f746cbfaae38d5fdf28378b088c981bb5c2e59c44ba169c43abf2968932d4e8a7bf06ba1f23b68775b036a20180ed7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124155, "uuid": "c65e83c4-b54d-4fd3-b1c5-812a5460aadb", "value": "T1EE052293EBE98172C8A66BF518F307931B35FC938C75823B3255A45D4CB359068B13AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124155, "uuid": "9fe3fbb5-34fd-41eb-95a7-b2c596e3d12e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124155, "uuid": "3d32bb3c-4b00-46df-b0d6-fadba3088065", "value": "12288:TMr0y90z7atap0WUcy86Q3IqlanNl5jX9oJecysxHHEOy75Br91E10hJuRb9/LnG:7ykatCJ33IpnZX9oJUsNEbTPcnsSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693124155, "uuid": "85973959-accf-444e-9061-4ea6f5e622d0", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693124155, "uuid": "a125ef9d-59b3-4449-8ef8-36d5723a3b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693124155, "uuid": "e93f97a7-3bab-4de0-ba3d-fe6ae2dd0275", "value": "c7606234a067c453c83154a8322c9c13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae90ba6-4488-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693106426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106426, "uuid": "058ad9f4-4762-4219-b264-eac39ee58668", "comment": "Malware payload (Amadey)", "value": "049dba940ae82f0854bf40c8b4e797c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106426, "uuid": "4a9dc99c-1b62-49ed-86c4-5ff5e9706d07", "comment": "Malware payload (Amadey)", "value": "dbdec713237cbedbd00b8918ab933922e00df0a115bdbcbaa75cbedd1f47cb97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106426, "uuid": "d763d736-0e96-4ddc-bebe-b2df88377cf9", "comment": "Malware payload (Amadey)", "value": "66fb9bb6e60c5c3a8b98a373fa447815f04e5542", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693106426, "uuid": "396661a6-d481-4573-b0b1-423bd7152db1", "comment": "Malware payload (Amadey)", "value": "59d501706ad242f12e150707b6801e6b704a0fde3e6ae0a790aee68ebe851c08ffab34d091bc19357725e212729e3e4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106426, "uuid": "c0917849-be7b-462e-8a15-d131cc1e3910", "value": "T1EC23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106426, "uuid": "18314564-0d02-4145-ac21-9d5f025b9b23", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693106426, "uuid": "cefd3654-830f-4a09-b790-692a845f61f6", "value": 48896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693106426, "uuid": "57bde378-651e-4864-a0e0-69c22872ec6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693106426, "uuid": "5ed01911-4ab1-4541-9535-8eb5e76b5fa8", "value": "049dba940ae82f0854bf40c8b4e797c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e173222-44fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693156602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156602, "uuid": "3b765d1a-7cb6-466c-aba9-6503f7615f53", "comment": "Malware payload (Amadey)", "value": "1529678f458bb541653b4321e4e8d7bc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156602, "uuid": "fb623793-f68a-45d3-bc0c-437bdb644d1b", "comment": "Malware payload (Amadey)", "value": "dc8d21a57c36da8e09cd989595d345fca73b4dbd2bf0ded29a706780c33e0428", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156602, "uuid": "8d6b0649-f093-4cdf-a1e0-15c3a4fd6c80", "comment": "Malware payload (Amadey)", "value": "30419e279bb82c9e17d7865496e828e6f906f1a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156602, "uuid": "ba2703c2-543f-4a8c-bb5a-9cc820d347ab", "comment": "Malware payload (Amadey)", "value": "b509cb1acf34a0e9200f51be6f7a899c75a1176239ef9f22379baa724a0b9c55b8a694a5380a0a146b93f1d866674e26", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156602, "uuid": "e533a854-6ca8-41ed-9344-39366cd9b2f2", "value": "T12F23F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156602, "uuid": "409e8779-24fb-4719-98bd-d7e92f02b773", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693156602, "uuid": "d7753b0e-ffc3-4fbb-85ab-a9de3be695ef", "value": 49255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693156602, "uuid": "c103deb4-d38d-4a6c-81fd-b868398aefec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156602, "uuid": "e1fb4ca2-e16f-4d6a-b701-bd5b2c1d9eff", "value": "1529678f458bb541653b4321e4e8d7bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2773da-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693110031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110031, "uuid": "e3d2f0ef-8094-4d46-aac2-0e6a5d20b0da", "comment": "Malware payload (RedLineStealer)", "value": "9b23f9ffbc087ff973a8b9208639c2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110031, "uuid": "36196f51-1a91-495d-a9d4-a6b12d88704c", "comment": "Malware payload (RedLineStealer)", "value": "dcd6c2caae4d8b3ad7f0499be47858348829d9c4323542053f932e555f0373bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110031, "uuid": "6d2b6de2-b79a-4a59-9f23-2285412b54fb", "comment": "Malware payload (RedLineStealer)", "value": "fd1b1b8e157221d7798d7e185589623a20412743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110031, "uuid": "4dce3b05-d44c-44cd-a484-61f5ba95a68c", "comment": "Malware payload (RedLineStealer)", "value": "f80c76d42e813894d6702f3514060e2bcbf34adb4143a91e24eacfc6ae995bb6ef057146baa75d926f41b7de16ae6885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110031, "uuid": "6301643e-3784-4b87-ba17-5f3e65b363e1", "value": "T132652303E7CE54A3C9F6137098F60AC302767DA5497887B72A93B02A4DB3BC59536727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110031, "uuid": "1219264c-23ff-48a1-a064-bd770fd55b04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110031, "uuid": "4f41b87d-b530-43e5-b59b-05c52c048fa6", "value": "24576:FyYSSqy7rrTSIhceKLeYmHZSKvRD662jYSv6tyPB4Qx44yNGMnYOKU3d9wA0:gtCriE/KLeY8TJD662oU54k4NYOKUHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110031, "uuid": "3424d2aa-46da-466c-9001-da70e7a04682", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110031, "uuid": "66e3b1e2-9812-4a12-969d-abef939387da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110031, "uuid": "71f690b8-8ed3-4e96-b92c-09e441574392", "value": "dcd6c2caae4d8b3ad7f0499be47858348829d9c432354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ec747a-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169477, "uuid": "79b9c0a5-4b4a-4f26-af49-947eeb286a60", "comment": "Malware payload (Mirai)", "value": "994f7a61724fffb2b7bbfd794c980508", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169477, "uuid": "aaa24988-be20-48db-b0b4-a12910ccb693", "comment": "Malware payload (Mirai)", "value": "ddb7ac4a44174640d6bb7675426349d0b161c687a001d2368163d646844a0134", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169477, "uuid": "d153c061-d75c-4e94-935c-f69c12bc6a38", "comment": "Malware payload (Mirai)", "value": "1bd9b04e9cfc2868cb2567210652f9ac8b8feb42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169477, "uuid": "76915448-4a1b-4ee8-86db-ba10144d565b", "comment": "Malware payload (Mirai)", "value": "3686d8d43e817899bc9c0af7a9af7a08492e8851059f20f5c663f3a86f16e9ed69c09e83a378571e3d399abe2dca54e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169477, "uuid": "ca864ece-1748-4753-81c5-fbbb7961c062", "value": "T1F1536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169477, "uuid": "db6b01e3-709e-44b9-bb64-bf5c89cf2513", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E8C:N1TjJ8EVGOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169477, "uuid": "74876740-0809-4c57-89a0-9bf7dbbcb83c", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169477, "uuid": "6e2976a8-b1b7-4f6a-8a08-4cd3f6a7b1d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169477, "uuid": "58ba932c-3893-40cb-b7b2-dc6913ced0b2", "value": "994f7a61724fffb2b7bbfd794c980508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3819a9f0-451c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693169799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169799, "uuid": "00ed32d8-bc86-423b-b7ea-6f9aa705f698", "comment": "Malware payload (RedLineStealer)", "value": "52f7abc61ba15d9132665327d6191c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169799, "uuid": "abb03bc4-ee3c-4fc7-bba1-fb1c648b79e7", "comment": "Malware payload (RedLineStealer)", "value": "e019d115d5bfea14541e68031c027e52d5f59ce70d306086c113e2938605bac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169799, "uuid": "f1697f15-b88c-446b-b0b6-9c450a90e68d", "comment": "Malware payload (RedLineStealer)", "value": "2dcd017611b9f5f02cfac8162fa5663f95a150fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169799, "uuid": "3c2f6bd2-de45-4efc-95c7-1fbe699ec540", "comment": "Malware payload (RedLineStealer)", "value": "c5f83d0d542f70dd8b5465d842dbfd073dfdfd94e0aad388ca89ba98eeba129b8c16375a50c147172e22c2495fd46ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169799, "uuid": "70ec6b65-1044-441b-a220-251a33643445", "value": "T1B3E412126FD9A072D9F91BB00CF303C3063ABC326DA5879E2B11A9AA5D736C46575337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169799, "uuid": "7adebeaa-01e5-42fd-851d-44c7d7b6e324", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169799, "uuid": "d6cb01e1-9593-4fa6-a648-f5841f330834", "value": "12288:lMrTy904iWIsQxu6k4yZnw0ExP0On9FK2Qmk3xZ6EiYL8o5NUwtwbXhn/:Cy4zxu7IfPaj1L75WZX9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169799, "uuid": "d6356b8e-4c75-4d0d-a6fa-daa2bf6c9737", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169799, "uuid": "1f4e4e48-1912-4e1d-91c3-29f81627ffbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169799, "uuid": "3f5aed39-8cfb-4d24-805a-a9d237bcc557", "value": "e019d115d5bfea14541e68031c027e52d5f59ce70d306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4597a9-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126187, "uuid": "dd168b66-0651-4d0e-bffc-6058565ecd8e", "comment": "Malware payload", "value": "64fcf737ac6a5e79ad9635aed40596b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126187, "uuid": "e36727e7-beec-4f1c-af8b-f5ef40a9e0e3", "comment": "Malware payload", "value": "e0fb246bc477764252cf0d64eab313d2f9ee90d1429c50f3253a0f9758463437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126187, "uuid": "c53f130d-5df6-4346-b07b-e019e9e0f379", "comment": "Malware payload", "value": "577032d4c203f3f5b009352eb460ce96e0307e14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126187, "uuid": "4e7271a5-aa44-49c0-ba3c-a1c85c653933", "comment": "Malware payload", "value": "8255abf36cbd394c1ae56ba5ea6f44f4256389799500cf3d59c653a59b299b5c5b33dd7fd288a5bfe0e1a2fa90b326c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126187, "uuid": "bf20abad-57a7-4580-8004-36d727b7c5ef", "value": "T1CD75E1D3B6886835C4FB05B97136C6CDFCB084821F22E171F6EC586F75B4A698237A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126187, "uuid": "0efb8dea-6201-4af5-8a37-fa20e8f2e85a", "value": "6fc8163a6bac2b935df39c2e7de7c550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126187, "uuid": "597c1484-14f0-4c8e-b599-8ccab945026c", "value": "49152:RbnIgJGYRgrGhAIqzU+F5JndQ9ivN7T32yY/:RbJGYq4PqFF5JdQkrQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126187, "uuid": "34d62252-c9de-4691-aec2-c114112e1989", "value": 1585262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126187, "uuid": "dda365a1-af4a-426b-bf61-04b5154594c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126187, "uuid": "cb952dff-eb2f-49db-8716-10ade2aaa04a", "value": "vid2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a417cc9a-44c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693130467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130467, "uuid": "0012f7b5-c70d-4f3d-b856-26872b80180c", "comment": "Malware payload (RedLineStealer)", "value": "7c81d0892afe38a32f592121abbdea77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130467, "uuid": "8e950de5-e31b-45a8-841f-28e774bfb62e", "comment": "Malware payload (RedLineStealer)", "value": "e2b7e6c3b0b24524e17d3fe06ecb5b3932bde3c7dc5273c64dd364cc16bdb40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130467, "uuid": "b5ef9fd0-a185-4117-988d-bcf63cf04f7a", "comment": "Malware payload (RedLineStealer)", "value": "2b42761da41a0107209c09a86de31648dc8c3477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130467, "uuid": "11f50992-cc3e-4c85-95e9-ae3298ad6076", "comment": "Malware payload (RedLineStealer)", "value": "22bd12c70aa754958df08fc49f1a30143b20f4fd317f6e78ee44e587a1ffe765abd47d58bfb1c06852f4a4f544dd796e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130467, "uuid": "0e120d75-73d2-4cb2-94ba-829c35baaf12", "value": "T1691522515AEC0062FDF82770D8F312930B767C927878835B574A99AA4DB37D8A53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130467, "uuid": "fcee8052-585d-49eb-8f95-317b62a6700b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130467, "uuid": "866c1128-d7ed-4bd5-96a7-0db3bae6814e", "value": "24576:Dy5ZSLG/y2geL/tIAbW8shMC/4MWadE8tXVKMbqZQYg:WzkG/tL/tIS/C/RWsPvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130467, "uuid": "833c771c-2a50-4656-98bd-391aa4a13211", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130467, "uuid": "496b70f4-3248-4417-8dc9-53bc7016cf0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130467, "uuid": "32d6d42f-b775-4ac5-bc53-e74f9830e875", "value": "7c81d0892afe38a32f592121abbdea77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6f8a19-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110049, "uuid": "33281fd7-1cae-4cbb-bbbd-e0786635d921", "comment": "Malware payload (Amadey)", "value": "af41426f32452bf1b8f2fb9fda002a4f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110049, "uuid": "196135ec-beb7-4bc7-9f13-6ed003a70558", "comment": "Malware payload (Amadey)", "value": "e39498d66ec03acaa50d8cc575b3e9a7f918e4b96fb7f96075c66f581902f531", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110049, "uuid": "f35d7a22-835d-4a4a-b137-692eba8c5524", "comment": "Malware payload (Amadey)", "value": "d8d1e28898b33e3290dfe98809e7a13513eea7eb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110049, "uuid": "cd7196f4-f293-440c-a026-b800355f7109", "comment": "Malware payload (Amadey)", "value": "9d2903134fb5133832abee99ab896f8bec43ca3dfe1cfd44e8f1ae379bfb0bbdae3bbafc548f589f1aeef8cd5ed3246b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110049, "uuid": "5ba2cfc8-051a-434e-bd81-1ffddcd6d70d", "value": "T157E41213FEE99471D8B60BB048F601C30E3ABCA58ABD9267774649090D726C4B5B277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110049, "uuid": "69fd496f-947d-4316-984f-8a9742000f6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110049, "uuid": "5dc5fbf9-ceeb-4169-9673-7345389db974", "value": "12288:AMr+y907cIrOPkG3E7sK4W6k4aKuhV52Y1khVvA0qlgI/4klgZPWV:uyqdukuJ5WYXWVbKOFVXGZPWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110049, "uuid": "820e4a6c-7164-4bc0-b8c7-fe9bb595e53a", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110049, "uuid": "538fa4c9-bab4-452e-a271-bd9695dfc944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110049, "uuid": "b96ce9d5-1508-4244-ab52-af8d1c2586fe", "value": "e39498d66ec03acaa50d8cc575b3e9a7f918e4b96fb7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b0f11a-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148193, "uuid": "81ca39ee-27be-49a9-a0b6-3205b3591a3e", "comment": "Malware payload (Amadey)", "value": "a10248740b1dad5cde5e74bbc45ef672", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148193, "uuid": "3fb44072-104f-4e2f-87aa-f7d0f5497ac1", "comment": "Malware payload (Amadey)", "value": "e40e35ad915ea332294083cf9f024e9c855309bc1fe509ffc1f9ae33bb6064ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148193, "uuid": "b73ebc59-6411-4a90-b43a-f4a523c5889f", "comment": "Malware payload (Amadey)", "value": "fbd1cbcfef6353ee5a73da3804e565b9f02b6991", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148193, "uuid": "5dd7278d-4400-41e0-916e-63e70bd945c2", "comment": "Malware payload (Amadey)", "value": "fe81474d922987bbe51cb3cf5395f425efef5d26851252dd118fe770203a75b306b0541f13e179f55ec6c6ba3cab853a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148193, "uuid": "4315c8d2-dced-4683-9dc9-c74cb08a0315", "value": "T1AFE41202A7E995B6E8B51B7428F343930E3A3CA28D35873B67C9196F1C735906236773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148193, "uuid": "266c5d58-b607-41fe-b53e-583f80adec74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148193, "uuid": "b368a3c3-c721-4824-bd44-050abfbf1064", "value": "12288:LMr5y90ECKIElk6k6pwNQsy4GV1QmamCMVxLB8ML8MoZqT6U6LTQAa:SyQKXl/pwNQsJGdPCWRpoM6f/na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148193, "uuid": "1fabac3f-9313-4620-9738-47a0bd6d101c", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148193, "uuid": "10ecb013-53d7-47e2-92aa-0ccfb440996f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148193, "uuid": "630c0264-c6ce-40c7-b84f-e19c00f1ce12", "value": "a10248740b1dad5cde5e74bbc45ef672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4351ab-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CryptOne)", "timestamp": 1693126132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126132, "uuid": "dd3c65eb-6439-4a0e-8bb4-dc2aa312d842", "comment": "Malware payload (CryptOne)", "value": "3a1aebaceb117f1f07b2da337f625983", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126132, "uuid": "43d40f75-dab8-404c-bf06-088ae21a780a", "comment": "Malware payload (CryptOne)", "value": "e47c1d156b17c009b7c8a7fc14a5d1a6b988515a2bf79995f0d80d3f24726834", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126132, "uuid": "a1bb9fb9-3dd7-40e3-b4cd-ddd869512cea", "comment": "Malware payload (CryptOne)", "value": "2f9663ec8981a1190ee6fbb0a14eaaa4c8d7b259", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126132, "uuid": "48e315a0-fe75-4394-a20a-e377e7d6df97", "comment": "Malware payload (CryptOne)", "value": "3290cd55c364044b1e3ea32ebcd34020824dbce33a8e0c4bbfd882a0e356655f7de9da9ab84044a261bd4d70474a695c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126132, "uuid": "0f01addb-0c24-4adb-aa59-7678d89033fe", "value": "T1867522217AC09971D96609305AE19731BB38BD201B364EDFA7581F1E8F304E1EE397A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126132, "uuid": "18d596ec-1794-4daf-9bce-84242c9fcaee", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126132, "uuid": "b4b33c8a-faeb-465f-bb0a-8f73cd1a4ae6", "value": "49152:908/RY7Ff4dHMuPHf55+Ts6IIDiVnHd46vxXPJ:e8/R+fyFvf5QTXHDC46Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126132, "uuid": "d35367b0-1a00-4070-a51e-29cf0519c70a", "value": 1652412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126132, "uuid": "21bc9455-6ddc-456e-af8c-4a03a1c07ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126132, "uuid": "a8a19ab4-4db9-4788-a86c-5be220c7accc", "value": "linda5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34f3e35-4496-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693112453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112453, "uuid": "13ffa98f-0280-4e37-ba18-79da5bd94e34", "comment": "Malware payload (Amadey)", "value": "73337423e405c3c0b71629c63c6f6cfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112453, "uuid": "e656f5d5-18e4-454d-8e42-ee510442e25c", "comment": "Malware payload (Amadey)", "value": "e538197b7b5154f17ffc93b45cfbc82b7065ed16e27679d52b4c23bff5457297", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112453, "uuid": "dcf7aab9-7c62-42a9-bd43-cf790fc21dd7", "comment": "Malware payload (Amadey)", "value": "539742b03de3ff3740a3d8d743ec9714904cd047", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693112453, "uuid": "1b090c88-02d2-469c-b741-92eb9138b23b", "comment": "Malware payload (Amadey)", "value": "f2cc1a7dd9e9347b791046da1857424139fa5360968fb1fa480eaa4b8c910550495db534cb014be5f1810ab1bfa8b547", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112453, "uuid": "9466050e-e334-4bd9-ac8e-d38e5f38742a", "value": "T13BE41267ABD48072EAF41B3029FB07830F3A7DA01978C75B5785A8961C73790D87276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112453, "uuid": "6d45f848-222a-4f7a-ac91-12e2dbc9c924", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112453, "uuid": "074de452-7f9e-40eb-a1c8-f5ed03a86abf", "value": "12288:hMrHy90j/L2EvY/JCfPeltFzHxjSGFJ7CnJYrHT9UmdcHtJj+nVPGK3R9dwuUP:myoL2EvYRC3elPrZzenJYrKmdcHTGRYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693112453, "uuid": "1e5b06e6-7d34-4c01-a106-4c47cb9a2771", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693112453, "uuid": "f0afa8ca-3ad5-4079-a2b8-56b99d9402b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693112453, "uuid": "7e4671d2-a8c7-4b69-ad07-fc9ae671d77c", "value": "e538197b7b5154f17ffc93b45cfbc82b7065ed16e2767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7841f8bb-44ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693134688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134688, "uuid": "ce7ae076-7ff7-413f-8feb-8bf04b49df6f", "comment": "Malware payload (RedLineStealer)", "value": "b4cb3897e2524b255715ebccf1dbbe66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134688, "uuid": "6c2e2e29-8ad0-4023-98a2-16b6e896b016", "comment": "Malware payload (RedLineStealer)", "value": "e6135c3ee6e5420c74c0ccb95805681f87266a4106f7892b7343ba8b033e4060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134688, "uuid": "9d380042-5dac-4c41-b33f-87b7ec616af1", "comment": "Malware payload (RedLineStealer)", "value": "74e4ef98ad0790d70e6ec3fecc2815f675f74cb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134688, "uuid": "d367ab09-9be9-4d40-93e1-0d291980ec7d", "comment": "Malware payload (RedLineStealer)", "value": "e16551f89b67aac83f87802c043cd210e13852cb87b4bb8a21ca2c54cebd54600ad14e50b8ac4d72b14d1d02dbf54139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134688, "uuid": "450519bd-91ec-4e2a-b240-32e31f4470ea", "value": "T1F9052202EBD80063DEB94B701DF716C31A367CE18D75235A67965D2F0CB23A0B922B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134688, "uuid": "42b645c1-ed25-427c-97c8-991e33563ea3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134688, "uuid": "eb49d314-372d-409c-8129-6da876a4a9ac", "value": "12288:dMr4y90V053iUlKACY3Wt3XcsHJmloGRFZ93CfSDJRp8MsrGPzWYlZloBF1loVFH:dywC3JKAqsCILyfYnurGSY3loBFTQGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134688, "uuid": "3c31bcda-3601-4ea7-b1b4-c41abe9bb706", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134688, "uuid": "44d2f0a8-8c8b-408c-b21c-543db29ec0b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134688, "uuid": "84cc6fcb-a6e3-45d0-aa28-70b9fd0fe3bf", "value": "e6135c3ee6e5420c74c0ccb95805681f87266a4106f78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca684f1-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110053, "uuid": "823de008-9fe7-42e6-9298-cf23bf86e1fc", "comment": "Malware payload (Amadey)", "value": "a35430c7618e81fe78f640b83d1f47c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110053, "uuid": "aa74b66f-160d-4c7c-994b-b78e4f66ae32", "comment": "Malware payload (Amadey)", "value": "e761e73238672a8189ae516c6ed7ac4e8cf3d1f9537fb9a17d25e6a714c89b6a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110053, "uuid": "3a5a61bd-3707-4885-9bb2-4cce81a44ab7", "comment": "Malware payload (Amadey)", "value": "24d37daed6557ba2b8b4c680b86b6592e9ed9e39", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110053, "uuid": "45292e5c-ebe7-4a57-ba31-9a680ed3ed46", "comment": "Malware payload (Amadey)", "value": "6d1ef3151574c7377afad6cd0276c8a0919c7c31d1132422057b939d1bfc3296a38accfbb03afba2a47512b26a9ff99b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110053, "uuid": "ebdffbd6-05d9-4c16-bdc7-b9610977e36b", "value": "T1B1E41253EAE88473E9B027B05CFB07971931BDE54C74C75B2789994A0873AC4A93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110053, "uuid": "164b2c63-721a-4faa-a220-d8a75a650bab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110053, "uuid": "21ba35f8-fee5-470b-bfd6-fe7f4886d0d8", "value": "12288:mMrIy90ZnZNVFF4qM3ytgF+HecNCDkB/gCWfSPPeDb6DT755cdEsgdZUdjab9DkZ:GyQN3P+c0OgCHPeqV5cdET6deBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110053, "uuid": "f4b4fca9-4631-4a41-b22f-2dc19d77be33", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110053, "uuid": "f7540b67-dcb1-477f-b958-640c1d640889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110053, "uuid": "3ea17133-1034-42bf-b62a-a44d48eedfa5", "value": "e761e73238672a8189ae516c6ed7ac4e8cf3d1f9537fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b279578-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693129861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129861, "uuid": "60c6620b-1fff-4b96-851f-499c81e15a05", "comment": "Malware payload (Amadey)", "value": "e577193e2cd7c8f7168dd733aef5d71e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129861, "uuid": "7237ade7-a58e-449d-bc79-c5d27885ee3c", "comment": "Malware payload (Amadey)", "value": "e77d921bd66381e907ddf36716c5b9a29260bd883b5dfbf336a7949f06a31f35", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129861, "uuid": "327eece1-0a89-4393-b4cc-3eb3e102fa31", "comment": "Malware payload (Amadey)", "value": "0be6a7df24d7d76ca775bc4596b002f18b2d3d4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693129861, "uuid": "2c485715-3a00-43ef-bc83-b4602fdc53a6", "comment": "Malware payload (Amadey)", "value": "24623a028db72c0484a2e6498bb7c72977171d2b7eeb465a8b73f6b4a79684d175129d6e723c8acbec45b66a99759b36", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129861, "uuid": "3ecf57e8-0c1b-4e26-adb9-c2e32cbcaa29", "value": "T14EE41256FBD81432C9B65B3158F307C30A3539A25EB4836F6791790D0C722E9993AB3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129861, "uuid": "1ca01e92-b72d-46e8-a4b9-324f8755150b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129861, "uuid": "3c185a95-1aea-424a-9b67-fb991155627b", "value": "12288:5Mrjy90CdDlE+iIoF5hjtm75k0/r2kidvhQJVz27MxjyL49tMSb:uydlESoFjj05lz2kixhCt27M59tMSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693129861, "uuid": "d422e2e0-f507-4c9a-ba46-0c0a1649d2c2", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693129861, "uuid": "547deeb9-b076-4141-aa98-aba8666352e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693129861, "uuid": "2bc32978-0d2d-4ad9-88a4-1a584cbde513", "value": "e577193e2cd7c8f7168dd733aef5d71e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d8eb24-44ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693149715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149715, "uuid": "8adf62e5-3d75-448d-ad81-c322f3900de5", "comment": "Malware payload (Mirai)", "value": "69a9338b3062d5dc17c0ab9c570d3e37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149715, "uuid": "7d1b5b1f-86e6-4b7e-af74-aa7e723d0e14", "comment": "Malware payload (Mirai)", "value": "e850cf5de5eed266953edd4922867d78a713e85086d77d63ff5593521bca1305", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149715, "uuid": "817a8166-8cb8-4cdb-9f92-aa92e54eac1c", "comment": "Malware payload (Mirai)", "value": "299db6737cbc0a233201596e9019d4fcf1caa519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149715, "uuid": "2336a62e-20e0-4cb8-8c32-6f2465fe0e25", "comment": "Malware payload (Mirai)", "value": "17e87391e6678ab83c019a1c6eb79b271e79297dcb621ba26df5f82d7e29bbbdd1360458478e351eea748d6d3b19e529", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149715, "uuid": "c717365d-2863-49fb-81c0-0e69b5fef714", "value": "T184538D75D12DEEA8C0424AB4A9598E704F13A0C046733EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149715, "uuid": "2b3ae88d-7a7a-491f-9dff-df2abdb67bbd", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149715, "uuid": "fb2ebcba-9afa-4b73-a38d-f90f58eb6f2e", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149715, "uuid": "bf98677b-735b-4502-a338-c8811b0e614c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149715, "uuid": "be627f2a-1187-4899-9f60-4469b733beaa", "value": "69a9338b3062d5dc17c0ab9c570d3e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29bcd9a-44c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693134383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134383, "uuid": "66e18df1-423e-479d-8037-e761e3223865", "comment": "Malware payload (RedLineStealer)", "value": "abb36a78e420ba847c46830f59b9346d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134383, "uuid": "95f8e4fc-13a6-4397-8b72-3a87f9a78a8d", "comment": "Malware payload (RedLineStealer)", "value": "e9b79770a34d56d27f240c8c9e8598d15e660b114c1226fa767807b825a208ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134383, "uuid": "03a623d2-8486-4f8d-a148-ad9b6998a69c", "comment": "Malware payload (RedLineStealer)", "value": "61fb910723a2b28524ee968a4f5fb091f7d2daf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134383, "uuid": "f2ea966f-ecbd-4d74-b2ba-bc93958a7b7c", "comment": "Malware payload (RedLineStealer)", "value": "45ad9efe0ab9ee84fac4cc8c7b62d2e5c6434901f8e96ed3d14556c1aa6759448135948e1efc09e92853a0d136c4ba32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134383, "uuid": "a36e97bc-6043-4b74-8b93-48cb83154932", "value": "T1E1E41223ABE48073EC7917321CFA07970B397CA15D7983AB2355A9AD0D73790983176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134383, "uuid": "062aa5f9-2d29-4281-a8ae-0acad476d132", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134383, "uuid": "41f4e99c-47f3-4700-ac12-16ec255cd56a", "value": "12288:9MrZy90PCbGnfkShIyRtd5xyN6Pig5GnL0zbYdcYJ81QfZpO05ej/2:wyOsGnfZhfL3yN6PTU4DB1QHO05eju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134383, "uuid": "e1a04d6c-b104-4596-bb30-6da303e853bb", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134383, "uuid": "bcf37841-914f-42b9-9b32-a6ef8873e26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134383, "uuid": "c1f92dc5-e2d7-4dff-8c6b-05d76dba6779", "value": "abb36a78e420ba847c46830f59b9346d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02355ccd-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693147805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147805, "uuid": "f12452a9-a842-4c35-925c-1c408c4fba50", "comment": "Malware payload (Mirai)", "value": "50eb97875970555299a3622e865972ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147805, "uuid": "74649c4c-1963-4a82-bb49-f3d650d04eae", "comment": "Malware payload (Mirai)", "value": "ea1d8e484bd746c8cdd01be02e5450de8e9ec281345b1a54eca4647e8c4cfb01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147805, "uuid": "eb900199-dee1-4c05-9b7a-144ff33bef90", "comment": "Malware payload (Mirai)", "value": "de740a4ce707f6b578ab00a9fde410117d4dd637", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147805, "uuid": "46721c79-97a5-4998-99da-9a9ded10176e", "comment": "Malware payload (Mirai)", "value": "1261b0bdff9a3f8b89eb1ef0bb600ec47d54b98dfeae9147f6e0780150e84efaae66b5ff5eeb953731936949853985f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147805, "uuid": "722087e3-7e3c-4814-bf14-e16e85660ca6", "value": "T17AC2D1A295F6CA17CC63437E1938167361581C55D30DEE3D1B2BAECD13884E62ABAC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147805, "uuid": "ec4b4ab3-0e8c-4809-b195-1db9e670f951", "value": "384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHci:X5+Kcrb9VDJef5Q2PdHuzb8HoEPbjfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693147805, "uuid": "33e0dacf-c3fd-49bd-ada5-ddd70e7ae724", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693147805, "uuid": "2b8a9d5e-f8f1-4577-9734-e5908dd6468a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147805, "uuid": "f2b469a7-8352-4956-b13d-cf86e238c0ce", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5a05aa-4528-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693175100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175100, "uuid": "f7c63da1-1387-47cc-9c52-d7edf863c40e", "comment": "Malware payload (Mirai)", "value": "c56543b8d388b7b3280e2d47b15032d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175100, "uuid": "424d39ad-d3e8-4372-b80e-22de5dafb0a8", "comment": "Malware payload (Mirai)", "value": "ea9af29b3b60289b32a5831add7b81d927326f6819509efcb5f869114753a252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175100, "uuid": "540ddf53-9103-4aa9-bc2e-7bf996afd92a", "comment": "Malware payload (Mirai)", "value": "19d90b29c313a5c3e969923469f9bf9a4386a7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693175100, "uuid": "1063603f-7aaa-45b5-bec3-e22ec3c255f9", "comment": "Malware payload (Mirai)", "value": "7fa8289886f68cd6b6806b579934c460c6a467f03a1e11b6eeed6f5533a8faf43e546ef7cf62937511a45dcc5e68492f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175100, "uuid": "63294dce-0068-488b-9feb-0544c02f4e8f", "value": "T17AB2D03605CDADA2C9609870FAE9C3082343067AD5BF705A37814F79D7D1299A2255AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175100, "uuid": "3802a85b-78d3-4598-ada9-2ed7fc41cb56", "value": "384:t9dWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl01VlbTjyhymdGUop5hy:t9dWCp0E/oZ1zZBT31TYsCcL8zXcLfy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693175100, "uuid": "c483b5d6-01a5-48de-a466-0e6f04f5de13", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693175100, "uuid": "3f0c7912-934d-45e0-83d4-dc516353ae98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693175100, "uuid": "545a47a8-a1b6-463e-a1da-abc29c3b92bd", "value": "c56543b8d388b7b3280e2d47b15032d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17234975-4498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693113050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113050, "uuid": "26b8f201-c4e6-439e-9ce0-e97b6b5b0d4e", "comment": "Malware payload (RedLineStealer)", "value": "3e0bf41de9ee565494a36b0be98c4d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113050, "uuid": "e6dfdb1e-da08-4373-8ff9-24201e13029e", "comment": "Malware payload (RedLineStealer)", "value": "eaac1af62999455401083c555143ee944719afa08475cccb14cbddb0d9ea6159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113050, "uuid": "2b82fe5e-05b3-4bc1-ab0b-99d1c6a116eb", "comment": "Malware payload (RedLineStealer)", "value": "e4ae6b64bde048d8e4dbd9d72611bf4a46e73c0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113050, "uuid": "cdcce86f-d6e4-4306-b6cb-e055c6666a93", "comment": "Malware payload (RedLineStealer)", "value": "8d3896338744b269f7c44417702eb714202fe33a4fad9b1dcc9d0655c5e7311fab3fed1748e662e79c176775ea1f93fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113050, "uuid": "4b2cd1f1-aba0-471f-b89c-7a3ffc115990", "value": "T123E41212D7E98573ECF4137018F703870B757DA5A9B8839B2382BA5B18726E45A3172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113050, "uuid": "4b74d750-4235-469a-b036-8db72ded40a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113050, "uuid": "225d1851-dbd8-4b75-8749-be5d907a860b", "value": "12288:jMr7y90QTIy8n3QNb9lgfKDi2fkjPQisFYbBH0NAdNCRAB4ht93HmXuYv:AytI330Rt8jPqFMUMOAB4hHWVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693113050, "uuid": "6cb6a08a-861a-41d7-a01d-a12714313124", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693113050, "uuid": "65d67091-3926-4a37-a4e4-d9a7774d4c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113050, "uuid": "e32c748a-8532-47b9-bfc1-1bc05b2a6092", "value": "3e0bf41de9ee565494a36b0be98c4d82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e43f4c-4485-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693105228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105228, "uuid": "10d4b5d5-ecbd-4d2f-a352-3d106ac03bee", "comment": "Malware payload (AsyncRAT)", "value": "2c493c99a0137d0064ab61279a3b824c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105228, "uuid": "2c9ad8b4-183c-4e58-a843-006ad32143e8", "comment": "Malware payload (AsyncRAT)", "value": "eb14d88ca888b4da123f5fdf79c4b9128c89b424b4f02f94562cd5eea974ac5c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105228, "uuid": "16217c00-12bc-49cf-b500-1afa5db1a2e3", "comment": "Malware payload (AsyncRAT)", "value": "c3356e966ca12df358193146b0e0cc9ffae2ba33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693105228, "uuid": "8cd2469f-f552-4448-8743-18f490ce9593", "comment": "Malware payload (AsyncRAT)", "value": "d36fed0e4f258cae818cf2b7f28ee3ce6ce6ecadb53ab48899cc68b16b7f31a458360e4fb6c456d69044fb45cd3246b9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105228, "uuid": "749677ab-3184-4416-aeaa-e76cabcd517f", "value": "T16953F7013BE98025F3BE8FB469F365854AF9F5AB2D12D95D1C8900CE0532B869941BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105228, "uuid": "5bfeddf6-6055-4817-8014-f119c87a833d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105228, "uuid": "d6159fb2-2f7f-49e7-9d92-fca76d404df3", "value": "1536:Sa2hiZpvskDeoKuuUYFkcU/By5bKAPa9gjcr+TG5x:Sa4ijvskxKuuUYF9My5bK1gQsCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693105228, "uuid": "acdc524e-6ec8-427e-88b1-76e00e55eae9", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693105228, "uuid": "25eb4eb6-3341-44e6-a55e-b4353c86e118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693105228, "uuid": "0d6303a9-11bc-4803-a82f-5f13f9a22030", "value": "2c493c99a0137d0064ab61279a3b824c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7397c84-44c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693130472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130472, "uuid": "fb26c815-c2ea-4f8f-a7e4-adf5a077c973", "comment": "Malware payload (Amadey)", "value": "4a66d237b6f2441ae14f333bb76a3155", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130472, "uuid": "3212dc0d-7908-4fae-bd48-cec77e0bf20a", "comment": "Malware payload (Amadey)", "value": "eb5282d9746418a88873e547ff74c7ce352c256b769c6a018c001ef7752ddbf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130472, "uuid": "7ccccd41-b554-442c-8b27-20b6d9aa897b", "comment": "Malware payload (Amadey)", "value": "731068c30f281d4d25ca4c72a81a42754b92b273", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130472, "uuid": "ad536944-681e-4558-a2b6-77be08519259", "comment": "Malware payload (Amadey)", "value": "7060c6f896c62bd4f016308a76e45e851b6db0892c9e46ad7d1ce8121394028492a4b784ec765ef6e9fb9d5ada044de5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130472, "uuid": "ce08f0c9-ed1d-42d0-b4e0-0dd9ae66cac1", "value": "T15923F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130472, "uuid": "d6439abe-9662-49fe-a618-614a9af1129b", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130472, "uuid": "34aa994f-b5bc-4f21-a9ba-ac2aded47079", "value": 48899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130472, "uuid": "146d5e36-8710-464c-bc51-e2ed3fdf805b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130472, "uuid": "c339c7d8-7200-44cf-8f7d-0c859aab0736", "value": "4a66d237b6f2441ae14f333bb76a3155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650bb411-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169445, "uuid": "9e94891d-98e3-4830-8e4a-8c1d669cc376", "comment": "Malware payload (Mirai)", "value": "67076d170bcdc6d17ead5ecd56934dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169445, "uuid": "20b19634-c37c-4f78-a828-f88ae1f0a51a", "comment": "Malware payload (Mirai)", "value": "eb71aeb6f27aa6e09b66e259e9137bcbbad1bcf9efa9166371dc63d89e9a51d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169445, "uuid": "f4dbedfc-3054-4f8b-b267-05fe19f00331", "comment": "Malware payload (Mirai)", "value": "65f47ea0f85cb36d200a45a78cbb0f9621ce8e19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169445, "uuid": "30231087-f65a-4737-a8c9-5791a5e4a507", "comment": "Malware payload (Mirai)", "value": "90ded2a4153c159077b315f39080a9c1abe08a93a201844e3333c03a05134da107f66cabe951905dcaacebd933f0daaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169445, "uuid": "b170ad1b-1a6c-41ad-9d2e-c7d2dfebb969", "value": "T1DF539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169445, "uuid": "2aa2f9ee-147b-4800-83c0-510449e3bde4", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169445, "uuid": "2988f872-ef9c-4c75-a065-abb67d4bc4d5", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169445, "uuid": "a8000add-b033-4746-96d4-cbf4e382eb7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169445, "uuid": "9dd5d030-ec31-4b22-b47c-a7d63ff9225e", "value": "67076d170bcdc6d17ead5ecd56934dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7b6cc8-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169407, "uuid": "a40d0fd7-4b5c-4d00-8e16-4c9242ae187f", "comment": "Malware payload (Mirai)", "value": "08c2fac4f92556de6a9fa8e36b152dbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169407, "uuid": "ad260d10-1e08-4841-98af-059b33ddb6d5", "comment": "Malware payload (Mirai)", "value": "ec295139412c226b853847ffb687ec49db8a9b0a2d461b50c97ba9959b36ad55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169407, "uuid": "c48b9203-35e9-4785-ae1c-57b3b17a73c4", "comment": "Malware payload (Mirai)", "value": "356ae4bfe6823b1ee39e0629272c881a6dfdbc6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169407, "uuid": "5e7267d9-44da-48dc-a99c-6ef705030575", "comment": "Malware payload (Mirai)", "value": "8b1093bc6fa857bedf0edb0fc1392b096d55f38aa02d3309549bd63295b12a181c8fc70cd9e8045e9f6e3e8cc636c388", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169407, "uuid": "25e2f67d-5f53-4726-a617-6ea49daeb359", "value": "T177E2F1639362E492DE786BF1F569858E6ABD4FACC17A30A21705571C3E9B0435F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169407, "uuid": "88956486-1239-4640-b809-bc725bb40f51", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9X+g9q3UEL5Id:1orm1vpALgUJ+pLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169407, "uuid": "f94fed22-da30-44bf-82dc-bbaef4be3104", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169407, "uuid": "81faa31b-0711-4e33-b991-efa22e2e10df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169407, "uuid": "29fc0a57-79e5-4e2d-a1a5-aaa9bcd0733e", "value": "08c2fac4f92556de6a9fa8e36b152dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1429429b-4525-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693173604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173604, "uuid": "796a253d-2873-42e5-abaa-727b0b9d372b", "comment": "Malware payload (Mirai)", "value": "f3a5fe3ddb1c04cad1613238a6562c26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173604, "uuid": "4802278c-18bf-4168-9f5d-62e4c7ccb056", "comment": "Malware payload (Mirai)", "value": "ed6094eec05382deff63f28e028a2d53ee6078aeaacd072c95ea8fe6e97f2a62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173604, "uuid": "ddfaae76-2f26-483c-814e-89c12f5b75fb", "comment": "Malware payload (Mirai)", "value": "7da20da85571dd8841d2e04e5e2baabc06544165", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693173604, "uuid": "0db5529a-9409-4d09-b7da-002d0d1d51dd", "comment": "Malware payload (Mirai)", "value": "6c24a04584e3502920969ab5818e95d5cb71d97b4606e5bd43ba8a6c95c0f864a39120eaacb0be2f0239ad2d73ae0dbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173604, "uuid": "2b7b3454-e00a-452e-8657-bed0f8f811de", "value": "T1B933F291802EADB5C8B02DB1D49459E07FBE177CF94F772EBA489A8530871976FF4048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173604, "uuid": "0b86977e-7847-4f76-abbd-9bea9e819443", "value": "1536:B+wg7A/ww96jocI0ALm1IpXVJc21+3on3:cww8ih4Lm1IdI21Mon3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693173604, "uuid": "926dc2bd-1acc-4ce1-a5c2-1f30876ff208", "value": 52524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693173604, "uuid": "eb1cd1a6-cc81-4952-8094-8b497ff41f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693173604, "uuid": "480c0e53-776b-44bc-9a4a-1dc89a72b5f9", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfed2ac-4485-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693104925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104925, "uuid": "0dae9ea6-2860-4261-b1c6-9972ba89b9a7", "comment": "Malware payload (RedLineStealer)", "value": "205f3762a18099d7c42bd98c5420a266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104925, "uuid": "a27c74e9-90e9-4c86-8d0a-c2d5aee3c6aa", "comment": "Malware payload (RedLineStealer)", "value": "ede4e5d3122653da10829a3c17397075d9fb050ad2acd1a172abad9b4f8b25b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104925, "uuid": "0b90ae2c-67f6-48be-b455-391762e17c26", "comment": "Malware payload (RedLineStealer)", "value": "550578a3a0cd412bfbb473fcf56ec1c43ed10617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693104925, "uuid": "435103e8-dcfe-43d6-a509-531df6ca86dd", "comment": "Malware payload (RedLineStealer)", "value": "0154d990bf56afbd06ab24fd2fda2e1087a2af8a0eb445acc6f313c8ca7a2af47360b7c6d5a3b847d2528b57e473840e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104925, "uuid": "55e3bcdf-12c3-4c11-ab99-0c82d0664184", "value": "T1530523527FD88437E9B657B119F307DB0A36BC92897883AB17469D168D326C4B13233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104925, "uuid": "c813962b-c81c-475f-922b-24e8870a3173", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104925, "uuid": "e21b3159-bf70-4437-b961-4ebeb20c4fd5", "value": "12288:BMrVy90RtyIT98U8TWrJ2uFvLu6A99DpAIxa4fAFSC4dkfisqy3mHCC/bbpNcdVY:syE44HrJNFvLu60AurrSAiWPkGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693104925, "uuid": "b0a22db6-90b1-4802-aef0-c1ce6308421c", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693104925, "uuid": "8816cf31-c550-4323-a524-ce97144b79c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693104925, "uuid": "d63425ef-cb43-475d-be19-f6e17605f9f4", "value": "205f3762a18099d7c42bd98c5420a266.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7712c2df-452d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693177206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177206, "uuid": "3b0baf0d-24d5-4804-85ea-593ece55d866", "comment": "Malware payload (Mirai)", "value": "63bcc0126acfeb74f4cbc89729525224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177206, "uuid": "b7eaedd6-ca4f-45f6-9708-f9e98c521c85", "comment": "Malware payload (Mirai)", "value": "ee390641b5d8bf89c81bf6cdcbe21d12d3c7022ce81fce54b786fe68c54ecc9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177206, "uuid": "88ae5249-56b7-42e3-b550-eeca60195463", "comment": "Malware payload (Mirai)", "value": "6141a4a4436d04ff3d3d1a58b6cfadbf32a4eb0b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693177206, "uuid": "a76d0a7e-9c05-48a2-af28-574d16d018ac", "comment": "Malware payload (Mirai)", "value": "e043e39ed3b6d932f2657c222c14492232d07917a60ce6df8b33545cfdbdac97afe5000ecdee36e82d230a12fb6cb811", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177206, "uuid": "03d975c7-f5dd-486e-9d4f-b2d13617619a", "value": "T172634C94BD406A22C6C25677FF1F124D7B1A879CD1EA3303D9295FA037CB81B0D2765A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177206, "uuid": "dffdcf37-8bfa-4653-9fa7-9506fb2eca30", "value": "1536:3+Q3kKdVB54E8CuKsJ+DHscMBiYrNEbVYxbargWNrvYM:3+Q3kK54E8CjvMPBicNERYg35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693177206, "uuid": "49a43d84-7207-41b7-a2a1-ef2b31e8b223", "value": 72004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693177206, "uuid": "b25e54e0-5e72-4a69-9924-5bfded90e416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693177206, "uuid": "ff873ee9-5568-40b0-a976-64f435d89e51", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707bf896-44b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693125656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125656, "uuid": "9f6aa881-23b3-4ce8-b5a1-7b79a1f6b5e3", "comment": "Malware payload (Amadey)", "value": "0406369726d158f8dd15f1fef42daa97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125656, "uuid": "e427c7e2-6774-4fb0-a8a8-8c44654389cc", "comment": "Malware payload (Amadey)", "value": "ee71f1d9040693aa981e35ee79b44102d7f3b4183fb07ad309b3fbdb1fcb1ecd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125656, "uuid": "8bc574ba-4d6a-422f-b7f7-3c8763a334a9", "comment": "Malware payload (Amadey)", "value": "5ab2ebf92a59c6c7a0474fab23f21897167251f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125656, "uuid": "dd09189d-4af0-48fd-a9c5-097f113d7ab9", "comment": "Malware payload (Amadey)", "value": "c3d45675f989ce09a5bb3efbf53ddf2a4bf3dbc7a5fb42ef36efd9316669c7ae13eb7bf4dea9f70c15578b23a9218496", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125656, "uuid": "d9a2a583-1d4d-4639-803d-5a8bb9e1b6e5", "value": "T105152306E7E86073E47617B128FB02931B32FCD0C574C2AA2B46991919F36D4BD3676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125656, "uuid": "5eb7473e-af1b-4981-a8d7-1a94c29d3add", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125656, "uuid": "85c10653-6c40-4415-a5a7-a7229ea829d8", "value": "24576:Cylb3zjJXl1i83938MTZu2jxkwwEXS3zLOIWXZ:plbDjz39MeKwwEXwzLzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125656, "uuid": "a677b8f0-d4fb-4469-b85b-5265d37f01c3", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125656, "uuid": "fdb64781-054c-45fc-b5ad-8ee02335d474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125656, "uuid": "8ddcd3a1-905c-4c44-8c3d-3c00329fcd68", "value": "0406369726d158f8dd15f1fef42daa97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca87a2ca-4498-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693113351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113351, "uuid": "a73f099d-6a79-4435-a21e-e964c7378973", "comment": "Malware payload (Amadey)", "value": "94d87148f9ccf212ed63cb7a655ed1a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113351, "uuid": "4d98b1be-ba65-4e23-8ff4-13a4de0e018f", "comment": "Malware payload (Amadey)", "value": "ef1f88dd4b0035bc9540ac0b1e3668e246ae745446e3670e4f38d606881cc72f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113351, "uuid": "9e510384-ed1f-4564-ae27-f333465be906", "comment": "Malware payload (Amadey)", "value": "7acd31213d4adfad9340d6b74e31520ef8b24b2e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693113351, "uuid": "f1fe0936-e5f6-459c-9ca4-e19ccb3557ec", "comment": "Malware payload (Amadey)", "value": "2fbdddc31f1c859225ab28aece2450c7a00205fa93340ecee8ac6ca067fdddf0f55161a715bef7a64fa33de32501c614", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113351, "uuid": "657ba5e6-0c0d-48fa-b299-a7bea6ee79e3", "value": "T1D5052393ABD8C0B6D9B41F7048FB53870A31BC519874437BAB06985A0C73694BE71B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113351, "uuid": "6b6aea52-583a-4665-989e-74628300b12c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113351, "uuid": "9b7998cb-f780-4fac-8678-d09d2756536f", "value": "24576:5ylHPU+nYcKYPKG8GZFJu9etolOj4PSGm:sl8wYB4KGJjcAoAj4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693113351, "uuid": "5ecbdf8f-605e-45ce-a824-57be9f6cf347", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693113351, "uuid": "81c01179-7d8c-4c2e-a6c0-479ea1f6a81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693113351, "uuid": "37b13d3d-d4d0-44a5-9e9a-b1be581e1e2c", "value": "94d87148f9ccf212ed63cb7a655ed1a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246aeef7-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110066, "uuid": "2b864267-dd25-4e3e-bc4f-4b191020b54c", "comment": "Malware payload (Amadey)", "value": "8cd65da91936918bda83c4118432ed31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110066, "uuid": "3c60e26b-9730-45bd-9dcf-646f9cd22bf2", "comment": "Malware payload (Amadey)", "value": "f1304ac59c31cc15ccedcb57a14ee7e98c09b424f2473845031a2da55f64a7c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110066, "uuid": "35745d51-386e-4551-b8fc-5760f0c5ee97", "comment": "Malware payload (Amadey)", "value": "10298e7d87a362adab96eaae35105555ff177e70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110066, "uuid": "643aac39-2039-4f3c-8e0d-27940ff20d7b", "comment": "Malware payload (Amadey)", "value": "bfc0859fad0c8daf071e5fcfe6f028e6813c419ee6ce6f888d777bfd1df34f5c536becfa641e9870c5e7aa87fa3c0167", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110066, "uuid": "ee0fe789-d84e-4cf3-a1d6-39ba5f50edc7", "value": "T1A2652345FFDA8473DEA12B305CF6179313357F901C7807967A5AE92A1872BA8A0353B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110066, "uuid": "b3e6cefe-0113-413d-94f8-65ce3d5e4d21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110066, "uuid": "672fdec7-f32d-4720-b7aa-fdc723318435", "value": "24576:5y2T7DxHiwbK1BYTpOuVfFPKe9d8Sk9MPgYtzG4llmWTAFuIb4:sM7dHbbK1BYTx1VKe9p+MIYtXzbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110066, "uuid": "0fe8d735-87b2-47d8-b83d-da4234d03ebf", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110066, "uuid": "1dabf966-ccf6-4799-a2f0-e0f14577d940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110066, "uuid": "f66955a1-5af0-4613-b4b9-0a5cd9f5bd1c", "value": "f1304ac59c31cc15ccedcb57a14ee7e98c09b424f2473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1e9e2e-4514-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693166640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166640, "uuid": "59d68a5b-b603-4d94-9e5f-24cb37836bb0", "comment": "Malware payload", "value": "c62ce8c67fd75aebebca0503ba564165", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166640, "uuid": "7ee7a715-51c5-4736-85c0-a0e59c63c18e", "comment": "Malware payload", "value": "f257f9be19c4b18f0581d36056a4b0e8032586b60aae3115c78b81a5758a8768", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166640, "uuid": "b1257f43-9b9b-42b7-9085-60ba712b325d", "comment": "Malware payload", "value": "707097635bfb51e7d9f6366639b8c42c0074ea88", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693166640, "uuid": "ba711042-a9c6-476a-95b6-6787e396c0c0", "comment": "Malware payload", "value": "e87e6fc35dffe3bded6a38906ccfab1f5e54a870fc750754ea0dc57f4be7d313e1b5f388b60f03ad6aefbead8b77786d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166640, "uuid": "f95be887-5b03-4188-9842-4986fe2bd69d", "value": "T10F851203F236A917C832C0323555163961570D19D982FB8A394D7BBA2FFBEE84F845E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166640, "uuid": "422c5f48-19a6-4e16-baed-d41ab1b94430", "value": "49152:Js/0kkp7XQoEYbwLVrgCU4u+SrV47qii6rwkaW:G0kkpXdQVrG4u+SqxRkkaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693166640, "uuid": "f7ba9499-3396-43c6-a916-835fe87992c2", "value": 1813881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693166640, "uuid": "98685b5a-e21a-4090-91a3-05483785c71f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693166640, "uuid": "47673c9b-ee19-44fa-a747-681049ddfe18", "value": "eapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcaaa19-4491-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693110347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110347, "uuid": "1022aeae-061f-4749-851e-57faaf088402", "comment": "Malware payload (Amadey)", "value": "d35f6d3307a162f05fef96b6eb17886f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110347, "uuid": "c4ff9672-1785-48c5-87c0-63d8b186ce14", "comment": "Malware payload (Amadey)", "value": "f3506d56b8c342ef31c2e886c66794b6dd952a6fa632e86e4d0fc1f10cc21e06", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110347, "uuid": "0f87d574-c0c1-45ce-aaf6-cb08cfaf7643", "comment": "Malware payload (Amadey)", "value": "14cf65e68269b5a8166a9ce4a62d372d853e2c1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693110347, "uuid": "d0e14f9e-6b58-4a28-9dcf-ed0b724c949b", "comment": "Malware payload (Amadey)", "value": "c79b1b1ff831059494fcd51a9871d6f2080dcf7e176af1b4e7a7d0ad18d131e7f3d7684765c827104add43f3cd6d2c3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110347, "uuid": "0c1e6e52-e081-4c11-a189-4ed624a2d84d", "value": "T172652302B3C894E3EEB14BB014FF47C31E72F5518C784ABA62C5589A5CB39E0A975727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110347, "uuid": "8b6710b4-de15-4435-999a-a3022146d7ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110347, "uuid": "49aec818-5325-40b6-9c43-e36f2126ba11", "value": "24576:ayDbZuMB3Y1fy6Kbm6h72LKHlwqn1aBsYGs3UHYjPjoUv8dQDZHLYV/OM7sEwV:hDb8LfGm6h6LKHlwU1aB9Gs3nMUkdQFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693110347, "uuid": "fc20fe09-6fc7-4279-89c9-3b1dcd043c01", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693110347, "uuid": "bf312c1c-36b5-4d90-98d9-4282f48102a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693110347, "uuid": "f035aa9e-8096-4c79-ae5c-1b5bd5306395", "value": "f3506d56b8c342ef31c2e886c66794b6dd952a6fa632e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36324b40-44fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693156911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156911, "uuid": "c55c6585-5f4b-464a-969d-c7dd5f593f9a", "comment": "Malware payload (RecordBreaker)", "value": "1768e3196e0eb7fa5b240ea0e8aaa822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156911, "uuid": "ab50bab4-9343-45ac-be01-652174700fd9", "comment": "Malware payload (RecordBreaker)", "value": "f372e681eb31936a35e710aff9e56f7034b105dd71a9c575e7c3080a2e17065e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156911, "uuid": "5942a197-cd69-4182-b37c-5fc6a54d6180", "comment": "Malware payload (RecordBreaker)", "value": "4e3bfccba2d4a94a111d477ce33b1ca0b333a416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156911, "uuid": "76266bb0-1816-4354-bff4-80f09cc25f1a", "comment": "Malware payload (RecordBreaker)", "value": "ad611377e8ecdbf9cdbcfedcf9c84c84929496b588e9410e6abaf673bd8fb639173226de11ffaf97f5d4249dc9162061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156911, "uuid": "b4a3d4ff-739c-4fb9-8c84-80e2e7e3f465", "value": "T1C9545B1362E17861F6334A338E6AC6E8E61FF851FF557AEB12589A2F09711F1C672301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156911, "uuid": "dcfc1c4e-c7c7-4f24-99c1-f4a3da8e938f", "value": "497066eb74b90edfec949c6dfd6acab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156911, "uuid": "d7dd2b40-6f5b-4e59-ada0-9fc090bac00c", "value": "3072:69iDGfnieS+V6cp2SiDRSHuUs2FgJn/9oR5lGqi6/2MVaRlT:+Lfie0cQSESHv1A/9o7lo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693156911, "uuid": "6c838936-4a3e-4e72-b869-831cecccc03a", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693156911, "uuid": "24d7a266-4c48-47c9-aaaf-45c760c958ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156911, "uuid": "40e1a06f-31d8-40bb-86ca-09e8b000a573", "value": "1768e3196e0eb7fa5b240ea0e8aaa822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b63d44-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1693125992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125992, "uuid": "40a2029c-fd10-4004-959a-f5111c041861", "comment": "Malware payload (SystemBC)", "value": "6a43144739156b1edb6fb29a53b97aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125992, "uuid": "c2e394f2-b400-4b83-ab5c-923b05c1ce93", "comment": "Malware payload (SystemBC)", "value": "f3f5ae787b645769869ad60164bce86dcbd609d3b8ce8585e1b9e8a27b3a76bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125992, "uuid": "24bc03f0-13dd-4881-a3e0-195636f60184", "comment": "Malware payload (SystemBC)", "value": "1fac7481ed34707184926b4c49aff050a154cc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125992, "uuid": "cbf30ffb-9775-4273-bc0d-53b02c13d04e", "comment": "Malware payload (SystemBC)", "value": "29893b481cba074e82aeb2200bd5cc677969c41accb0e1b22fa8a09c0c097652a346a31c192d0af2cb3fca56dea15d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125992, "uuid": "0732f69c-b6dc-4cfe-8703-d8f0122447e5", "value": "T14D850252EE36C9A3C81F047A74B38FAA6DBC60D52BB717A3255E424CF2518C8CD7E254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125992, "uuid": "e32e4e63-5f1b-4e44-b6fd-ff697b811ce6", "value": "1b7388d593285d5b049b57d84dc41b81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125992, "uuid": "207a0461-8de9-4e09-97d6-fc2a00552554", "value": "24576:02eJ419CoCAjP9+MRUOj7AilkD3alSlpawSntZORol9POBLwbKcqc5RV7Xcog3Vj:2YdPgecilkD7ywSnWRovIiJPMVNPGmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125992, "uuid": "51afc221-c357-4daf-a7bd-faaa281780d3", "value": 1803992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125992, "uuid": "7f2352ce-fd03-4dd5-9b7c-25dd15894348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125992, "uuid": "4f8e3529-2a33-4fa8-8928-51eff69f0c26", "value": "wevtutil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a81d2d-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693148208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148208, "uuid": "7bcccb64-14f1-4b9f-a342-7eb7a2258d62", "comment": "Malware payload (Amadey)", "value": "5aeeef5d34a070976a1b86ff9dcecd45", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148208, "uuid": "900bd9df-7035-4546-916a-05f79ce4cfc6", "comment": "Malware payload (Amadey)", "value": "f426423b3a2d80abf74d7dbe7794f1df2f45299248d77f136bfc497a4a552962", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148208, "uuid": "fa1735ab-6c3e-45cf-a0dc-eb9b98bacc68", "comment": "Malware payload (Amadey)", "value": "fa069c70ba4e4cd49b225177c4f5a0327b922c03", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693148208, "uuid": "4e7dbc12-7b82-4cad-9243-baddbc59e374", "comment": "Malware payload (Amadey)", "value": "f6f5ef2ebf1b52aefe3c007e4b95174ae1215adfb9ed7f5bdb18611b7a58e0883b787a6989e454336aac09dc93cd9a22", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148208, "uuid": "62c25a39-a0fd-42c9-af9a-72199b760c1e", "value": "T1C5B41243B6E89473D8F513B118FB07831F31BCA1AA74866B3785AD590DB3594A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148208, "uuid": "6e985396-d1ce-427f-8534-197caef97dd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148208, "uuid": "2086277f-863f-4bee-9c08-73b12c366fbd", "value": "12288:xMrRy90SRyW1jVJrk6vejC5hh0VY6lzR6vHX0k1Ogj:QyryWm6qKlvH9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693148208, "uuid": "cc8d6768-3b55-40fd-9edb-baa90871e06b", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693148208, "uuid": "85c85e35-ebf6-40b7-8253-b174aee831c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693148208, "uuid": "341bed95-9d93-4cfc-9f10-26063de737d2", "value": "f426423b3a2d80abf74d7dbe7794f1df2f45299248d77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7b7e58-44ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693149380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149380, "uuid": "238b6138-83c8-4f4f-8e4f-e10b1acc8481", "comment": "Malware payload", "value": "e301f0d281dd1f4f843f884df31c54ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149380, "uuid": "47936c9a-5cc6-4bba-aa46-5dbf723ea567", "comment": "Malware payload", "value": "f55bf6ecc5093842b0c10e15a033b3dfa817161e9c6945fb9de39ed89d29531a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149380, "uuid": "9c93bf5d-0157-4be8-9cb8-bcbcf61ebe2e", "comment": "Malware payload", "value": "f71bfeff5c1c2984bd8eccf7fa7ea59ce68ab3cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693149380, "uuid": "7839fc38-9382-4ea6-8b0d-bc0367586b03", "comment": "Malware payload", "value": "cc4f7b699d1628b6559ec2ea1b0f1277e8efa090d8d303f4148fc2f1d01dabd1469c41a673fd1a1535d94d72f67012ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149380, "uuid": "7a89d502-211a-447b-9c15-613f7e556da6", "value": "T155C3962A7E12BFFEE168863107F35F70839521A236A19386F26CDB585E7128D1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149380, "uuid": "1c0e477c-37af-4699-a0d9-d94def22a826", "value": "1536:W7jO1TP6jquDXASiSjuR2rK5ZuN4HrzPe3mreBzJ7JJLhJUmkigFxfC7cgnQ:RR6N4HrzZoN7JJLhJUmkigFxfKcgnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693149380, "uuid": "f84ad575-1eaa-4cb8-8019-8ac2301173ea", "value": 121854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693149380, "uuid": "7bd935f7-5832-4e21-8c18-9be56e97f43b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693149380, "uuid": "889fa713-f5b3-4bdb-a78b-7d76df959901", "value": "e301f0d281dd1f4f843f884df31c54ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60cb01fe-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103725, "uuid": "c081bdce-391d-416b-b110-9604be4693b6", "comment": "Malware payload (Amadey)", "value": "b36e94861ca5c75a92573f94b2be41c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103725, "uuid": "de9bb874-04fe-469c-af91-9dfee0bc327f", "comment": "Malware payload (Amadey)", "value": "f64aab996d106f87fb99df98f31a63f7598681ba1bb13e46868ae3238802650c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103725, "uuid": "0aa4a575-08aa-4d12-9f9c-f37f6ae5caeb", "comment": "Malware payload (Amadey)", "value": "c41c4ab4f136cd675b48f6d6b311f92551e96335", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103725, "uuid": "4a4bd4ae-16d9-4412-b79c-3e03f4b9a77d", "comment": "Malware payload (Amadey)", "value": "f388debdea3a2086ec8a7edeefd4b4ba2d0df2cf7f743fb3159146550f8801ba21a5f92030da08cc9385cbd31f7586b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103725, "uuid": "a1be2cdf-3bff-43b4-b3bc-fffe24f5d6fd", "value": "T108652347DAD944B3EEB2277079FB1B830A3DB8715CB8C769218668430D77B94943236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103725, "uuid": "4ee43618-c05c-462c-8ef9-117c48e9f00a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103725, "uuid": "85f0caed-c848-4cb3-bc29-1e60aa9e01fb", "value": "24576:yyG/s76svLtk+xHqUG7XvKbTmKnY52aYcu4FT6UwMXSugaWGHZD+tz5ZBLD/:ZJOsDLxKUGjvKbTmKnY5LT1FT6RMppWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103725, "uuid": "dcbdf16f-9d12-424f-b29f-ab8bb42226a0", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103725, "uuid": "6c7280e6-07cf-407e-bff7-7421d0bdd6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103725, "uuid": "a2ebd306-12cb-4f35-9b1e-2db995ca2616", "value": "f64aab996d106f87fb99df98f31a63f7598681ba1bb13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a9cb3a-44f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693152005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152005, "uuid": "762f2034-29db-4c6e-a710-da6dffcc090c", "comment": "Malware payload (Mirai)", "value": "e40ae33d585d1a2d7eae0e95d317e980", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152005, "uuid": "43bf6928-06fc-4bdc-913c-d61457fcf180", "comment": "Malware payload (Mirai)", "value": "f69256157b89ab273ba9cd930388ba9f3df38fdfaa372ae261f27517386ec39d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152005, "uuid": "aa1ce115-065c-4728-b785-18146b36b0a6", "comment": "Malware payload (Mirai)", "value": "d25164e99d45450ba381b29d2fdc667b346171bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693152005, "uuid": "85f30691-86b5-4fe6-a8b0-13d987189cda", "comment": "Malware payload (Mirai)", "value": "5296f1a1430d132af6049ec5e5da809042027e4edf79412526133f230a962cece12433159384f1a53300943c413d3fce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152005, "uuid": "f090f6cb-45b9-4d93-b205-b944002d53e1", "value": "T14FA2D015BF1C86CBC832697555E9F6D21252FC62F2ACCC192940C15FB4A33E96834F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152005, "uuid": "e6055289-6114-457c-be50-4c6a93be06ee", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKM:598o08kxofBE+ZkXaqGbp2F2TWul0c5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693152005, "uuid": "ef9a52c8-ba5e-4ddc-b2e1-1d8827aa2600", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693152005, "uuid": "115cabb9-e00d-4494-bde5-4f1649ad9be2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693152005, "uuid": "1aebe3c3-a4b3-4236-9bf0-d5305544ddc7", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9574065-44d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693138287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138287, "uuid": "e2aa364d-af07-4c46-9c96-eb53a0f42ddc", "comment": "Malware payload (RedLineStealer)", "value": "cfd71c05df43464b4aadef6ebe06aba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138287, "uuid": "71478848-0803-4a15-bf0e-f78389d0669c", "comment": "Malware payload (RedLineStealer)", "value": "f7306185c8d0320b4e8d01bfc83c485d8a755359b7f1363f35a98397de9d0dbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138287, "uuid": "245e1439-8441-4da7-b42c-42b62d0cd5dd", "comment": "Malware payload (RedLineStealer)", "value": "6653497aa9dac5b1b524ce10bdae3cb4ee85bc43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693138287, "uuid": "ecba89ce-f121-40bb-ab83-b547d654d7f6", "comment": "Malware payload (RedLineStealer)", "value": "61bd2a425ba4e62820b7590c017506366f0fa131ffb30565c106d0654398027c2091f1e0d9eff1d7dce299210dc608d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138287, "uuid": "7d445482-550a-4188-b409-d133f01e920b", "value": "T14815231397E45432E9B56B7158F312830B367CB1C879832B4749A95B0CB3A88B572B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138287, "uuid": "4df75ea2-8b56-4a43-816c-c8f5bbb66d47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138287, "uuid": "3f6f3191-2d4c-4c90-ab19-22964cbcbc1a", "value": "24576:hyXYGn2ibBMQ+1HhslpIY/x9S0T3x749biGQ7c:UXYtitMtapI9w3BmiGQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693138287, "uuid": "0d251c61-8cfd-47d1-915e-444035eb4106", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693138287, "uuid": "db861286-10ca-4ecc-bd8f-e41008436107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693138287, "uuid": "f26bce1c-dade-42f6-96d1-0d9ead15d843", "value": "cfd71c05df43464b4aadef6ebe06aba5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82283eff-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126115, "uuid": "2140a9cf-2425-46e4-9780-9166b9c52ac8", "comment": "Malware payload", "value": "34b89e5857a4a2313b19e9d50977b7ed", "object_relation": "md5", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126115, "uuid": "56cd838c-2b8e-4a0a-b77e-47d4aabea5d2", "comment": "Malware payload", "value": "f77eda82e8f6f317acfed55d0c96aa4bf30297606f4a4b018dcd830e155fae0a", "object_relation": "sha256", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126115, "uuid": "d3036b54-c2c7-46f2-8623-3de89fa7d303", "comment": "Malware payload", "value": "0486d8cd5f4de55a065a2d55850aa43aee990cab", "object_relation": "sha1", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126115, "uuid": "17a5cee1-e9b5-4444-bde3-b9f31ee337ff", "comment": "Malware payload", "value": "985376f05291ad9bebaf1e41699b83e8c829141a2546cadc34436ded2e0f2ea9e5fe8899cfa58bb480d42eba2cd6bb7d", "object_relation": "sha3-384", "Tag": [ { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126115, "uuid": "c18f97e6-c367-4f2b-84fb-3bd743ad25a8", "value": "T1E5A1C6033FD3D2B7FE989670C671590DBBA4D6F1B3ACC7E7358881292E8612179124D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126115, "uuid": "2bfaa618-5688-4476-a9f8-e0316b1787ca", "value": "96:kz5y/benREOqka2lGOW4c+ZnVtfEA7yyyyyGPnlf:Gk4EOqka2IOPHesPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126115, "uuid": "f1be53cb-9c5a-4bfc-941a-ad77b0b13449", "value": 4973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126115, "uuid": "929053c7-7ea4-4e64-87f4-3e6be7759ac9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126115, "uuid": "88eaf6fd-d43e-4032-88bc-058756410d1a", "value": "output__main__.pyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b5c0e4-4475-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693098017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098017, "uuid": "40124eab-d17e-4144-ae51-14c03610d326", "comment": "Malware payload (Amadey)", "value": "2fe6264ed56d0fad75e2f0d7a4fd95b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098017, "uuid": "8af6e311-8142-4855-9c31-9847d1796d86", "comment": "Malware payload (Amadey)", "value": "f7d09ced444c3edcf671d2b23fa8318e666ca22e44d0af7a8d121271a83a5319", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098017, "uuid": "a9948c6c-7274-4aa4-a88a-b8d4e3ee0867", "comment": "Malware payload (Amadey)", "value": "fe19b235265c97c674b10866d0659bd231b93023", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693098017, "uuid": "46ea1ebe-2372-4a9b-a909-1e48bc243432", "comment": "Malware payload (Amadey)", "value": "c30846624240bf35573b3fb92f66da510b7e59b5e4798e7eb511f1690a925cb69a34cddaf3f5e7ec97252fbb4aa3530e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098017, "uuid": "347d68e6-0af9-4586-90b5-8a23bfd91cfc", "value": "T1E723F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098017, "uuid": "452ffb4d-285e-4a83-8120-4661f043590b", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693098017, "uuid": "1a5da189-7d54-49cf-b772-fe9086cc272a", "value": 48463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693098017, "uuid": "b2df29c1-a889-418c-b8f5-b594078d962d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693098017, "uuid": "48a3bb1f-0383-44fa-b713-52f39cd2c3c8", "value": "2fe6264ed56d0fad75e2f0d7a4fd95b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f81ad2-44fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693156000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156000, "uuid": "9e017219-58a1-4ae9-b643-2c985744c727", "comment": "Malware payload (Amadey)", "value": "44fff638c205579f0e4240f434062254", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156000, "uuid": "8fa03b81-6cfc-404a-ba53-c98476b13606", "comment": "Malware payload (Amadey)", "value": "f8843f410363e39e28b249f6745b446f50ebd4cbdaeb7357d2104ac5961a7cd1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156000, "uuid": "815a332e-18a7-4fd5-adcc-9866303d5dc0", "comment": "Malware payload (Amadey)", "value": "4473e744522b65125c97c03b7ee3ed6490f7b86f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693156000, "uuid": "263315a2-00f9-487c-b189-fc42a3020734", "comment": "Malware payload (Amadey)", "value": "81140a22b0930cc0c520e457a9c10a97880f36168a9dcf2513a3dcbbc1c215c9633122f91366c79212333069e6fee39c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156000, "uuid": "e1e8c578-4ae4-49d2-9971-5a12fe189e85", "value": "T124052312E2D880A5DDF5277074F21BC30E36BC605A7881BB3B45A89B1CB3995E07677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156000, "uuid": "9d00f906-e540-4fa9-96ec-e94ef2beb653", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156000, "uuid": "e8ad20a9-0088-4fba-a1a0-d6cfa2d072c6", "value": "12288:zMrYy90V+cw3vq3Q6CRi7U7woE/+QKDUbEp8JR6cikvOz30eI3fSV:vyUavdNRuUSFYteJR6FtkeIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693156000, "uuid": "cd07fa05-5579-432b-b640-74c8ee8084a3", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693156000, "uuid": "aeba04b4-69ed-4062-9845-75bebcb3199b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693156000, "uuid": "45efbbeb-cdb8-42a8-86b4-e951c3ee16a5", "value": "44fff638c205579f0e4240f434062254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0301f2a4-44e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693147806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147806, "uuid": "6e2c8b83-ad6b-4fb0-ad5b-072bacfcfc9e", "comment": "Malware payload (Mirai)", "value": "aa523d1c5742afbed69f182c9dfd91f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147806, "uuid": "37c60dda-b6e3-4214-afa7-358380e16d82", "comment": "Malware payload (Mirai)", "value": "f8b2478e592919652d07fff755bdbb1f16782fc8ec4baac3d7dfc3c04760ab62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147806, "uuid": "ab32d194-669a-4921-8c01-6cac026fcca0", "comment": "Malware payload (Mirai)", "value": "c5a3c5ca0ca22f84ac3a691dc7345435d358f0b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693147806, "uuid": "297d3c2e-c24f-4859-80ed-cdd212da53dc", "comment": "Malware payload (Mirai)", "value": "0e1eea80f686ad5c97f2fb6f931517e8a70479b9e320cc61e382203513a64ecd6d890a6244228b723b9467917e0d4e05", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147806, "uuid": "b8390524-0c7f-480a-8733-17aa2aa04eed", "value": "T1DFC2E0659228D472B1B44836FDBF05039736CFF8C6EF352622244734A097D2696B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147806, "uuid": "66855112-7312-47f5-bcf5-bce4a3c91ffb", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plNaJrhymdGq:byNUQUfhQllxlaH0MFjlOnGsws3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693147806, "uuid": "d53415fb-033f-470e-8806-6b3fcb3e7c03", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693147806, "uuid": "3fde017d-ca1b-4d6a-96be-0a7167fcf542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693147806, "uuid": "116138b8-8f23-4eda-b2af-c492a06e5f1a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb1ee0d-4534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693180308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180308, "uuid": "467698c2-e12f-46a9-be3e-79ec6ee31bcb", "comment": "Malware payload (RedLineStealer)", "value": "28bebfb065b8938103b10e999ef70e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180308, "uuid": "f82f6077-cb21-48e1-97e7-e43204d7f811", "comment": "Malware payload (RedLineStealer)", "value": "f96295a2fcb84ab1aa3cbe992ec8f8b5da76d580def05eed5f3e28d4e83b673e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180308, "uuid": "95ca44f6-32e0-43db-9c70-b719445098cc", "comment": "Malware payload (RedLineStealer)", "value": "9c9585bc5d3db0ee0789821fb5c52418b151f416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180308, "uuid": "a151d072-0966-494d-af46-e359b8652bb8", "comment": "Malware payload (RedLineStealer)", "value": "5e27d20fd78dc9e76783d935ae66b80767edd1ec11621225dc055c8f2c2a52f4e551984b28b6ebc268ff3a877da84987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180308, "uuid": "9897d22b-6da3-4726-a6c7-14b2be6b4412", "value": "T116E41256F7E84033E4B52BB054F317C70B3A7DA1CD34A39E1395A9581CB26E4A57232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180308, "uuid": "850a0880-009d-498b-8a8b-aa5605347105", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180308, "uuid": "256bcd9b-80e3-4f7a-ba12-9a298c456cd8", "value": "12288:EMrAy90fGeVyn5VAXcheheJ7s8S9t/cEaP1cDQcXVdqx/d5UcHPzw58FaILdV6hz:sy1NnDAGe0J7XS9t/kaDNXVc/HpvzIIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693180308, "uuid": "389140f2-d534-4f97-b57e-b69a4c3f5c76", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693180308, "uuid": "40fc760a-d59e-4cfd-9af7-32069e6a9eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180308, "uuid": "18b77e12-751e-47c6-97a1-704865c5651b", "value": "f96295a2fcb84ab1aa3cbe992ec8f8b5da76d580def05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9181a7-451b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693169458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169458, "uuid": "3f539071-d19b-4abb-a920-c70cf229d024", "comment": "Malware payload (Mirai)", "value": "e1797596b36357d8aef1990048008600", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169458, "uuid": "7686ae21-91ba-4031-919b-c32a14a41a23", "comment": "Malware payload (Mirai)", "value": "fa030cbd9f0948c88404b23d95e9c6eb0f1ea4c6d464088902604aae8eebaa44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169458, "uuid": "01b6d0b0-8820-4e27-8bb5-984a52081637", "comment": "Malware payload (Mirai)", "value": "7b9dbef9c66623caeddb158eccb417f8aa0f0fd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693169458, "uuid": "315d0617-8ec2-4bb2-be73-833d51f3c9b5", "comment": "Malware payload (Mirai)", "value": "d22fffae0b47ced3a5cab0625caeebc812cc40bde992fac48bb8743755c839b618410b681659dadc1e1ede09749d43da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169458, "uuid": "997f8183-5f93-4374-a651-97bb15030721", "value": "T10CC2E094F041CE05DFFA29F53E40CADBBBE12F1EA9618E8166A053C16A5D2B38305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169458, "uuid": "1ab6b287-55db-47bd-9a2d-a699148dca74", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7Pt34uVcqgw09C:tam+AnKehPRa9a54u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693169458, "uuid": "348a4869-2b39-40d3-9123-f87543dcbe3d", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693169458, "uuid": "0e93f1c3-674b-4995-9b8c-b714e61c9eea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693169458, "uuid": "4dd638a5-8450-42fe-ad27-4675e5622833", "value": "e1797596b36357d8aef1990048008600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18ba86f-44c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693134382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134382, "uuid": "73ccdfed-5618-4c1e-aeae-bf83d1fb2b38", "comment": "Malware payload (Amadey)", "value": "09319dc24bd5403c42d4e57580dea0a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134382, "uuid": "65487bb0-1573-4650-a32d-c282d6e87f8d", "comment": "Malware payload (Amadey)", "value": "face8ab2ae67f2803b1af284b133139f8592c788db7bd9ada106cdf2ddc1ed5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134382, "uuid": "d1fda2b0-8f8b-4aaf-b62c-41f78982907b", "comment": "Malware payload (Amadey)", "value": "435b976942cb8479b0720575a0a51f4111ba8ede", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693134382, "uuid": "0ce00c86-97dd-43b0-9d0e-bfbc6aca8473", "comment": "Malware payload (Amadey)", "value": "1d60633408a0826cd2fcacfcd9a3e219175608b4e569a47da008073ac0b7709ef88ad76a50bab7e2759dfae5e89afdb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134382, "uuid": "820288e0-0578-461e-9175-c26593b4d868", "value": "T1AAE41253B7CD9423D9B617B42CFB02D30B32BC628D78475B1781AD5A0CB29A5A531B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134382, "uuid": "56f5afb7-fcb7-4a85-ab1f-9f86c48b0fee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134382, "uuid": "8e8987df-5324-43eb-9cb3-e811dfc66778", "value": "12288:lMrny90gIMDpTe0Aj4sW31RMNUQBapLJLzVD+3+oix00J:yyFbAM+LkpJH0+ocT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693134382, "uuid": "56f57ba2-9c16-4194-92c9-e38e2544d0fe", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693134382, "uuid": "79a75e98-4f1a-4392-8bac-09c91a21c83b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693134382, "uuid": "a312e873-9d3f-4072-a1b5-6813929ba14b", "value": "face8ab2ae67f2803b1af284b133139f8592c788db7bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49f5e74-44b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126656, "uuid": "ab58a11d-b78e-47a9-ae9e-2578596e1615", "comment": "Malware payload", "value": "6cbfbbc715b8c41ab8c18dddf50e905a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126656, "uuid": "2a0d4f34-7e5d-472c-84fc-d41c4322ce3d", "comment": "Malware payload", "value": "fb1476ddb95be9b979a8e209556b71755b3a941cb34050511e0e0ba7ee14a7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126656, "uuid": "6f325156-96b2-4a3c-8c7c-6e903dfe3d00", "comment": "Malware payload", "value": "a3ce6350ef4e9f13b3fdbccc8194e34fd17010f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126656, "uuid": "50a3e8b5-62bc-46cf-a049-0145f8353ae7", "comment": "Malware payload", "value": "581da3804baa71e7e97233e96c462a4785d4d095d03590cb40b9f9d2920dfa987a41fc7db3beaed7902fad5d065835d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126656, "uuid": "61e55ca5-fec4-447b-a5ba-800e575ce4d6", "value": "T1A545940BFBE611D1F5BAC139A552322AFC7234A1473897C792459A4E5B30FE8AD3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126656, "uuid": "96fadc51-6b03-40ed-ac8f-2347be6906d8", "value": "d63a56cd5a82ba3774a796d6b01fed33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126656, "uuid": "008a29c3-b680-48f0-9f5c-d68d65913a66", "value": "12288:46e8iTntZtMoYH0XymFQXR8hY0iXhRtFrVc/XFgqI:y8iTntZSdH0imFQChYNtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126656, "uuid": "ad9e99fe-be33-4b1e-abc6-31d462b6bd54", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126656, "uuid": "93a9edde-10e1-4f9c-bbd4-75ced9222689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126656, "uuid": "3827c095-6962-4fc4-8dfc-eff854477cad", "value": "buildPostman.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ccc4c7-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693130168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130168, "uuid": "14bc0b47-6318-49a7-9d19-9cc5d1484927", "comment": "Malware payload (Amadey)", "value": "6f4ceec2e1d7e87dfda3c4bde72b867e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130168, "uuid": "39c24a52-e67d-4730-a265-29582467917a", "comment": "Malware payload (Amadey)", "value": "fbf8eaa5dad65e0a820d544cdddb3dccf992c52cf3d692b381b69243ecf8775a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130168, "uuid": "db946f95-fc2d-487d-9980-c5141da8a0a0", "comment": "Malware payload (Amadey)", "value": "a6f663d07c2683a0ec15cece3d1a8f90236728c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130168, "uuid": "6d5d8468-0c86-4ab6-aa16-d6b9c27ef809", "comment": "Malware payload (Amadey)", "value": "4a2146f9cd1c029f37a694b86ea749ac186423f46ce11fc6919773250460ee112cd96587aacc99996a9d4a0660562201", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130168, "uuid": "b0e5fd63-d670-4491-8c80-dfa747431696", "value": "T1CA652357A2E944A3D8F61B7019FA13C72B39BD640C28C75B330798AD5DA31D88573B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130168, "uuid": "0a41b3f1-5e2f-4563-a0e3-d04429eb6851", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130168, "uuid": "09273abd-b24c-4786-90e7-2a7a295e64d6", "value": "24576:oynUy1qQE9lfrG3CcKaCq6x4F11fdk+s8Jay4qxIkQ4ca745h5QIlb+:vrTE9doTKaCq6ODZsxl4B74Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130168, "uuid": "bd02c956-160e-42c6-9375-0043b3832546", "value": 1500672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130168, "uuid": "0936c6d6-6685-4815-8f77-a3b937e25f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130168, "uuid": "7f4b88cd-24e0-4edb-a54a-f8e24b77359a", "value": "fbf8eaa5dad65e0a820d544cdddb3dccf992c52cf3d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7dd02dd-450e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693164108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164108, "uuid": "09b6b3b0-2fd5-4789-8d80-88608a8d9d1f", "comment": "Malware payload (DCRat)", "value": "2b7f820ad4b5f7518071bd730ac2e655", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164108, "uuid": "5ccb16fd-7dfb-4085-a48a-e4d31ae5f8f9", "comment": "Malware payload (DCRat)", "value": "fc402b8bbe328bc15da197b4f57b67d6fb74530553eb7f6fb2d1aa3d1af64fb6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164108, "uuid": "894f5bf9-d5cd-4092-bd3c-ece97e704de7", "comment": "Malware payload (DCRat)", "value": "8ff9a5b37c8d8482666707b3f555e071b8298df2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693164108, "uuid": "1071ac02-927a-40be-996b-81725d207c4c", "comment": "Malware payload (DCRat)", "value": "47cbdee23b615f8ffad85d59106596baf063f462a361d11e5b171a0be44e7bca49557450ee0bee5280a1f93ca313c501", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164108, "uuid": "c210a934-7412-4819-a7a2-bcf0b22b7725", "value": "T184C5CF027E44CE11F0191273C2EF454887B4D8516BA6E32B7DBA776E59123A7BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164108, "uuid": "7ef0f9de-cf1d-406c-bc12-dccf82025552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164108, "uuid": "a7c9b46b-0569-45ca-b5d0-041f2889504c", "value": "24576:PFFok8gvLa+c8OFvHh6QaA3JnPN8NTx5cxWpQkQTd315EitgptuOkalH9MWTk8eo:dFzvo1Ta24dx5gWmxrEiC35dk0VjR61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693164108, "uuid": "b519909d-49f5-4744-8737-85269d081a43", "value": 2580480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693164108, "uuid": "5e378cd3-c451-4fb3-bd35-d5d34862611d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693164108, "uuid": "a799f3ae-5145-4dd1-94d0-20be6ec14f3f", "value": "2b7f820ad4b5f7518071bd730ac2e655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71897e29-44b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693125657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125657, "uuid": "72313c84-efd3-474d-b8ff-7d0b7f22693b", "comment": "Malware payload (RedLineStealer)", "value": "491c194dc201b458ba0eee755dc38194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125657, "uuid": "97954301-3a76-441d-8d17-ba2bb63c52f5", "comment": "Malware payload (RedLineStealer)", "value": "fc7472626bdaa92b539a22f97642f03225bbc54cfebdcc8ea75c5eae0112d3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125657, "uuid": "ec1c5d14-5450-471d-9bed-09c9d1f9e450", "comment": "Malware payload (RedLineStealer)", "value": "efcfbd0594516ddf1ddbf16a1c947ec008686a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693125657, "uuid": "d52c2a41-00a3-4505-bc20-c08acb748e30", "comment": "Malware payload (RedLineStealer)", "value": "b7ab4188fce0057db20c62a786b289a37b943539db5f647a26a8d50d15bc66383019a67bb6851de71e7cd77c26e80290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125657, "uuid": "9d2b07d7-faa4-452b-9f66-78c88b9a71aa", "value": "T1526523579ADE0033ECB65BF049F616870E39BC391C25572E2355E8670C6A9F4AA3133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125657, "uuid": "d5154707-af34-468c-9b3d-adc07a276123", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125657, "uuid": "913d5a31-29a0-48a0-864a-867e4fb72718", "value": "24576:CylcoFHjzzlqN5mE4l7+YKjCIdMUdsEhLuKapGki6o4r0pppx30U7BzCWxBVO6:pltn0F4liYKjCIPds0Wy39pHx37B+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693125657, "uuid": "0f1b570d-e8ef-40f7-bb08-d094aa6bf0c8", "value": 1504256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693125657, "uuid": "9dd711f6-7252-48df-83c2-fdaa1e1c795b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693125657, "uuid": "774194f9-cf61-47a0-9804-f47f0d119bf7", "value": "491c194dc201b458ba0eee755dc38194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7279fcf9-4534-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693180205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180205, "uuid": "8874b920-e9ab-44d0-ba31-f8949fdd128a", "comment": "Malware payload (Mirai)", "value": "193d2c8fc830b89d08c53ee0170845b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180205, "uuid": "f2cee474-7bfd-4fb1-8043-c11ebdb6f795", "comment": "Malware payload (Mirai)", "value": "fcd716aa491fbb0ca34de6700aeba0dcc3c79e90d9f4701d0537967738e88007", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180205, "uuid": "b0136c4d-0038-41d4-89c8-93ef11f42fce", "comment": "Malware payload (Mirai)", "value": "79870cf0d8fd7f447fd279a1d8eb8f3be9a199fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693180205, "uuid": "74cf2bb7-438b-4ca6-9ede-8581074cd4d4", "comment": "Malware payload (Mirai)", "value": "c275e4eb441b7a5668fc6b802b7db8d76e49cf2e27bfe8f9ddf750300f09b4884ed0b87fb97596a9c815df493a590d00", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180205, "uuid": "1849e4ee-d883-4bc2-8d1b-9d3ad2971b42", "value": "T1FBC2E0E53E77399BDE25013D38AD9E3742B5E052D79EAB13A240920820071BCBB719DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180205, "uuid": "94a372e5-2bd6-4445-8be7-10e758ffd0bf", "value": "384:Mn1DMwk8JPyG3GDZaEXVZVBy6HInRiWLRYh4Sw4cGJYeRzOFGBzd8QJ+NZlNy0Nv:CMwoDZLFbBy6HQHRYfeAxdd8/NQ0Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693180205, "uuid": "7e30a612-20d2-48d7-b682-9d7e28ad83d2", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693180205, "uuid": "c482f9ac-14de-4bb2-8b45-34f56fd91106", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693180205, "uuid": "a65b1600-98df-4ed6-a3ff-1a8ae813b79b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa73f8c-4482-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693103723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103723, "uuid": "a2d85385-1952-4ac3-9c92-514334729a57", "comment": "Malware payload (Amadey)", "value": "c4a10a7e2cf4a085356ee11a124ad9f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103723, "uuid": "cf6c1f88-4547-4a75-9571-4b7890a10a24", "comment": "Malware payload (Amadey)", "value": "fdd7679fe1646099a29b5a1684b0ff3782ae80e828473af7bcd83b4beb573bad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103723, "uuid": "753ead1e-1c25-4e38-aea1-7f30cda3545e", "comment": "Malware payload (Amadey)", "value": "eee81ba6a1988c3510a8f29b81cc1fbf6a3e2b23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693103723, "uuid": "0ccddceb-830f-4eed-a8e1-a0691ba54412", "comment": "Malware payload (Amadey)", "value": "10830c58ce7c1547f661c7c039d3f08d38e25ec4ff4ad099407b54ed3105a1a0d9d717f48e5dc94edd79b75ddc7b4d5a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103723, "uuid": "2410589a-f2e2-41ff-b12a-28d76a5cc301", "value": "T17B652342B7D88862EDB41B746DF527C72E397C920668839E3B96E44B0563BA1F534333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103723, "uuid": "ed04dd86-dd02-489c-a03c-6e6e58c1eba9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103723, "uuid": "eb3e4b3f-bd70-411b-93ab-f105a6084915", "value": "24576:3y1LB6XEdGR7oTKs8jI3hXVqO9EBeDeDz9YjnFOoDGcoRfVnr46qAG7dM9PhLDdt:CxdGR0TKs8jwLjEBWe3CT6HRNv+8vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693103723, "uuid": "212624c1-d3d2-4df6-ba2c-b990b7b0c879", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693103723, "uuid": "fddfcba6-07af-4bf6-9cca-77d599c72850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693103723, "uuid": "e8d4edd7-12d8-48b9-af5a-1020f4d099fe", "value": "c4a10a7e2cf4a085356ee11a124ad9f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3e5a14-451a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693168899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168899, "uuid": "b9682d92-5e3b-4cb0-938d-d7b0de30f699", "comment": "Malware payload (Amadey)", "value": "ea094fee358eb0ed2f1d6b2984b05bc3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168899, "uuid": "24994c49-e610-48fb-a4a9-c2afb249ff0a", "comment": "Malware payload (Amadey)", "value": "fde29e7641568bf59eeecd9c5ea544bd1ab873fd546a29820d024650c42f488a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168899, "uuid": "ebeaeff9-c151-4706-b2d4-f22eaa39369d", "comment": "Malware payload (Amadey)", "value": "79bb72285a8efb9aca675fdef3fb320dbc40c625", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693168899, "uuid": "03580eae-d6e5-4015-ba81-74eb4abcd8e3", "comment": "Malware payload (Amadey)", "value": "f3f40d19d85244432cbd3448e84c4c7a3d6b978711152a546c96dde2ad8cca38e4e6b511807d0620a9528df6120bc579", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168899, "uuid": "12ba6f50-da33-4696-bd56-da2202fe0545", "value": "T1E0052349A6DD8076D9F627B00CF513830A3A3C95587A53AB269AAC8D0D736E4F03573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168899, "uuid": "822ae40f-543a-47b0-9e25-c0effdf29543", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168899, "uuid": "15a186db-b731-4625-9d02-5399259a5125", "value": "12288:jMr0y902pjDobCTdn/+4ejnUw2Dg0YfOLnO6bJ6ei4AmJ3M7PL9maTP61v4gHjmh:fyRDobR4gP2XzOQBc/PR6N3DmRMzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693168899, "uuid": "0d78a848-0ee4-44b9-aa17-600e2d938871", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693168899, "uuid": "2c726e7d-3446-4812-8b37-931eaa661be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693168899, "uuid": "142870d1-1cba-451e-a30c-93e14f020ab8", "value": "ea094fee358eb0ed2f1d6b2984b05bc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb2d684-44bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693130164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130164, "uuid": "80184eab-0abd-49f5-8c9f-124c02fd2438", "comment": "Malware payload (Amadey)", "value": "a5a9cbea2105a5d90804fb0e4391fb77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130164, "uuid": "f8cb35cc-f3f4-4d63-9b4a-84b647dd666a", "comment": "Malware payload (Amadey)", "value": "fe13e64f2a27b2e2cf8a357f381def705e70f32eccdb6e873ef784714bf3cb56", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130164, "uuid": "c4cd8f3a-3996-4d34-acfe-521fb9945d7f", "comment": "Malware payload (Amadey)", "value": "3a50fd669dd44487814dd3817e96961e6c07c4bb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693130164, "uuid": "ec251e02-ea25-4b82-95a2-344f5f5aff7d", "comment": "Malware payload (Amadey)", "value": "17b97941049452c27f677ad008493de15ba73d2efe3892d2e5afc1b15ffdefd63c0083e6a7e84c36bbccb3313da5493d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130164, "uuid": "d6e515c6-e9cf-4913-8fba-53159d00cd61", "value": "T1C7051326BDD81573DDB51BB04CF303830B3BBEA1C878965B2396985A0D726947478B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130164, "uuid": "06d9e2d9-5290-493e-8121-f668645ac297", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130164, "uuid": "9f1d20d9-0cf8-4893-a4b3-79c026b5500c", "value": "24576:ty8u8fHz1JaE3Wza5rdsH2k0HuJ+WxpvT:IsfHz1JakYa54yyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693130164, "uuid": "10f416ae-d360-4cf7-b1f1-aa196f767da4", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693130164, "uuid": "d0a05a30-ac4b-45fc-8a9d-555724d595ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693130164, "uuid": "9b8d34d3-7474-4019-907d-15b8aa14d592", "value": "a5a9cbea2105a5d90804fb0e4391fb77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9899300-448f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693109431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693109431, "uuid": "22122a43-009e-435c-94c3-28fe3b2aa9ff", "comment": "Malware payload (Amadey)", "value": "2612db60a87d252d98301a3f3eedccd0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693109431, "uuid": "bcc46c6d-d69a-4ba8-9f8e-29bb2a6697f4", "comment": "Malware payload (Amadey)", "value": "feccc34d9d5d89013d16ab7b5cb5437575ec915237b67fd4e48326dd9d41a54c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693109431, "uuid": "770947fe-ec29-4728-aa16-f6fd042505b8", "comment": "Malware payload (Amadey)", "value": "cfda352237351c429036d78acecb97db0e46b667", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693109431, "uuid": "4a33c4c8-9538-4d6b-bd98-764524912bb3", "comment": "Malware payload (Amadey)", "value": "9c97318519fc1b1268976b274e44128e1bce6f86c23e1689e8a64b863dd4d967b30608115a1237bc42682cb60d4a3c1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693109431, "uuid": "be85bf85-c70c-496d-aa99-4ab1789f70ab", "value": "T1A774F146A3E98033D8B117B028F712D30F3ABCA59DB4536B23955D5E0CB2AD4A93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693109431, "uuid": "abddb64c-7f68-4435-a394-9c71f8071156", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693109431, "uuid": "648dd4e3-4a19-432b-a82a-3ae3ed615337", "value": "6144:KNy+bnr+Ip0yN90QE5WXSkgXmmhqbqWNhRYDlB8em1NUMkv2/SwOIBRHdJaVuye:rMrAy90xSbqshRYTWyxIBBaUye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693109431, "uuid": "48e856aa-7d69-46cc-96c4-b469271209dc", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693109431, "uuid": "e66e2bf3-1be7-4eed-a58d-2a745a208ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693109431, "uuid": "53d3a1cc-b90d-41a9-893f-0662c3b7694e", "value": "2612db60a87d252d98301a3f3eedccd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528fb044-44f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693154811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693154811, "uuid": "291fc92c-fc00-414d-9f3c-1b37c5de6d78", "comment": "Malware payload (LummaStealer)", "value": "3339cc64daf2927c1d3cce443b37d773", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693154811, "uuid": "6deac88c-f3ee-4a49-9167-8242154028b5", "comment": "Malware payload (LummaStealer)", "value": "fecd12f8994eba3b98a904a16d86e8a52845232eaa2d77e8a541680d35743222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693154811, "uuid": "eda3f1f4-0a78-44da-8ace-abb9019c7ea3", "comment": "Malware payload (LummaStealer)", "value": "587ed53c15e1bcc6679d1315d6d2802d291e5b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693154811, "uuid": "8afc06f9-b083-4bab-82d3-f4e5050cae02", "comment": "Malware payload (LummaStealer)", "value": "c3a7b46e16a53de549241c94c72a9d7caf7b34eeb38be1c0ac66ec6e0e95a3d841beace73bb8254e5086b5da83169794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693154811, "uuid": "95faa0c6-94d6-40cb-9838-370d1ec517c6", "value": "T127849D01F9C2C0F2D863153209A5F77A5F797931CD61CACBFBC81D69DA32681931A26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693154811, "uuid": "afba2c7f-b014-438f-9c76-cfd422e46c87", "value": "cb7b6da3b09f0bff0d1e3f6d54685bd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693154811, "uuid": "f0557ccc-d33b-4b01-a9e7-37dcd776c45d", "value": "6144:s2z444N0LFLd7qDFEJfOig6XwXw7DE3oA8YHf6Nz5b1h5RtkCovQV2MvgAA6:sBF0RLiFNNtXw7DE41YHiZ5b75RtkcC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693154811, "uuid": "6644d916-a43c-47a6-a468-3205b752e3ef", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693154811, "uuid": "7eecbec8-e8f6-4f0a-ab75-85c569e81b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693154811, "uuid": "21efd32e-9f38-4ab0-bb88-a8968b5134a9", "value": "3339cc64daf2927c1d3cce443b37d773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c41581d-44b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693126078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126078, "uuid": "b1bb2986-164d-483a-830c-d347959cbec5", "comment": "Malware payload", "value": "f9e6c484c2a192b70ebf7de8c26f555c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126078, "uuid": "6506ba5c-e2a0-43ad-a4aa-d7527ba4b8bb", "comment": "Malware payload", "value": "fecf2d2456a5709cddc255d0fe1bc9828a50664408e6b94a9302f551acaa7647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126078, "uuid": "57de40a1-bb83-45e3-8571-cead83598ba2", "comment": "Malware payload", "value": "1bc3bd11b634975c82cfa5ffb2fe40f2ece18e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693126078, "uuid": "9d755fec-edaa-4fe9-8893-003689b88ff6", "comment": "Malware payload", "value": "c21412792c2a48639328d8bad3b735ceff4b3e6d0aed1ad4e2814546eb19359ae39ca7b7c37655fa201a5cd7681fffa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126078, "uuid": "6cd44cef-5053-4649-969c-3c2455bf4be9", "value": "T14A85F52E6889D473C3A2023076BAD7E146F86EB027E180FF52943D17C67C9D176F865A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126078, "uuid": "09713482-f858-4228-9ae9-457524e39a86", "value": "8ec03ac6f0bc169245431dc7abc76595", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126078, "uuid": "0b9c0abc-2149-4a94-bd5e-f6f7962f14df", "value": "24576:ic6LPXtknU2HSwdIoGCkTv77QTEBbBbLTvFzTk/SR2yJtLo:IWnzcMAzLTtzfR2yJtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693126078, "uuid": "fcc0aff6-ecd8-4e02-bb19-10b0ee17dcd7", "value": 1740096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693126078, "uuid": "97f1da38-6812-46d8-920b-31b8aff2eb9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693126078, "uuid": "1ddd8839-9c06-4517-a447-b235e69596bb", "value": "news2_01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1a0008-448c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693108230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108230, "uuid": "a9ba1cdd-001f-438b-aa37-33e5f3b70966", "comment": "Malware payload (Amadey)", "value": "37a3b3bbb80ebc9f361d6754330adb11", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108230, "uuid": "2b33de4f-50a9-46dd-9f06-deb276e2491b", "comment": "Malware payload (Amadey)", "value": "ff60e41bc9957112ca2e164b9500b12e2c8d4d7ae3b4ea0f097ccc698f3a6b51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108230, "uuid": "f1125a4c-fc8e-4464-aca3-8cf51ba3b590", "comment": "Malware payload (Amadey)", "value": "d786be41e4154f3b7a5bf7674d799bb2cc2f9e5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693108230, "uuid": "ca931e78-a634-44da-8e95-2917bc4fe467", "comment": "Malware payload (Amadey)", "value": "f6f3417c789881e27f7b3f0fd7e8e6d6ed1cc04440ca89ffb1dafd31d91e22ca4ff1136d1f35d7af682effefe8a1a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108230, "uuid": "27afef12-9821-486a-902e-276f5006acef", "value": "T1D8740202F6DC8163ECB51B705CF603830A3A7C95AC78936B2B95AD6B4CB3580A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108230, "uuid": "d4448522-407a-4ed0-9591-925e51845fe6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108230, "uuid": "3b706730-8568-4632-89b6-3cfe42248148", "value": "6144:KOy+bnr+yp0yN90QEIVo14zJ8b9UdBIzqnRGHQVL7rC6PQoeL61nvkXjc:iMrWy90m+1a8b2jBnjlrCloeL6qXjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693108230, "uuid": "54eeb358-0217-42a1-af1c-1113f9461506", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693108230, "uuid": "e03e5d9d-1d04-4d73-a8e1-8d534f63a3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693108230, "uuid": "72713c64-407e-4df3-a232-47d542fc01db", "value": "37a3b3bbb80ebc9f361d6754330adb11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }