{ "Event": { "published": true, "date": "2023-04-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-04-08", "timestamp": 1680998581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "65e32c03-cca0-490f-ba06-db7bce02b6ba", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1b122b-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997169, "uuid": "28b0cee2-5108-46da-b3a0-4783ac2111e0", "comment": "Malware payload (Mirai)", "value": "69d4d56041a4faac2cef5f930579107c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997169, "uuid": "e0525112-27f6-4225-8a55-97856b34d1ba", "comment": "Malware payload (Mirai)", "value": "0111091a9459a439d56a4a74ee5bb56443364378568bf33332d7b752433e4b5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997169, "uuid": "23020e81-1d8b-4137-be9b-cfbed71b42bf", "comment": "Malware payload (Mirai)", "value": "d14fee63bbef7b02aafec2b2710251e5250ac7d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997169, "uuid": "da845067-fa4e-4943-b4b3-579a06284948", "comment": "Malware payload (Mirai)", "value": "28469832f7211c8b13bc51c532ea6d70c481d3b7817ba0b4e8a61b945b58ca286a82ef926e82624967facf1c4ff4ea18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997169, "uuid": "56508bc4-31dd-4db8-b5f8-725baa324734", "value": "T121130B41B9818F13C1C212B6B6AE4A4D3F25BBE9A2DF3203AD317FD136564E72C16E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997169, "uuid": "6c59c3fc-1adf-4f92-8d75-ea013815ee4a", "value": "768:Tz4zwrxZS0nMvFbVpwbGmHu3/mf3gspM7mZeJv8/N+5iZc9sdLswbZ010U5Mmqf:QzwTPnSFb0O3SQspWoMiZp5b+10mMmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997169, "uuid": "7cbdf346-740a-44fa-be90-bac5ac53e2db", "value": 44332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997169, "uuid": "09ca49f0-12a3-4c7b-aeb3-7cd1212085a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997169, "uuid": "a3d013de-b5aa-455c-82d4-a4798234988e", "value": "69d4d56041a4faac2cef5f930579107c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e862e5e3-d5e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680942323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942323, "uuid": "152a100f-c795-4ede-ab9c-6efac04feb61", "comment": "Malware payload (Amadey)", "value": "1c0d28da1b4d5e777823e2e062f236fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942323, "uuid": "51248138-7203-43ff-b74f-a64a579d620c", "comment": "Malware payload (Amadey)", "value": "02be30640562bddc8b2f693db97311a79e929b10e31a6dcd0a623bd5dea62758", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942323, "uuid": "a63b55ec-09d2-41fe-abf6-13db4b1ea551", "comment": "Malware payload (Amadey)", "value": "313cd2f8592f7f8bea05a25ba6956ee23971ceba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942323, "uuid": "a8a3e138-4f23-4214-bb92-fab3a03e0923", "comment": "Malware payload (Amadey)", "value": "8cb30b0c15188a3eceead863e8f0a0b73377f742144ebdad8fef558ad2c0086cfe8c57c196ebf24ea4974def77fa859e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942323, "uuid": "77398f92-3b73-4e07-8df4-11a78f711649", "value": "T17E16D0B0C8834A572261FC76FDE85A7B5EDB21BE411FD84E0AD6125DE784EF83CA0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942323, "uuid": "5ec5fd55-0928-4c98-9992-53b4e144f92f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942323, "uuid": "a6aebd21-3fda-4983-afdf-0e8f3f5623dd", "value": "98304:aI1FeWZ2aTUUYd0RaqDVq4NDWcn3q+ax4tOkw+0Fi30:aksWQaCWRaoo4paetO+cik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680942323, "uuid": "885d852d-b53a-415c-a511-75205dee164e", "value": 4372992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680942323, "uuid": "03bf5180-0fd7-4a65-9f45-d300fe046b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942323, "uuid": "85fad253-0bf3-4836-b03a-565c9745e889", "value": "02be30640562bddc8b2f693db97311a79e929b10e31a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abcbe7b-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptoWall)", "timestamp": 1680976928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976928, "uuid": "256f55be-dea9-4652-bb52-c0b8f2d79b97", "comment": "Malware payload (CryptoWall)", "value": "b2fe08274cd765d5c3269bf6d560b5a2", "object_relation": "md5", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976928, "uuid": "a09628f1-7de8-41f7-a74e-b2fb29719e87", "comment": "Malware payload (CryptoWall)", "value": "0715240d1af82c1cea262cde2a286b8b400805dc1f35f49422c7ee39e00f93ce", "object_relation": "sha256", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976928, "uuid": "b44ed1c4-23fd-4b36-86b9-c889b89afca3", "comment": "Malware payload (CryptoWall)", "value": "faa12ea8137072476ab6646f06cd74c1e0ced5be", "object_relation": "sha1", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976928, "uuid": "9c2d59fd-4ce5-45bd-9c5b-937b3d2b6513", "comment": "Malware payload (CryptoWall)", "value": "0d9b2cedff920342cef74781c28fdbaf742bc87ee7898eacd0e9b1e81a41a7a083f293dfc5bbdf7c671334771f91589b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976928, "uuid": "38cff817-3545-4c96-8e57-cb8d69cac03a", "value": "T1B7D31B10C060C3BAE49240F9D7E90DBDF8355D60230615C767C63F78AB92DE5AB35BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976928, "uuid": "badc7180-e039-4d93-a765-7e29960d578f", "value": "3072:ECmzzdcTtDRgEorpwbVLuP4HWV1oqCgQfBUnPy8L2VBBh:EbOTttgTrayP4HWV1oqCgQfBUPy8L2Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976928, "uuid": "0625da1f-d43f-4716-b220-83432e45f1c7", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976928, "uuid": "cc12b051-6ba2-4464-9081-f39138b02678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976928, "uuid": "24c285c1-994e-43d6-91bb-b8c181539f44", "value": "2023-04-07_b2fe08274cd765d5c3269bf6d560b5a2_cryptowall", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffd8905-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959704, "uuid": "7a6e1b4f-7b90-47f4-b3b3-c66b08c002f5", "comment": "Malware payload (SnakeKeylogger)", "value": "a2e7c256ef37b0df14206a977717e480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959704, "uuid": "cbf88370-6885-4d32-a07e-0303b3c4fbf5", "comment": "Malware payload (SnakeKeylogger)", "value": "07825917e55f488b83f57994cc3d4a9f253a21a47e54a094ce150671037712a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959704, "uuid": "8957c5ae-6358-4c6d-a046-c4de3ded67a9", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf33ad7c73d0f36ace7d8a185bf3a18a854f7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959704, "uuid": "9201b52d-1ea3-439d-b0f8-990918b41b3e", "comment": "Malware payload (SnakeKeylogger)", "value": "84d2493385bad2dda9f4ee2e71946b3fab38cbe7bd05fca9ffce8f6defbb134a7ad6f14db9780c85ed9d0aea250d10ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959704, "uuid": "9e80b0e6-89e0-4b91-af06-e38685b74384", "value": "T1CF243B5A7BF48410E5FF493304B09561CB3AFC521A2ADE1F67D1B52A1F386908E16FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959704, "uuid": "cb755dbb-5486-4182-96e5-1aa2e5b34a96", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959704, "uuid": "47331a72-2d02-49e2-be9a-47b6edb35701", "value": "3072:jGybM97hOQ/iK2jrOyipG/XbKjvF18CkAgAEcCv/IgOYrvQlqQArb8A8xwBWjO/Y:iDthOzj8GzKltFyI6UqQArbOOtbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959704, "uuid": "77422372-f6ef-4d47-b32d-dc9b230e4853", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959704, "uuid": "3f93ef9f-5d71-442e-b19c-f538b428caf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959704, "uuid": "9826a966-43ab-4b5b-ae43-0b39bfaa4ecd", "value": "a2e7c256ef37b0df14206a977717e480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e63d29-d5f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680946820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946820, "uuid": "1efafa54-e707-4e6a-b5d1-b853cf5e3ef0", "comment": "Malware payload (RedLineStealer)", "value": "e4d50dca43015760f6580812fbe46f33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946820, "uuid": "44c1fc4c-c5b6-4fd6-a70e-555c2d4c239a", "comment": "Malware payload (RedLineStealer)", "value": "0a141f6eedec693e46e432f67b58f35f8e0bebeeb4efd74460893a845e23cb81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946820, "uuid": "de918b29-5788-4b2e-9f28-bb6f623f445e", "comment": "Malware payload (RedLineStealer)", "value": "e56937115788a4823c4269b73c35c1401c4cbc3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946820, "uuid": "b42af68d-4aac-482a-8cdf-a48f998f1f67", "comment": "Malware payload (RedLineStealer)", "value": "be39f639817271e63b157ccab6604ad8d1f026ad0c94c074f56254c8c7a4163a704bab6456beb34442ddcd130f8b75b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946820, "uuid": "0e5dbc4e-7c95-4275-877f-2a94e3fb8c90", "value": "T12C64F111FAD0CC31C56718385072CBB8AE6FFCA2D6A0858B7B542F6B29707D1A736356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946820, "uuid": "2662f91f-3c3a-4e4e-b57b-c3182aaf2c38", "value": "df2226e8fe47f2e29ce1b8002c45b6ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946820, "uuid": "96347a76-db3f-4183-9d39-00e17902247f", "value": "6144:ZgHQ96hkCu1oy3ZmwEwfh2pOhoM3H0ddcSZVoGkYR4B8XQ:ZgHThPu1oyphEM2pObXBgefOyiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680946820, "uuid": "d5a999e5-012c-4699-8a09-b2cd7df13bf3", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680946820, "uuid": "631024b9-7d4c-4136-a10a-bbf720015e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946820, "uuid": "c9eac800-bdd3-499b-99f3-f2ef95f5e75c", "value": "0a141f6eedec693e46e432f67b58f35f8e0bebeeb4efd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dfbdc9f-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993550, "uuid": "9e9458dc-307f-4a70-b161-302d62fb42f4", "comment": "Malware payload", "value": "b59bf2d6b87182b922918f2939b42ba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993550, "uuid": "593d9c74-7f04-415c-b859-2fb2642e38c2", "comment": "Malware payload", "value": "0bfd6dc12e7262cf7803a9d3f28e2a35932c61224200ed152e3eff1c3dc638d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993550, "uuid": "7dfc9062-3515-4074-8718-54ee128ebc6a", "comment": "Malware payload", "value": "fab0ed64dc9e857e4cab31b9f13b4e9ea8bf84c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993550, "uuid": "584bde28-7659-4f58-b792-c9ce75a3fa39", "comment": "Malware payload", "value": "ecfd79bc6a4752022bb5a572f0d3416c13fd7b0968a6e9448870c75fa54fd9286cfb72f910f357b07fbcb99743d0994f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993550, "uuid": "6d656d87-3503-4c4d-b4c5-0903153afa66", "value": "T1E4D32A56EB418A13C4D61776BADF424533239B5493DB73069928BFF43F827AE0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993550, "uuid": "24885e81-a811-4650-b7d6-ce874fa98ed9", "value": "3072:22YYn+j6necra+FAKYoF1PtlN37cJzy4gM/9wWbE8F:LYYn+enRra+FAKYovPFwJzy3M/9wWY8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993550, "uuid": "20a7cf00-78ce-44da-97a2-03c501e7d705", "value": 137251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993550, "uuid": "54464d43-11ca-4215-ad41-aabdeb247042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993550, "uuid": "5d94d8a5-9d31-418d-94fd-c65451e9f2a2", "value": "b59bf2d6b87182b922918f2939b42ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cb00e4-d627-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680970152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970152, "uuid": "e8145280-1216-41b9-a08f-628e146d4468", "comment": "Malware payload (RedLineStealer)", "value": "abc359b5d45a7c34630b38d8012bc454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970152, "uuid": "9bb33ad6-9467-438d-831c-4210297d30a5", "comment": "Malware payload (RedLineStealer)", "value": "0c26afac85b2a7d081e85521a98d115dfd12dcfc6503862ff4f3773cdf2ab7b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970152, "uuid": "4b37e484-dee3-41a7-979d-fd0987984e4e", "comment": "Malware payload (RedLineStealer)", "value": "30f0fe243b172b667d6fc035353a35b7bde4ad36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970152, "uuid": "d37e8430-08c9-4577-bd30-9de282d2bac3", "comment": "Malware payload (RedLineStealer)", "value": "fb014fca8f05526553e580529f9ae7816ccf12d618b04d1b8bd2fa8e5e8f85985fcc28b0de4eca4eca8a6b899fa47acf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970152, "uuid": "fc562f95-0359-4a92-a1fe-86781e13a4a4", "value": "T1C664F021BAD1C476C86788345425FAA89A7FBC92D651C54B33582F7F2E307D09B2A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970152, "uuid": "0a6937d3-16e7-4170-8de4-2a62c83cad1f", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970152, "uuid": "5f9b4ce1-1e7d-42d3-81c4-0006d95f3fe3", "value": "6144:3H4FKKLhGeLwi75uM/SNJskSMwHalECpMjRQoYEM0cN0X:X48yEid/SIGuCCiRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970152, "uuid": "f340a285-035f-4335-a31b-5f777f0b1a11", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970152, "uuid": "44dd48ee-984b-4e57-8576-ec7de823d661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970152, "uuid": "209dfbea-94bc-477c-9368-24f4a666d8e4", "value": "abc359b5d45a7c34630b38d8012bc454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39232322-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993569, "uuid": "f19dee8a-03cb-42b0-9d96-8567c3549c2a", "comment": "Malware payload", "value": "1f029bf3add6da5ba65919abe045e4ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993569, "uuid": "c3f0dfd1-67bb-49f2-9f65-c207209b3e96", "comment": "Malware payload", "value": "0d379b3c64159a97d765f39dd0447a0e965b663eeabf9e642065fa77190697b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993569, "uuid": "6b42a77b-a886-42f7-8d58-6e7d9899a2c8", "comment": "Malware payload", "value": "9e94d04984abb71927c8ee2a2d364c0610d69e1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993569, "uuid": "1571bf33-79a2-4298-8aa1-387f34b61de1", "comment": "Malware payload", "value": "8aeae0b060dd21bd162c8e875cb8543deb26aeb86f654a521679b1ea23aadab8d830dc87fc44ab56a506a3a6b9d92095", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993569, "uuid": "361bd44b-c8b3-423f-9c6a-07d0b43afe7b", "value": "T119A33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993569, "uuid": "1a590c64-2730-484e-a520-a0b49a0b4a67", "value": "3072:iHobm0w+aSP+wUsGZmDYgTE+mBQO/IXZFW:iHo6+aGUsGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993569, "uuid": "25e54d1e-7f77-49de-82a7-43c2fae64e92", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993569, "uuid": "7d4c1eb7-76f3-4da1-984e-5676f29a1294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993569, "uuid": "3bbb6c55-c18e-488e-8d22-29eb34999146", "value": "1f029bf3add6da5ba65919abe045e4ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6945572e-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680964873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964873, "uuid": "96ad61e9-787a-48b5-ab43-0a4432fc2874", "comment": "Malware payload (GCleaner)", "value": "99a3cebe3450021c771985d2414bfcae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964873, "uuid": "a623d129-d8db-4f0c-9b7b-aede308426d5", "comment": "Malware payload (GCleaner)", "value": "0df707ea4faac4b07939ac3a4cc235699451830cfb75f6d665a2a81f0bc125e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964873, "uuid": "24a511dc-4a91-4e50-a98f-f6fe91991d3a", "comment": "Malware payload (GCleaner)", "value": "d0a5583d0ec903418fc1f8043f005824b11a6fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964873, "uuid": "b6d122cb-f0f5-4e90-b7f0-84a017a940e9", "comment": "Malware payload (GCleaner)", "value": "8c1861dc2eea548ec7199c35ac37c02c768343387a7fbc56f492dbe4345e3f2452a3987ff0ca50b6ab074096c1260376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964873, "uuid": "23e6611c-eef2-49fe-a262-ed6931e85017", "value": "T16244E0617C90CD32D86914349871CAB1267FBC5766149943B7B83FAB2E323C12A3639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964873, "uuid": "88600b92-2c9d-47bf-b3d0-e2930507e331", "value": "1a21bc96f45cd14b947cc79f5712c961", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964873, "uuid": "5ab3425b-f121-4a8f-9304-c630e8c61a06", "value": "6144:kAYTwA8lsnpt1cuXdgn87eFsLniXf2LQaRgyXET:p0HmsnjXSn87eFsjtLQ0gms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964873, "uuid": "397be02f-53fd-4998-b6d7-9823b2db06f2", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964873, "uuid": "7d57a4bb-f3c2-40ca-bc98-e07a17ff8015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964873, "uuid": "339b66a0-eb74-41fd-a5e7-d000f83ca121", "value": "99a3cebe3450021c771985d2414bfcae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e13c79a-d5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680914630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914630, "uuid": "ff0f7836-576c-4c59-93a8-6b8360ebc51b", "comment": "Malware payload (RedLineStealer)", "value": "36d3808cd082f0fad9a4a8a4a55783ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914630, "uuid": "2b767fc1-860f-4b0a-b911-7b3e3541f7ca", "comment": "Malware payload (RedLineStealer)", "value": "0e20c38d5b5538dd3fc23539548562b6ae47d4a61c8f2c5ba73398c02deb9a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914630, "uuid": "e25ff265-f5cd-4353-b751-a56741546d4c", "comment": "Malware payload (RedLineStealer)", "value": "ce4cae2a1b5600ac2ef67a7c14329b6be83df0a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914630, "uuid": "1eb0605e-1b19-44a7-b50b-454b8480b3fb", "comment": "Malware payload (RedLineStealer)", "value": "dd1e1f6e70a2fc065b20da38d90992475528a99187b8c3463466d992704d2488fdaf48409d0059aeb6631afb9cb16bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914630, "uuid": "a29dfbb3-6c61-42d9-bacd-e17e0ed0f071", "value": "T1350512C2BBE4D076ECA0677059FB46830B367CA29974939B3B411C5B09B36C4A93176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914630, "uuid": "823d5837-f0d8-411b-9380-31464481a3c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914630, "uuid": "f413f1cc-1d8f-43b5-a29b-e9d974dfde91", "value": "24576:DyXQk4/Ri6v+7JayYRQYbzkzmWgtcTxrX:Wg5sxDUcTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914630, "uuid": "8b8f23e0-82c4-405d-bb26-d619529d9852", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914630, "uuid": "aa78c763-9b8e-4cbf-952b-484fde532ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914630, "uuid": "adfd910c-a71a-47bf-b5e3-1c97268d6ad9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e349d-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680956135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956135, "uuid": "8a8ed131-315b-4860-ad8d-bb67f88945c9", "comment": "Malware payload (Amadey)", "value": "782a29b558061d8ccc533bde07afce6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956135, "uuid": "7cbe5ec0-4e68-4221-ad02-c7bd2fb81239", "comment": "Malware payload (Amadey)", "value": "0e59e748168a7b81e907d13d51b9994e3e8049d967d1f84afc4b3550aa30503f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956135, "uuid": "6a252757-3c09-4f30-bc62-d8d036f3f5be", "comment": "Malware payload (Amadey)", "value": "acb7ad07cf34cd49599d124953184972a7665acd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956135, "uuid": "fb5d11a4-96fb-4d9e-877e-6421dce42024", "comment": "Malware payload (Amadey)", "value": "5933f9506c737c76d43d844fbf6bfb031653ceecc369a65a22be1fcc42b115d58055d8adb4f6cf5884b7416d21cbb165", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956135, "uuid": "edda248b-b176-415c-b90f-18a06d86e193", "value": "T11F352203B3F941B2E8712B7158F343930B7ABCA19E38469F3686B89F59732C09571766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956135, "uuid": "cd95492d-43bf-4c07-a2fc-1a6492fd7f14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956135, "uuid": "050ec272-1ca5-4455-9508-c9775e929dc4", "value": "24576:byjgbi8gL2iNk340XY7tbcUNxoyYP+x0Hu:OjkpiN1kY5bcU6Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956135, "uuid": "d84304ff-6e91-412e-866a-df8e842f811a", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956135, "uuid": "3591905d-f9cd-449b-b0d1-f0003c6b5026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956135, "uuid": "1f402bc6-d400-44d0-b872-98d721492236", "value": "782a29b558061d8ccc533bde07afce6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4824f882-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993594, "uuid": "31ae89bd-581d-42ac-b893-7d5699a6a7c8", "comment": "Malware payload", "value": "fecab42709d05270d46c871392917fe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993594, "uuid": "98060158-d483-4124-b43a-7300d27c1816", "comment": "Malware payload", "value": "0ec2bf4e77012b6ba7eef43f1cea43c3b51ec0da67269e2b13195e0c07e4e7d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993594, "uuid": "9d63b241-0af0-4834-b35a-f836483d5c33", "comment": "Malware payload", "value": "e833056d6afa1452a1896e58d8bef6575148c3e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993594, "uuid": "6ca563c5-b917-43d2-8930-c996eccef17d", "comment": "Malware payload", "value": "049696fef7043c25c76642ec38082a333c8c9c1e746df14a5e8954c7db7b93c7b2609d2b276d429676fad2109382f5ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993594, "uuid": "88ebbb41-054a-4d15-bfa9-544c0f29bec8", "value": "T119830897B901EAB7F40ED77604D74B247230FB624E931A32731779A6AE362D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993594, "uuid": "37b46bc4-49ec-4cb0-a0aa-9350d614a5ca", "value": "1536:uoEA0hVJxW/93584AWzab0y79N1xK19OTetUvZuJifUImzS02q2/cOfBgj:/H64/Nnzab0y79NPI9+uJemu02q2EOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993594, "uuid": "fdeaf36a-0132-4c9e-8f55-f9107bda95fb", "value": 86519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993594, "uuid": "91648380-279a-414e-b20a-62f3acae739e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993594, "uuid": "666699a0-ae30-436e-bf02-57d765a4512a", "value": "fecab42709d05270d46c871392917fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126094bf-d620-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680966875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680966875, "uuid": "eba68cfe-5a0b-4310-9aa5-58607d2c2f99", "comment": "Malware payload (RedLineStealer)", "value": "05f07639b0ccf119f5330b11ca422afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680966875, "uuid": "2c97cf7f-8f32-4945-bae2-ad1a68bfe21b", "comment": "Malware payload (RedLineStealer)", "value": "16ba6f126c62b4a6b933a7c137b525df0f735cc9e97d287cfe5c11c1e7491abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680966875, "uuid": "2852ba82-2611-426d-be55-e7fe354ff0b6", "comment": "Malware payload (RedLineStealer)", "value": "e7b8fea03689360a0985a5ce541f21855d17a6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680966875, "uuid": "89bdf2ee-4ea3-4e89-a678-d4a13c0bf7d8", "comment": "Malware payload (RedLineStealer)", "value": "6fb478042a79acb6886ab94d8c807d4bdde8dc37cab9ad3991c94a20a0131b2af9e4a9f13b35b3721afa79885e604d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680966875, "uuid": "576c6b50-f9d7-447d-b1d8-059043d37534", "value": "T15957B20DADB060BEFB15B3BD7C9378EC6A387D62986A4B0626B580050A5F4F97753334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680966875, "uuid": "4d9c151c-b054-4296-ae72-80b520efe219", "value": "534add4c0cbea8afae98064a5b4a30b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680966875, "uuid": "abb3e4a7-1a81-4cc5-84cd-18fe8d9a8570", "value": "3072:yC3DwcB0IH7K+RDvbUV6uM/7yA+dYP7kD8+gKhgRclXr/5O:Fj0IE6uMmykpggSGXr/5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680966875, "uuid": "155edcaf-978a-4516-ab7c-70ff5f8b0dc0", "value": 28513280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680966875, "uuid": "4aab35ba-b4de-4213-b7e6-97d474ab085d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680966875, "uuid": "3dbc1c56-8c32-4ca5-8f06-91802dfe49b1", "value": "modest-menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515f5abe-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680993609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993609, "uuid": "eff73058-97e0-4df4-9c30-03f6fe2d0228", "comment": "Malware payload (Gafgyt)", "value": "b34aec1f03f6408e7daacfe1a7302ee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993609, "uuid": "e17beec6-665e-4ace-95a6-8d63de60964b", "comment": "Malware payload (Gafgyt)", "value": "16e49b95ab1b1be3844bf87b69520cda570761b8447d4c931785852eb834d02d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993609, "uuid": "01d59dec-2c46-4ec4-a57d-535925c542b4", "comment": "Malware payload (Gafgyt)", "value": "60c1e2822bf27f2820d7b7c21fdc3502a43866df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993609, "uuid": "c56c0731-6093-48e6-9c56-434c48a07740", "comment": "Malware payload (Gafgyt)", "value": "ecda620e3fb00ba31c5d8f973ee8f5d0d6673ffab1d38145ac2f0cac0002426c929f526f75ed3bacde6df43820b02e87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993609, "uuid": "d6e59c78-9d29-4f84-89c9-a9c10e025c19", "value": "T1A2632A026741CAB3D4831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B22B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993609, "uuid": "43bbe7f7-210f-45e5-a71b-ba604824bb27", "value": "1536:RRVYPCNH1jUdOn4JymPWBSgSh1MtNor/NbHBDSDmd+l2OZ/fufYEZ:RRUCNH1gdikrEHM1I2rVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993609, "uuid": "f2666286-41b3-42f7-ad67-ec7b45033e72", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993609, "uuid": "d86bf1a5-0a7c-40ae-96af-8bc826530099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993609, "uuid": "ffd15192-2def-418f-a9e1-7b2262fb0b04", "value": "b34aec1f03f6408e7daacfe1a7302ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af93ffe-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959695, "uuid": "a8c0d0ec-341d-4c7b-8f7c-af657ea0282b", "comment": "Malware payload (SnakeKeylogger)", "value": "fd2fe0718fe705c643931510cd56f6f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959695, "uuid": "dbef9659-62ce-4c62-8df3-e364dd71d78b", "comment": "Malware payload (SnakeKeylogger)", "value": "16e5b2307f57c405eeb692bc1d64d4141b47f463961408eb2668a3fb9c447ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959695, "uuid": "aa95448d-5196-461d-a609-44f8156697bb", "comment": "Malware payload (SnakeKeylogger)", "value": "bd83ffb10e80337d8214e0f855d12ef52094fde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959695, "uuid": "f1a802ec-e189-4ba7-82ba-4e2b81cfd8da", "comment": "Malware payload (SnakeKeylogger)", "value": "82da089404441d578d548b55a60c0845938ce4cf8a83e5dcb08c32ce75fa9c790e5e0089121e24f6e5a6f07292b8673a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959695, "uuid": "78bd7fe1-0499-40e9-9b7e-ff69947d1ad4", "value": "T19CE46CD42AD68BC4C537B130F05AC6F2C3D2152AE09DDBE1389B5889E1D2E511CFA9BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959695, "uuid": "4aca2d17-8164-4d3a-b64e-06fa04fca5af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959695, "uuid": "f0ea6b1d-90f1-4fe6-818b-d6963cb2e597", "value": "12288:ri2iNUg+oVNm0Fw7f+Eh8JsxmMCAPgoYicoqH1/jKH9yyBcJmvdfa9yVgh2eV:m19++Fw7f1KdLZD/H10dfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959695, "uuid": "1dbdc60b-6ef1-40d5-87eb-a66940ad7793", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959695, "uuid": "69c565f7-e4e8-438c-8bc7-3fab1657b65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959695, "uuid": "5b814feb-f72a-4d32-a899-101c09f75888", "value": "PO STS5492(338)042023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3ca4df-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945574, "uuid": "e9ccf17b-c433-4880-998f-2853da110b54", "comment": "Malware payload (AgentTesla)", "value": "835d2532d19757fd40e6488df73be8f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945574, "uuid": "de781f8c-2922-4220-92fa-e90d2a4265fb", "comment": "Malware payload (AgentTesla)", "value": "16f6faf3419e20508194c93d03b951f1374bc514067c8b479542df88d0fbdb34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945574, "uuid": "74c6a5aa-2414-4a5f-b177-0465327407c6", "comment": "Malware payload (AgentTesla)", "value": "f41a48e8e26d0b2ed70735482381999410390155", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945574, "uuid": "ea2d719d-2b00-469e-93d6-deb3a7473d26", "comment": "Malware payload (AgentTesla)", "value": "6de0495ff91b68be6964c00c5e9031fe21e91f341688659daf42fd9cbf1e1bef3266da4d770a301a3a68df8df23d91cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945574, "uuid": "5a78a6b8-5950-43fc-b0d4-fdc7f267fcb8", "value": "T1E0C4DFF082448ABBDAFC0074901E06A877F1BD78E1A1F3E73DA87992A7B37534765506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945574, "uuid": "99eeb44f-05d3-449b-9dc5-4a42338d7b87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945574, "uuid": "e6abb668-dae8-4018-bed3-f23217c72fcc", "value": "6144:Th5oiwrzM277uXuFyG8uCY4bW1mta2mQaCgoCKViQGjKJVZ3HzhliG1y1ovbGW/K:FhqzDnnFyRNi1QmQajPK3rrZ3HJFMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945574, "uuid": "6d54588d-535e-427b-be7d-d72166f09c7a", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945574, "uuid": "e753a0a4-e8cc-45eb-9343-aeca23988e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945574, "uuid": "426a1e22-35e8-43cf-9c99-306a7d33c36b", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784b09d6-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997111, "uuid": "aa83128e-f4c1-47cf-807e-8638302aaf43", "comment": "Malware payload (Mirai)", "value": "fa9ef619ba970a85aa7e7bf051175671", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997111, "uuid": "d5a14cbf-184d-4706-b9a1-a9184ea3f88f", "comment": "Malware payload (Mirai)", "value": "1808d74b3020c46986495143533c78c2079c22adeeca1ed7d425c34e8c03c152", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997111, "uuid": "ae7cd318-c061-4ffe-9188-8375f687d7e5", "comment": "Malware payload (Mirai)", "value": "0aee31ae3bec6de1df8d7e9bd1ec248b70b7819f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997111, "uuid": "912ce6d5-2e33-43ab-9db2-116647f11cbe", "comment": "Malware payload (Mirai)", "value": "837bb7715c53c2bcf78299e0b621529b4211ad2f11bf287f81ce8deaf26c6aa3130dd39e431c3f340b26a8767d73b20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997111, "uuid": "9f3112c4-cafc-4324-8551-a66a51f52d66", "value": "T15F13F897F806DE7EF40BA7BA51934D097920BBD616930A2363B7FDE36C321D52812E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997111, "uuid": "a45282f9-c096-4330-a646-995731e18b69", "value": "768:j3eqgmf+wg+BSuY8wKOskrhve9cEWDkGFaQLDTAw:jc+BrY8wKwrhvocEw1LPAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997111, "uuid": "da41d82e-3630-4e4d-b5a9-22a905846adc", "value": 45556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997111, "uuid": "234a004c-c259-44a5-9c09-d2cbc8a9e2b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997111, "uuid": "3516c946-c259-4871-a4a3-b2bbb05debe7", "value": "fa9ef619ba970a85aa7e7bf051175671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5f53c4-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976933, "uuid": "fe979686-1a72-4d0e-bceb-7a8577c08c51", "comment": "Malware payload", "value": "275e1d6534be20597694a5e11140a96b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976933, "uuid": "2dc9ac2f-2a85-4635-bfe9-d41f22678a09", "comment": "Malware payload", "value": "182cc09a57686761948eaa8e7bc012ea469f1e857b0b3029864787d30b787dbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976933, "uuid": "016f3aef-77e1-4370-a826-7c3171b10dfb", "comment": "Malware payload", "value": "53ca21bd775274969bdb5cb895773cf65a76fd68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976933, "uuid": "292a4670-24fb-4d1d-91fb-e9c8458b6f6d", "comment": "Malware payload", "value": "b4ba5620fecbcec06a8704890d1ef3cf1810a942b2b7b013ddbdc7bb13c1243b24efd9dbe36f507d0845a027d0864908", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976933, "uuid": "937cc996-54ba-40f4-94a4-7b02a62e603f", "value": "T160C55C64E610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976933, "uuid": "e56304c3-fd84-4ae4-9ae4-de176ce4a3e4", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976933, "uuid": "7a21ec0a-80b5-41db-9ee4-2c2fdad322bd", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCc:eEtl9mRda12sX7hKB8NIyXbacAfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976933, "uuid": "6fc4754e-77ae-417e-ac26-3db7b59ce728", "value": 2559068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976933, "uuid": "d6f5e6c6-a5f1-46b7-862e-d5c641d1a1d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976933, "uuid": "a7d63dd5-1339-437b-ab88-804c59067052", "value": "2023-04-07_275e1d6534be20597694a5e11140a96b_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80af56f3-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680964912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964912, "uuid": "a62ad45a-ab22-4092-b847-163431006f9d", "comment": "Malware payload (EternityStealer)", "value": "ff2092551fecc65e5f564738387d7951", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964912, "uuid": "4800d94f-4d9f-48de-a059-ec422cfcfa6b", "comment": "Malware payload (EternityStealer)", "value": "1a346d63b9fd727e74f1bc04b872de7e9a67d9fd48dfddda287d6e7163115648", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964912, "uuid": "7d3cdb4d-154a-485c-94ba-21063580b98d", "comment": "Malware payload (EternityStealer)", "value": "df6faedb17efd0b8cb01e22af1384d0ca867eca3", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964912, "uuid": "be22de8e-29bb-45ae-b4ca-12f961c4cfbf", "comment": "Malware payload (EternityStealer)", "value": "0f1688f27e77e9d06dfbdc7ab68133ab96f4eaaef363f432a010c4a480c17e6974fb0edc8d22586ed457231c36d61ed7", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964912, "uuid": "57849428-2be5-4fd2-844d-d8a1a4982797", "value": "T19A423F303CF9965EF3E9553E0B138A3B136105862267B364DB87F2B26CA1751DF09CA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964912, "uuid": "fea003bd-97e4-489a-a0e0-a03f70e93cf5", "value": "192:4DMsjjG+t4al3TVD0cvJcXEQpZkfd0Me307IjrNOO:QjtljVhcXTZkl0L3hjrNOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964912, "uuid": "c696243a-1665-45c1-8299-2a19c0580e69", "value": 13018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964912, "uuid": "39d38155-19e1-46d8-bde8-a010c0d3fe3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964912, "uuid": "15e4c1b7-a869-4455-8415-b9719d67f641", "value": "ff2092551fecc65e5f564738387d7951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9800a3a-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680965437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965437, "uuid": "4ccf096d-96c7-472b-a9f9-5fa75e9260d3", "comment": "Malware payload (RedLineStealer)", "value": "3368167e312f869faa57d65be8504b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965437, "uuid": "9c56e730-6ff2-42a8-a465-bd3584b3a119", "comment": "Malware payload (RedLineStealer)", "value": "1a7ed068842df41f1ff11d19e788065ab309f3d6c29b380d226f737b858349d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965437, "uuid": "c236e2a9-e880-4641-85ba-a01cccebfa16", "comment": "Malware payload (RedLineStealer)", "value": "54c78c78584d445070b17e1967f4edc0ef79f352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965437, "uuid": "232fa7db-d5a0-49c8-b57d-1df2077cde23", "comment": "Malware payload (RedLineStealer)", "value": "9777d7692ada6bfaa9cad67ea9485aa1c751f96cb5d558cb4270ea039af8588ea916c7e596a45bfa2625c98fc96e8247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965437, "uuid": "dc0afb2e-9b91-4f3c-9f91-bf573267b449", "value": "T1F73523076BD84173E4B12B709DF743470B33BC624CB44B27279A586A28B3A959E36377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965437, "uuid": "582af488-d168-4be8-a7a7-fabb79f6d7a8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965437, "uuid": "f2ed369d-b14a-4b83-b894-4474ac84c7b3", "value": "24576:xy4VLkv+waeNnOqgOu7OlpkDrdMFgp0kxDp:k4NVwQqRu7OwDBKi0kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965437, "uuid": "1bca51e7-897c-4f3e-ba0e-601ecef7f28d", "value": 1090048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965437, "uuid": "052ae65d-2f1d-4f37-8b89-412b4ec0e839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965437, "uuid": "f4ef41c4-5190-48f4-ad89-b9900d8789cf", "value": "3368167e312f869faa57d65be8504b94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec6cfcc-d629-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680971137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971137, "uuid": "5d0a4a3f-c7bd-448c-9121-74870c2397a0", "comment": "Malware payload", "value": "402d0aa847cefa1fdf19ee2668088126", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971137, "uuid": "da741616-8dcf-4649-9b38-9d815331194b", "comment": "Malware payload", "value": "1b3d009198767a01d6dceca649006a80d997aa2d9c8010ea9df0f901d096c482", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971137, "uuid": "897a91a2-00fc-4e9c-b852-d9a16ceed766", "comment": "Malware payload", "value": "43284e2d2d6134fbee419ab3c48a7f736737333d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971137, "uuid": "5cf56241-358e-430b-b203-6329ed654c40", "comment": "Malware payload", "value": "7858f5dd177a89843f90aa40a16155ce443264d1957954a3decd28e01f93a881753ac00015abc26e35c01d3413fff132", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971137, "uuid": "0ed1fea0-080a-4d97-9ea2-96704e90eec5", "value": "T18E67230BE390AC47D8B6D63407FB1517B9070C50DA83E7276885B07EA8F76E19E19BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971137, "uuid": "b421fb3e-a619-4bc1-8649-01714b6536ce", "value": "393216:9Xtn3vuOBLNGXLaVjNhs5zB6VfUDuI9Dd41YCujXa/izsgJvQ+2uZolGn5AhxZdj:99nmOOeNu5doWsweQJ49Abg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971137, "uuid": "ad0bcea8-4b71-4325-a9c1-398fe78415fa", "value": 31830437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971137, "uuid": "79c3b3bd-279f-4247-856e-1df4b6efa319", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971137, "uuid": "70f2d324-0fb6-4b21-963d-17f7c451296f", "value": "Easy Make Stickers_3.0.0_apkcombo.com.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169beda6-d5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680947125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947125, "uuid": "1dbdae0c-5b4c-485f-aff0-456938e12e73", "comment": "Malware payload (TeamBot)", "value": "b2135c72e06f314d9b7e33c5a5a26b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947125, "uuid": "e8464f45-1cee-4b7d-a072-b3af7a46b797", "comment": "Malware payload (TeamBot)", "value": "1d7fa07ec72df76604ae7aa303dd9ba899cae443f8fca44d1afbdc334b1e0bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947125, "uuid": "f54ab8dd-0519-40cd-8035-885f1a4d01a2", "comment": "Malware payload (TeamBot)", "value": "4c889489c07f811ad29daca10aa854592934269a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947125, "uuid": "e9ec5ba2-61af-4267-a9db-27ef394996c5", "comment": "Malware payload (TeamBot)", "value": "3fe34e445e7ccb3b768ae36d5d8ea841d3e8055a3fb1cd198d5c1d78aac56871f2a1c085b52651395c4b96142669ffc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947125, "uuid": "23215af2-6161-48af-ab01-102fad9363dd", "value": "T11714CF2179E1C4B2D89388798435C6BC6DBEBC519795858F33582FAF2E307C06B7A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947125, "uuid": "5083e32f-ef91-4e2f-81fd-56e0be5ed6a7", "value": "7f2f76766a962f8a0db702cc8033dd98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947125, "uuid": "e300ef84-aee1-4c5b-b660-7e1999f6bb0a", "value": "3072:N3lYvCYKGi+RALJM55au5jrVjNjjq/YBSQTOfLYu451HRkvO2hr:Fev9voA5aWVRi/PQgmHRkXhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680947125, "uuid": "0b6fd9b7-85da-4461-a40c-599c228c5ddc", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680947125, "uuid": "a5ffc018-c812-4ae6-8e95-53da7937d66c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947125, "uuid": "b6006252-9794-4bde-9f51-f1240a9be5cd", "value": "1d7fa07ec72df76604ae7aa303dd9ba899cae443f8fca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19470824-d612-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1680960874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960874, "uuid": "27cefe41-d821-4dbf-b1e6-3ef91f2c079e", "comment": "Malware payload (Stealc)", "value": "63e2e4bcbfdc24365d14f36e6194eae4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55555", "colour": "#5F8B14", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960874, "uuid": "4af2aa5c-fc9b-4424-ad3e-8812b5aeb982", "comment": "Malware payload (Stealc)", "value": "1e24fe84c023466dce90092d685c6887447218659b27f28147784dcb35d7c330", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55555", "colour": "#5F8B14", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960874, "uuid": "4b2b0e1d-4abc-487a-b868-0975c82436df", "comment": "Malware payload (Stealc)", "value": "71ee7c48111ad610ec8d083eb753fc6983c9ffbb", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55555", "colour": "#5F8B14", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960874, "uuid": "46edaa6d-123f-4e7d-bc92-b4e968a93281", "comment": "Malware payload (Stealc)", "value": "fc84c0ba8af99dd52f1dfd9a955fb6886a645e74c12146ee9f1b957cef142486f49e38a32d9b3ca4d67ca8878cafc2ca", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-55555", "colour": "#5F8B14", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960874, "uuid": "ed2803bd-4927-4a71-9351-61456b7c700f", "value": "T186F633BA08CBBC7D51FDD56A356080654B2104988CB8241F0C6EE377F7FA05DB5AABD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960874, "uuid": "c5565c56-c94c-443a-8731-3c94bbd58f7c", "value": "393216:W/GZABqJDMxpVwFisZFzt+k1lNzkGBrzyJD7F349GKL0qb7WdJS6:W/GZABkDMrVwAadWXu9pnKdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680960874, "uuid": "1a5b075c-3477-4c3c-99b4-1a3cffb15b03", "value": 16166030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680960874, "uuid": "faf3a267-2474-4b0c-9789-444bf7f55fc9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960874, "uuid": "73e73247-9d15-4031-ad37-00956d0ff2d3", "value": "Installer_3.64_win64_86.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43468209-d62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680971681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971681, "uuid": "a368dd6e-b4c8-463b-b0d4-597a2640ae35", "comment": "Malware payload (njrat)", "value": "e6915d0e95bca15809953d2db93dde7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971681, "uuid": "fbca0785-1698-49b9-8fe0-f468fd65ff66", "comment": "Malware payload (njrat)", "value": "20a14c4075b30d81d68e679600e83ae166eb660e9fb3e7a78eea5a52564f483d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971681, "uuid": "5cb0e2aa-b46a-453c-8066-cd1e22294fce", "comment": "Malware payload (njrat)", "value": "d091f2375f451d511e0b944f893ccef21070c1c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971681, "uuid": "4e7e8a33-3aa9-4b59-9d30-97eb80b9b639", "comment": "Malware payload (njrat)", "value": "8ec510a3d101aecb574aec405c51098e8619431722e18168c3310a032e5bd03996c403fc960da14296c249571ee049fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971681, "uuid": "7f1bfddd-ef72-45a5-83dc-1a7f80e2bde5", "value": "T1A0B22A0E3FA98866D4AC17748AA59A5003B091470423EF2FCDD550CBAFB76D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971681, "uuid": "95f93596-5751-4e8b-a6db-5a2a27e7ae5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971681, "uuid": "981b3931-cb30-4d07-8b92-6f8caa003efb", "value": "384:yYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZ5j:lwWkti/aeRpcnuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971681, "uuid": "439092e5-4427-4b60-b3fa-5df18589a0f5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971681, "uuid": "52d4e793-ca82-4d98-b28a-a2af3d848a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971681, "uuid": "7eaebff4-a80d-461a-b082-e6bb683627fb", "value": "xC6pU64EX8Sb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088fc12d-d63b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680978455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978455, "uuid": "ede17b07-26d7-4552-8d7f-c455a9ab9169", "comment": "Malware payload", "value": "5a881ee3cba8abdbda6f8584d4b93799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978455, "uuid": "29cc2a48-1691-4c5f-8f3c-098a453769b7", "comment": "Malware payload", "value": "215f6b10529ab1fabb0bdd0c1094980b581cad69228aa1724465ae4942945efe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978455, "uuid": "10adcaef-b844-46e4-aa58-dfd78c2c87f1", "comment": "Malware payload", "value": "0346280120887e57dba1f8a6cccfbdfd6c15e6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978455, "uuid": "61ce514e-b9b3-4b0d-82e5-3759351e806e", "comment": "Malware payload", "value": "c689ce027a53625be52c2ead2a82806c9eb7e4d331db6504482b45deca28a87a6d70306a19e75ad778edf6cf732371bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978455, "uuid": "be21efd1-3695-4da5-b672-672e2367a290", "value": "T109A4225BA6F0D45AF59B3D300F3DA37BA5FC973420660A5B03A4434D7A3B991C90E7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978455, "uuid": "ac4a5df8-f492-41ad-997c-a2d26f2e23c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978455, "uuid": "6b0c8ca8-63a1-41a3-8624-8435ee094067", "value": "12288:vYSUMn8lBKfSFkjvZMs54YTEGs/L4Iz4D/HB:vYSpn8lBIkcHpTEGVDHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978455, "uuid": "640bfab8-c156-42ed-b922-1707e44b1436", "value": 449240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978455, "uuid": "df94baab-438a-4058-b5cb-64a7c89e5e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978455, "uuid": "bdc0385c-b7a7-4898-bac8-fb1f46730f5e", "value": "PO_TOS2304.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8678b1f1-d60d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680958909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958909, "uuid": "55a98ab9-e545-4744-a575-b1b7a210f7e5", "comment": "Malware payload", "value": "549e2bd18cc02a6d3311946905bc0eb5", "object_relation": "md5", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "mekoban", "colour": "#585F63", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958909, "uuid": "0bff7c38-3020-4171-b252-2c5d8de730a8", "comment": "Malware payload", "value": "21a06a37976a7b137003dac057cc1e1ddcab4bf942e8c51216819e195fba3d10", "object_relation": "sha256", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "mekoban", "colour": "#585F63", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958909, "uuid": "cea8b071-a4ee-423d-9627-e0ec0b34b15e", "comment": "Malware payload", "value": "97e6a6ef783ea046adc83e06eea4f772e38da1c9", "object_relation": "sha1", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "mekoban", "colour": "#585F63", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958909, "uuid": "c8ea1af9-8075-47e0-93f0-6085300afb13", "comment": "Malware payload", "value": "c19bf9b2ece3be78251240476164e326c602054bea7f0f3bc8d51a8a3c98956c54d5c0d65eba66de9be5f2e30cb40eb6", "object_relation": "sha3-384", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "mekoban", "colour": "#585F63", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958909, "uuid": "c01b2e54-891c-4ec2-9ccf-6390dbc8d585", "value": "T176761215F3CBC532C15D017BE859FE5F1539BEA3573040E3B6A939AE88F08C166B9A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958909, "uuid": "dc0678fd-f5cf-4af9-b0a0-95045a35e006", "value": "196608:lIKv20ZmJxLsMsW2OekIOzRm6VMHGI5m:lIo25sW2OehQTVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680958909, "uuid": "88972baa-8007-4afe-8dcf-4fd72b175255", "value": 7191552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680958909, "uuid": "c064d5f8-f1d7-4d8a-ad2f-6c20ee1ea25b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958909, "uuid": "75a4ed07-3583-4cbf-a6b4-d7e4f974bac5", "value": "n_f_3_f_1_s_k_4_l.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84631be4-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997131, "uuid": "406daa7a-669e-401b-96a2-64d2c9d6385c", "comment": "Malware payload (Mirai)", "value": "c847bd463101dff4c86093192e41fc6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997131, "uuid": "122fa166-4507-451d-9c5d-59364fb63204", "comment": "Malware payload (Mirai)", "value": "2330f0d55ebf92d859d02aa2f7b991fe6504062d3209f37c90ec4e904d2cb0b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997131, "uuid": "3e170b0b-a73a-45bd-84b7-c1b31f26eaee", "comment": "Malware payload (Mirai)", "value": "35c5621ff9c37980bc5957fa2ac063fa58a61c97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997131, "uuid": "c0c1b3fa-8d0d-4ff8-81d7-514ff49ff610", "comment": "Malware payload (Mirai)", "value": "5a656ae0234efb5395dbb3dddcf519fe869e2ac01c23f147f50d1092b3b42f5008e9a849861588e81ada4e2b4d4f4c88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997131, "uuid": "edb25ba7-3b13-4535-92c1-62f188cbb2b8", "value": "T1DF233A31FA361F13C0C264F461F74F1879A5AADF29A5869A7C712ECABF215C07502EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997131, "uuid": "19393c04-d960-4ec3-b8b9-779d5eaf0315", "value": "768:FDoBjtvg6UQ63yS0S5m8O+lSCOWpwmJh+0V0U8Y8cV:FDGjto6UQ6CSGGtYmfjV048Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997131, "uuid": "5add790f-4642-4f82-9137-ef3a8a9c721c", "value": 47512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997131, "uuid": "132a7676-a0fb-40c2-b98a-732eeb06dc8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997131, "uuid": "6e614ed8-9371-49fa-99d0-bce47887051d", "value": "c847bd463101dff4c86093192e41fc6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480582d5-d5a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680915425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915425, "uuid": "d860072c-3bd6-4db5-baf8-2c0f16c03124", "comment": "Malware payload (Rhadamanthys)", "value": "799f9e421ed6a18c3195ec7df9d7c0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915425, "uuid": "45b991cc-287e-4616-9d1b-80eb4883cc3f", "comment": "Malware payload (Rhadamanthys)", "value": "244df867017dc59ee2e05033ba7a06a1f8cf861c5a9435a84b82e0239775c5b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915425, "uuid": "2a3d2556-bb9c-4f65-b7f3-bcaf3e4681c9", "comment": "Malware payload (Rhadamanthys)", "value": "0eebafdf1e0d6115a9696c9c5d406544f491a19b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915425, "uuid": "0342c65e-bb6a-403f-9190-a96080e2bda2", "comment": "Malware payload (Rhadamanthys)", "value": "058189b10e3fcb2d4ea04194c8210d1dd1971d6f91ad1de3bf79123a0fb0251c4e6713fef0714ef238f274bf4372f96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915425, "uuid": "133629f1-3d23-430c-84d8-9eb48e015ab9", "value": "T15344E11176A2C8B3F45ACC348831DAAB697FBCA19A55428733543F6E3D303C0977A752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915425, "uuid": "9c3c1c01-37f3-456d-b294-84eda1f8de2b", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915425, "uuid": "dca062d2-c74f-4f6b-9eab-1a54a26c258e", "value": "6144:x8635dtevQ2vZYeRZZaTmxIDNs1CWUWWgPkGauV/:x863hS5xXZZ1xf1cWxPkGH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915425, "uuid": "4a15b164-2f25-4dde-bf2e-661328e1d596", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915425, "uuid": "7c8972c6-96e1-4ff6-ae96-7a7bb472d204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915425, "uuid": "5c0a18d1-6deb-4fe1-8a94-8433b0a04e65", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19342418-d5e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680941117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941117, "uuid": "96871a3d-f175-4d54-87f3-50ca188049ff", "comment": "Malware payload (RedLineStealer)", "value": "2b92b8f8a30cc8e1c1f89f84720aecbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941117, "uuid": "a3b1150c-9a4a-408f-b813-16cc3ad70d5e", "comment": "Malware payload (RedLineStealer)", "value": "274dfd3f3ff0da31cb2163147a83b9fa22bc73b271f15f13e0d8c40ed6ab7ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941117, "uuid": "6bd4760f-7e6b-416d-a14e-aa3baeaddbc6", "comment": "Malware payload (RedLineStealer)", "value": "ef9e9b7942cb5f3e1cf5e71fb5ee1901119baa8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941117, "uuid": "03f3dae7-850f-4311-a5e4-3ce7d22de586", "comment": "Malware payload (RedLineStealer)", "value": "db263719017351487a1dbf4e8dd7aa0e4e707bd06410d0bd199ee84922930ad708a2684ba70ff103e3e48a19df3fd799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941117, "uuid": "fe77f038-c97f-46e0-87f8-8a36235131b7", "value": "T149351203BEC298B2D46219361A796B10653DBD205F79CEDFA3D42A5DDE315C0CB31BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941117, "uuid": "b61d0b32-76a0-4618-9284-b25ef318e0d7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941117, "uuid": "b96c395f-3202-4d3a-9b4f-969b68a880ee", "value": "24576:2TbBv5rUyXVM8K14meUWEq+HcReK4FVdsl+By5JPltkJBW8/Qu:IBJ/9Z+eedOw0JQJoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680941117, "uuid": "d0d56fb8-087f-4a6a-9e07-a1f3949baa92", "value": 1140251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680941117, "uuid": "41563b3a-2c9e-4aa8-9b55-819eb3178f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941117, "uuid": "34e4376f-172a-4dac-b8bb-332e0b335d8e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac66dab-d62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680971372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971372, "uuid": "157a78f2-b652-4b4b-9e43-690ebac4cb2f", "comment": "Malware payload (RedLineStealer)", "value": "65aee29ece81bfa94a3c310f1efc4025", "object_relation": "md5", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw SP13", "colour": "#0E8D5B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971372, "uuid": "a3e1ed46-d66e-4ad9-a722-4c4ae603f741", "comment": "Malware payload (RedLineStealer)", "value": "27653a35994185b6578daf3921fb9347f7cdbb2b66a7630890594ecaeaac792f", "object_relation": "sha256", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw SP13", "colour": "#0E8D5B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971372, "uuid": "3ef632d1-b06d-4224-9b23-732e24cc657a", "comment": "Malware payload (RedLineStealer)", "value": "0000296ba1aa10dc029f077a8a38c1b161daa073", "object_relation": "sha1", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw SP13", "colour": "#0E8D5B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971372, "uuid": "81177b82-fedb-445b-bc85-b332803f85ce", "comment": "Malware payload (RedLineStealer)", "value": "4d04999c80c9e7c560735f643f9530752132404d5d35e8858ec7e2c09ab2cc0aee56e87c8ba34086c184c8dac3803857", "object_relation": "sha3-384", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw SP13", "colour": "#0E8D5B", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971372, "uuid": "c5726c73-f575-4f3d-b788-5a31a93c0ea1", "value": "T1201633692B7E75A5F4F265F5178B28E41940D620772B9F760B003E8EF733271C24B62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971372, "uuid": "072aa98f-4f03-42db-8b2c-fefe38bf1f87", "value": "98304:Eq0dsrXhxUQUbtv8U0fd2YRIBUrOrR78O6IpHTIf64omeyU:Z0CrXhfU5vGFB+R7ZDzIomel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971372, "uuid": "03c80bbc-c199-4025-aea3-de55e9c24dcd", "value": 4210764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971372, "uuid": "4a141143-9cd5-47ce-a13b-9ec72b3860e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971372, "uuid": "acb37d32-7d41-4948-87d7-7d36814e2ec3", "value": "SpacePearl_Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4feff7-d5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680914329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914329, "uuid": "2c85803a-ce1a-4df0-b4d3-5289397aa471", "comment": "Malware payload (Smoke Loader)", "value": "fa30f45c22839c65928e682827787e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914329, "uuid": "942864b5-f2eb-4654-940b-599af61950a4", "comment": "Malware payload (Smoke Loader)", "value": "2a780da5c98fd3fc260c3b07bae4fc7581dc35cd3990e43cb3e4697670a8dda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914329, "uuid": "1aafb6c8-aaf1-466f-974a-842ddb24fecd", "comment": "Malware payload (Smoke Loader)", "value": "5228e59fc4e3be945de010013fb0afc73b34f0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914329, "uuid": "dacb6acd-9db4-4025-81fc-1286a1f6ac7e", "comment": "Malware payload (Smoke Loader)", "value": "ab58fe588d97cd41fce8a1042a5b0d1a05f99e43b0b0d8ae2d244e5d7f8739e670b0e144696c2ccc2dae8626f9e06c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914329, "uuid": "085a787e-0674-4170-bba2-fbdfaff52e2c", "value": "T1F314D022BEE1C073D997817044E4EAF4EABFB8519794868B23147B6F3D703D1862B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914329, "uuid": "8b40b49a-9d65-4d27-8199-b602aaa9e48a", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914329, "uuid": "bd5f1c0a-7056-4014-82dd-29c28aa49fbd", "value": "3072:WUlOPY7wb+NxHtZtFjZ1IV0jzZpi6zireDFZ07TP051dHvo9:pYWHtZtB4V0zZpZDTyTgdHv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914329, "uuid": "32f17bec-6a9e-477a-bb1b-3675f403f365", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914329, "uuid": "e169196d-f413-46dd-9d83-1b1c0b07e873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914329, "uuid": "19474049-3bbf-4bdd-ad00-9194c3a678e6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977101e3-d62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Harly)", "timestamp": 1680971823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971823, "uuid": "292b7919-d3db-4a8f-8f13-b2906255dffc", "comment": "Malware payload (Harly)", "value": "bae760f6f41071d6607d215262cadd2b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971823, "uuid": "71ff2d0b-842c-410d-b0fc-9b5790167994", "comment": "Malware payload (Harly)", "value": "2b44a106dc5ace546ffca7e9d2baf52326894e2ed3f5714115f72c6e45c6bc49", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971823, "uuid": "c703efe9-35c0-4c62-a05a-653e05f2f799", "comment": "Malware payload (Harly)", "value": "8bb220eddbd6a7ec5b69ff598ec5f966be49bf0a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971823, "uuid": "f0e3aeeb-fba1-4bb5-87f9-5a1c07e97b67", "comment": "Malware payload (Harly)", "value": "6be8cde6209d95141a0a920a01e74306bbb3d7b97d8c4c210efc834c2cb2ab4b37c5d2815724aac736ff362ad2b00a4c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "harly", "colour": "#DDAF41", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971823, "uuid": "d133d791-642d-4884-bdbc-72161769bebb", "value": "T125772357E39496AEC4F343724E3A2272421B4C35AB8397976838733C16B79E80B5DBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971823, "uuid": "c93364e1-b0ed-46c0-8b1d-eb3f5d2f399e", "value": "786432:9JyNcfAqB3U+IZa8UWgcwBpS5Ye4CKoflTMqaLN5QnHHA9vzuun3Pb6g:WN2AqNyadWlbYeJKeTahmAhuun3Pb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971823, "uuid": "83d16575-b473-404a-aeb3-6732dd7cb2c5", "value": 35568912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971823, "uuid": "4307044b-78bb-49b9-81f8-2f077fd30275", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971823, "uuid": "3fc37138-33cb-46ac-bda9-fa1ca99c3341", "value": "Lion Voice Changer_2.0.1_Apkpure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab7c68a-d63b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680978485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978485, "uuid": "498178d0-352f-48f8-93a0-d3d9af114791", "comment": "Malware payload", "value": "b74a162efe4f52f43cc67d126c2f8d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978485, "uuid": "ea0bfb85-e2a2-4012-bb6e-6d3f65787dae", "comment": "Malware payload", "value": "2bc4b7908e49fb1b4bcee9fd51702a318423945423b88ce55dd28ef949e2ed27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978485, "uuid": "05291976-eae9-47a0-9400-f46bf321f951", "comment": "Malware payload", "value": "f01917d3ac9397cf878d389b34da3d738894b627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978485, "uuid": "f3417c22-98b8-4c8f-bfdc-50551113d9ae", "comment": "Malware payload", "value": "2cf517d0126c8558ca7bd9d16943c2f9839c41f9d87754f64221d1f40280ced4a8ad6ce1c8afdc092cdb56a985523ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978485, "uuid": "9e38c027-c002-4509-81ef-392cad249be7", "value": "T18B35CFD46AD68BC4C037B130F059CBF2C3D21529E09ADBE1389B5986E1D2E511CFA9BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978485, "uuid": "4728ba97-28a6-46a0-b851-72fe10d61931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978485, "uuid": "aa2a6f91-4c04-4b8e-8aa6-66f0597bd516", "value": "24576:q1ChsCThcQJJTrYJlLs+vjKBUbgh5jBcxG:qwyClcOJTEJNgVFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978485, "uuid": "67880e4f-5840-4b30-adeb-2dc350337659", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978485, "uuid": "3968ee5d-ff24-4b6f-a560-43477a55d543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978485, "uuid": "02fe10ec-158a-4966-9f27-03e7ca8ba1ab", "value": "Ship particular.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129c65b6-d63a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680978042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978042, "uuid": "64da077a-0025-40d6-9211-2db6045149ca", "comment": "Malware payload (RedLineStealer)", "value": "f3eeca6aa9f46483ab7d3a024bada72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978042, "uuid": "5e1f7abb-30f2-4086-b490-cf6b9b7619a2", "comment": "Malware payload (RedLineStealer)", "value": "2d125c4b3bfa149c43d524e8931140142096fc7a96c119cab15c9b3dc558a8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978042, "uuid": "c3b2634f-0744-4d38-84a6-da7db400f9db", "comment": "Malware payload (RedLineStealer)", "value": "403276188d3dbdb6a87d866c1df8bb3a443e07e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978042, "uuid": "c0feaf54-7919-4828-b03c-735e2b3caba3", "comment": "Malware payload (RedLineStealer)", "value": "76beac4c0bc3027e1b8be10b9606e99bf3823662baf6650dda39b705d0a8801bf210a3c048e4de817d1a2446b8d43ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978042, "uuid": "dc28553a-9a00-4a98-ac5c-9a727d181996", "value": "T1AA352357BAE86433EAB417B11CFF03930B397CA55D78835B2289D6170C32B5964387AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978042, "uuid": "14ea6dec-d92c-473d-bbe6-f6a06cff3448", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978042, "uuid": "d18fec54-6764-4117-971e-53182038c04f", "value": "24576:Zy2VVaU5q6XArL4IJaL8XbVaD/gQGJ7jflLcEn8z:M2VVaUpAf4IJdXlLtLrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978042, "uuid": "c4eca739-72da-4cf5-baa1-ab4137fd1893", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978042, "uuid": "50a711c3-5164-4780-93ca-fa2f3e0b9f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978042, "uuid": "6f2781c6-0689-4bd4-b5a7-ce5823572aac", "value": "f3eeca6aa9f46483ab7d3a024bada72e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b51e5f-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680964782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964782, "uuid": "255148ba-2139-4e7b-8a14-c43b45c90b79", "comment": "Malware payload (Smoke Loader)", "value": "c5e281db1afc7b2c38c548d6b489ec83", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964782, "uuid": "7885fbc9-9ffd-46c0-ac9f-02926ee90d1c", "comment": "Malware payload (Smoke Loader)", "value": "2d945517a164add6964b06e18322a82c800d5f57b7209b24a8e209ee9204c188", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964782, "uuid": "535a1fb5-7524-48b0-802a-c4d93ee6619f", "comment": "Malware payload (Smoke Loader)", "value": "7fa0dd75f3b20f5fa21f5de02a350a086b7331cf", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964782, "uuid": "3b45a628-508b-4c9a-b94f-62f19f9d4030", "comment": "Malware payload (Smoke Loader)", "value": "4be6d721dfa77de7a8892cdfdd221e8b632a8625200dcfd99e93bd28c67a78b37f42fa15ca45c82a08d57a84b1af1a68", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964782, "uuid": "8be52c9a-3f6c-43b5-911f-406320aab465", "value": "T17D14CF207AD1C8B2E81785749829C5F0763EFC628B95D9BB73883F6F3C316815AB6711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964782, "uuid": "51fd9776-bf86-40d6-a6c8-59845e7f861f", "value": "0c473655039a754e9f814d9a583e5330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964782, "uuid": "c2028853-7d63-4382-8699-6d3a1501b6ec", "value": "3072:HKbANa/zcbGs1LHMaKN57xXNaSB8swwJ5WG9msTM:iA+zcCwHMakBvaSBSG9fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964782, "uuid": "a3fa3783-318e-4e7e-8ba4-c2e9c574dc20", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964782, "uuid": "fffcf6c0-f54b-4019-b904-3a2d1c2388bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964782, "uuid": "207d6df3-f17d-4936-a10d-438040ea4963", "value": "c5e281db1afc7b2c38c548d6b489ec83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fe88df-d617-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680963388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680963388, "uuid": "6b94dbc0-94ef-412f-b2eb-c069abd1a2f0", "comment": "Malware payload (RecordBreaker)", "value": "f4bd1e75f61bed751f8afd83f5d701a7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680963388, "uuid": "b5c3453b-f84e-4a4f-98e4-e8d22f7c6251", "comment": "Malware payload (RecordBreaker)", "value": "314388dedf53c8e12d1aed3f8c6966cba875bf25ab951b4e95939c4d95913091", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680963388, "uuid": "1c156290-2d91-45d2-b87f-ecf6c60c9892", "comment": "Malware payload (RecordBreaker)", "value": "e0e883c6f75eb415d283a655597dcfa9889a9556", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680963388, "uuid": "c567951a-3948-4365-a26a-48be1923c4ee", "comment": "Malware payload (RecordBreaker)", "value": "17c9fba48b4d5b38e6884aa153703c8406bcf4b8c8669a4aefe117cb624d6067c7bd1aa7cdea75b83b6168214eaeec44", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680963388, "uuid": "87b7f255-5ddd-4175-be4f-d5e017378c27", "value": "T19977338DC5E05EE6FC58FA04A1273B42B16D68ED3F4F2E31511A658CF4B99A4B4EC4E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680963388, "uuid": "717e5588-f607-446a-abc1-567b5ced3f31", "value": "786432:30QV1q4aZ4ekXVFiUOjA/zF4m2N6RgoYNX7ovrIHxFo9kSoWfVgAj:EQV1FW4ekzOjorWIeLy8MPNlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680963388, "uuid": "42e8426c-b586-463a-b5e2-8a833b283376", "value": 32935364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680963388, "uuid": "2feb8d77-b238-460a-8698-75cdac18c9c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680963388, "uuid": "0766cb6f-5888-44f5-9df2-b322b070ea5d", "value": "222555.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4f373b-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959701, "uuid": "1a5660d5-a301-4f9f-81a8-596b6ab17715", "comment": "Malware payload (SnakeKeylogger)", "value": "912e23ebb877a4015a27ba96c9e4f3de", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959701, "uuid": "abf820ec-c453-423f-97cc-83315fd59ded", "comment": "Malware payload (SnakeKeylogger)", "value": "31a72a10b075efeff221db46524d61ea229f3c650ddc793d5403efb3801aad56", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959701, "uuid": "74f19811-2109-45fb-a58a-f066a2d41d37", "comment": "Malware payload (SnakeKeylogger)", "value": "a3a750a50a44611b48664358c6451a43e75733cc", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959701, "uuid": "714f53f8-5f8d-4312-84e6-6a5cfdf73699", "comment": "Malware payload (SnakeKeylogger)", "value": "bdaf297703f955d29ae2d3f5d849f248a3ee4614acbccdb67865cdb2b5ba5af8830f78efb880d4befcfd19c1c5b0cdd0", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959701, "uuid": "e74ccccd-a3d0-435f-9985-f1e371e9a0f2", "value": "T112C412493359563BCA7D0AFE9122210983769576B607D3DF1CCCA8FA25E3B908816FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959701, "uuid": "fb31528d-d5fa-424d-ae5a-d143194d2fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959701, "uuid": "6cecc656-b10c-45db-a9a3-286e21a56ffa", "value": "12288:WEtzLwrQiWdv1hqbVKVxEeIBtY190DHfOqYR3Svv8LE+o2QREe:8Uvq0YrtYQbIyuJoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959701, "uuid": "ee97c5ee-af73-4fc3-8e52-7c2fdb1528fc", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959701, "uuid": "c9d7a512-fe3c-403a-accb-bcf359ddb88e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959701, "uuid": "a1c18e04-94b8-4879-9092-3945468edfd1", "value": "Confirmaci\u00f3n de recibo de transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70b5c53-d621-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680967661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967661, "uuid": "40c17bfe-d00a-48da-a9ba-bb6992b47e85", "comment": "Malware payload (Amadey)", "value": "b5513b4a32d7812604c4f13356141e00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967661, "uuid": "0111f72b-2862-4284-9047-948a457e6e5c", "comment": "Malware payload (Amadey)", "value": "31ac76457a722b4ac51200a5753d18cd38574eb4ac493b4f09d5bc2d23e3490c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967661, "uuid": "1708d844-5900-4c44-beda-81c18fc43946", "comment": "Malware payload (Amadey)", "value": "770776252d9481d21f532094440f6fd14c835bae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967661, "uuid": "e4d88ec1-9a12-4d03-b3f2-8703983b913b", "comment": "Malware payload (Amadey)", "value": "bdeb38850c73ce0d178c4ed20c609117fa7e97f384371de5b09ccf9f54befee28c635aa392754164aa19a742952d9a5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967661, "uuid": "75bd15e3-d4bb-4d3c-ac8d-9689f9645c74", "value": "T13414CF12BAE1C0B3D46749744064C6E8663ABC93A77C998763583BAF3D337E14A76343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967661, "uuid": "f12031d6-a213-4514-925e-45a9f7600a03", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967661, "uuid": "1e4b5b19-27de-431c-b0be-448544306745", "value": "3072:jVbp6RuJXygYkPTCQppYXE59XAVK94Bxs7E7YC5rRcadR:htJXySrfp+XEbXAVZs7ErRca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680967661, "uuid": "5ce481d2-8de7-4fc0-93f3-11465b65b261", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680967661, "uuid": "4807b39c-0fb5-4e27-85a9-bf592e111301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967661, "uuid": "21e35b1d-5348-4026-a7f4-1a4e1fc9562f", "value": "b5513b4a32d7812604c4f13356141e00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e6170-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959693, "uuid": "b0e3fdbf-2f68-45d6-910d-dca4fc28cf43", "comment": "Malware payload (SnakeKeylogger)", "value": "a96a1bded7a84eeb505ab62e51b1549d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959693, "uuid": "f5e5e942-d4ff-4ad4-8221-ead7a33c03cb", "comment": "Malware payload (SnakeKeylogger)", "value": "3446602893829f57687ab3fd132821036d66df46c132b79802b279d3ef79b737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959693, "uuid": "0cf6a010-1b30-4a2d-8b99-493ea571f0be", "comment": "Malware payload (SnakeKeylogger)", "value": "e6a58938c9be2ff2e8a11393df66d1d249a16112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959693, "uuid": "81d43752-556e-4982-9602-2764bd977589", "comment": "Malware payload (SnakeKeylogger)", "value": "0f443e12c2a892cb7b9f799e9b1423c3f813814508375faab3e2daf9c34f7517ccc107f189dd290358dd20c996bb1ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959693, "uuid": "a67bf3a4-c606-4769-972a-dc18971720c9", "value": "T11B25AFC476D58BD0C037B075B04ACAB3C7D2092AE089DAF138DB658695D2E525CF68EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959693, "uuid": "481b97d4-fd64-4890-9a3b-a525335ac737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959693, "uuid": "7fdc1860-085c-4a79-97dd-12a1fbf2079d", "value": "24576:C1QhklU0YNnVAVMuXvsIjjG7CigvfG54a:Ce0YNnYG7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959693, "uuid": "934e57de-ac75-497e-86ea-84e1d26385fa", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959693, "uuid": "787e4fe7-5f68-45c1-bea5-430613deb813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959693, "uuid": "46b04cfb-338f-4abc-a48c-b5a0ac269af8", "value": "List2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31b1848-d615-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1680962447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962447, "uuid": "87e80cd8-7fdf-4f21-871a-fdaca5d0251b", "comment": "Malware payload (NetWire)", "value": "58d02ed4bc010363facf162ac2976905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962447, "uuid": "96640a9e-f21a-421f-b533-41163a353e32", "comment": "Malware payload (NetWire)", "value": "3647bace25f94430a534aba8aba08a731571ab2ab22f95ac209096e2c32ef81c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962447, "uuid": "bedfb230-2dab-4870-b906-9c8eb63bfb80", "comment": "Malware payload (NetWire)", "value": "0fdbd386a4cd8ac2edbd32a32a2fd5e8263bc38c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962447, "uuid": "c2fb469f-eeff-4f6c-b766-07880930daea", "comment": "Malware payload (NetWire)", "value": "0c72f7058dbde4c370a598d0bd0acaf031b8533f015c2cec91de2585f969e1df269f1869fd93cda1c50ad6ecd61760f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962447, "uuid": "85e7937f-ac72-45b9-86f1-9bfb95437c1c", "value": "T14AD3A419E66BD0F9FD472C7480DFF26F46386D00C534CF62DF953E02DA27921A129AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962447, "uuid": "c9795485-1532-41d7-8aa1-9cb4f940cd88", "value": "4e6ba17721530f6e9a509b1380c99995", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962447, "uuid": "4134c5a7-bdf8-4de9-bf10-d7ff6169e4ba", "value": "1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rw75ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rKZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680962447, "uuid": "02e22d74-affd-4a96-91f9-0007357d638e", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680962447, "uuid": "eb8cccd3-9200-4b38-99ae-b231d86a7a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962447, "uuid": "1b46f836-9f2e-4dac-98a3-81df96538af4", "value": "3647BACE25F94430A534ABA8ABA08A731571AB2AB22F9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dc325e-d632-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680974744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974744, "uuid": "bb1739a4-f830-40ab-bfaf-094ea5ae03c8", "comment": "Malware payload (RedLineStealer)", "value": "b5cd0d2cd6dc1c087a84a9f09db3cbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974744, "uuid": "b1e05fb6-3400-4c98-b05e-bc773611aae9", "comment": "Malware payload (RedLineStealer)", "value": "3661ef5a90efea60e4b63317cc2217f43710e41dcfc344131d1c0f3af8dcc7a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974744, "uuid": "55e33612-e0d1-4c13-9833-3350abd6ae25", "comment": "Malware payload (RedLineStealer)", "value": "92ee3fbcf7fe6777b1c03272416e12b5842228e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974744, "uuid": "c17cf766-7624-43ee-90d9-3be40fd6eed5", "comment": "Malware payload (RedLineStealer)", "value": "6c96a1a6cb58aeacce46b5dc5d87cda995900e651f835995b222f5bea1d3c1a26360ea0cc7e7a37aa46d2b2b8d7da89f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974744, "uuid": "93f15472-47a4-4810-9695-d711acbfcb1a", "value": "T1E01523179AD88177E8B407B05DF602571F3ABC10AD7583BA23E2654E0C73A55B8363BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974744, "uuid": "22c21417-3447-41b9-a835-cab954417b4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974744, "uuid": "33940544-1787-4303-9a32-8621c258acb8", "value": "24576:gypy1t3R32n/q0HuMeUD/lHK0JyHAYwNodk:npythGn/qWuCvyHAYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680974744, "uuid": "f0bc69d7-90cc-456b-8970-68016651d246", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680974744, "uuid": "5ecb118c-4316-4bd9-8686-9e035824d444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974744, "uuid": "822a8a8b-b37d-4896-a305-aa440880c594", "value": "b5cd0d2cd6dc1c087a84a9f09db3cbae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ac74c5-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680976596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976596, "uuid": "393b3754-c25c-417e-a572-20d42ed6c161", "comment": "Malware payload (AsyncRAT)", "value": "15812c269dcb051b5b23a540696d5288", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976596, "uuid": "861b625b-b386-4618-ad07-efdc54e1e9a6", "comment": "Malware payload (AsyncRAT)", "value": "3702de50af26c3d4288bb4c9c4bde0f0bb0cd98873393b4e38394c6848fad039", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976596, "uuid": "87bde625-732c-45a4-9707-196d2c0f1367", "comment": "Malware payload (AsyncRAT)", "value": "db261e59e91e57ec14f45798bde865c01482ec15", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976596, "uuid": "09882184-addd-4441-848c-2672caf7e2da", "comment": "Malware payload (AsyncRAT)", "value": "bfddb203c79643066b5eb23f8863d6d5fc9ee43626d291d7a3771ced4deb5fad31d497161f9ed597cda6ba4cb71777a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976596, "uuid": "bd7dabf3-991e-44be-9a73-531618551748", "value": "T1EF236C4037D88136F2BD4BB4ADF3A6418679D2676903CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976596, "uuid": "77dd3b6c-28fb-4a4c-84d3-6666ba831321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976596, "uuid": "39fe90ee-e4d5-4b70-938b-5bd0756ed8cb", "value": "768:xOduRtILkWAA+jiFtelDSN+iV08YbygeiCPdYPy22pvEgK/JLZVc6KN:8duNoFtKDs4zb1omJ2pnkJLZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976596, "uuid": "fa03780f-99a1-4551-a451-84dce1715578", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976596, "uuid": "e627c08a-6366-46e5-866d-f48291f11441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976596, "uuid": "3855fb7b-90b7-40e9-b050-a1702d99b757", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6848dd6-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680965003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965003, "uuid": "550d165e-85b3-483e-80a8-c57802cfcbf4", "comment": "Malware payload (zgRAT)", "value": "0e6334f3895d668dc2eca3a74e015624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965003, "uuid": "c92a3a63-033d-4302-9e94-496b23ee0979", "comment": "Malware payload (zgRAT)", "value": "38bdcae9e27d094752bd095c32f2b5143a47a9ad9837139837193fb54163b9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965003, "uuid": "09edeb5b-0385-4197-94b1-71521c3624f6", "comment": "Malware payload (zgRAT)", "value": "4dafd0c1e75ba9518a8199d82cc22e93d7d24e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965003, "uuid": "6697f873-38e3-4d9b-b589-da9f7f3d96bf", "comment": "Malware payload (zgRAT)", "value": "4300f67bb2446123944f058c5b49b1d8035276053d6adc73eda077639d4be4502848ee06c473fbc0ecde798b99191fdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965003, "uuid": "c2e561d6-9c06-4a64-b48e-f5e45a7f7e57", "value": "T1AEA66C23B7A5DE62D6BE5733D6E521080FF0F8536312D60D308D23AA6FA37624916763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965003, "uuid": "bc572c37-32de-4765-a2ee-7ee19d1d1c5e", "value": "49152:9qphNGSt9cA25UrYlvlbLO6VDfe1+uff5GBnRSCST/SxU+EPSIN+eS1Tfj0dxilD:jgD25UrYXbyj1vfGRjq/Ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965003, "uuid": "33997923-29d0-4db7-b4b6-96dd3051c673", "value": 9955840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965003, "uuid": "819c8f6a-b1af-47ca-bfcb-b4df99bd95b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965003, "uuid": "d18264cc-2641-4dde-899f-5fc9343931a6", "value": "0e6334f3895d668dc2eca3a74e015624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13df715a-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680965159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965159, "uuid": "f3822e1b-a0f2-44ae-bb5c-51f5a2e8ac0e", "comment": "Malware payload (Smoke Loader)", "value": "9c994081087ba08cadce7d8d323b6bdc", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965159, "uuid": "24c2dc07-4977-49e1-9ab9-5d40f8358c43", "comment": "Malware payload (Smoke Loader)", "value": "3ab4f041abd53fecc70c291ad0793bd4444f46737f11e1cc2ac299b4a7cb3530", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965159, "uuid": "d4a8551e-22c7-4454-a257-3966399a3bf6", "comment": "Malware payload (Smoke Loader)", "value": "6716c941e677457ef74d9d895bd771e4a89c4295", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965159, "uuid": "b9d8cfbb-a9ac-40bf-93b4-31fe464b1617", "comment": "Malware payload (Smoke Loader)", "value": "180e75ee6d22b10172e89045944afd0d2cb939ed933e2c61ace8bb3fcbc15283392da165927ef19d875e2ba41bb87397", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965159, "uuid": "dcab9816-8130-45db-aa09-baf645c7a579", "value": "T15214C0317AE0C472D7B788356470DAA4B97ABCB19B94828B23583B3F2D312C05F76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965159, "uuid": "b9ad5c05-5716-4094-be62-b5b69df1b681", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965159, "uuid": "b660eb26-2dc3-4b14-b8f6-a0654e9c82b2", "value": "3072:iGxsJceBg6dWpRGqC7q2P98K+1buhTJwB0cnqC5rRNGlGRl:9CB1gCOM91Hh96BRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965159, "uuid": "e6e9a353-80c3-4da8-a5fe-b849edc6cc85", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965159, "uuid": "ca3b451e-2991-4f1e-aebd-f7d03ab73f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965159, "uuid": "bb1e1304-a073-4bed-a1cd-bb989a8eff75", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870bd2a7-d5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680914672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914672, "uuid": "7339a91f-7b40-48cd-b400-5526c82c77b4", "comment": "Malware payload (Amadey)", "value": "0da48f813dab2479228bec25f37e7df9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914672, "uuid": "9981137a-b820-418c-9a3f-0d9c1351ab67", "comment": "Malware payload (Amadey)", "value": "3c5aecd6a2e3b0699df8b04e5bc904733af2646f70f14241d7378c86faedbe16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914672, "uuid": "3ed286b6-01d2-4197-886f-f3ff7f853128", "comment": "Malware payload (Amadey)", "value": "d27ad40b1cda4bb2cc177561ce93f3d82107b803", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914672, "uuid": "f7ed7972-5f37-4b43-9fef-82ac796a7070", "comment": "Malware payload (Amadey)", "value": "b2fd4ead760bea6f9066e0e77583e8104c9437ffe9f6f526fc02c1fac68206b052a82d1daff1b855b0e9af897564b172", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914672, "uuid": "9655293d-7e3e-45e9-91ec-4ee1fb1177ed", "value": "T18814CF21BAE1C4B2D89744748430C7E46A3EBCA157958587F3142FAF2EB13C14BFA766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914672, "uuid": "61bc201f-679b-457c-bc42-ff8f5243230c", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914672, "uuid": "50acce5c-d2c8-44a9-934b-c26e51c10aa0", "value": "3072:uHSJXtass+T82C88QeFcSStkJJ+nFG2ML/UXvArjRsDJ9cP51VmI:uyug82xhPyYF1OsXvArWkVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914672, "uuid": "bafd57d4-845c-4d1e-be72-1e0c905c9325", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914672, "uuid": "42ebf212-319e-4c77-9bfd-fb87d84e861b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914672, "uuid": "a4c42cc8-2fe2-4a11-8341-31f32577be73", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f624ba94-d5f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680950077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950077, "uuid": "52af19fd-6a44-4c3b-bcf0-8546b23d9e83", "comment": "Malware payload (Amadey)", "value": "1316bbd4926b8f92c9e2dbb8a33a5f5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950077, "uuid": "efacebb7-5369-4414-b90a-eef0c8e6a2c8", "comment": "Malware payload (Amadey)", "value": "3ce59f4740e06e135b214f2345f4ca167586b83aa2afdfbb4ade797d90e5c85d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950077, "uuid": "bbeeeef7-ff5c-4ca9-aa42-f2d58520370f", "comment": "Malware payload (Amadey)", "value": "1fa065832dd70ecb8b90d498983dfb8d6b4c76bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950077, "uuid": "20fc29a7-0023-40de-8b47-b6e8b09b55b4", "comment": "Malware payload (Amadey)", "value": "2002ac9be6b0627b40507811c38babbafc1fe6e0fcc63fef4cc4a4c86025e88dabbfbe2d2908daea176276e7e09bd255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950077, "uuid": "7f1379ef-ef9a-4e4d-abb3-39cb031be04f", "value": "T10D152352BBD89432E9F027F46DF2069757387C60847C8BA73246CE5A5C71284B63A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950077, "uuid": "b2849a85-40f5-4d25-944a-f432d29f8ce0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950077, "uuid": "70e7dc97-cc8b-49e4-85e1-a82cebb13360", "value": "24576:0yERc/eThcva4t+o5kSs7bb29v2hRuK+Y9gMFg6:DERc/q0t75kSxt2hYK+3Mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680950077, "uuid": "7cb2a820-b39b-4e17-a1d2-7f0534d9e965", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680950077, "uuid": "91670eee-995f-4473-9aae-7e43d0a7173e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950077, "uuid": "7dc1675a-df14-4257-abfa-7de75514582f", "value": "1316bbd4926b8f92c9e2dbb8a33a5f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f23379-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994231, "uuid": "eae07f7d-e51d-49e9-8375-5300e1d49b5b", "comment": "Malware payload", "value": "2cae9126c08786f93de4e92fc628d244", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994231, "uuid": "bf21d1d5-4fa4-474a-95ea-0b7fa98e073a", "comment": "Malware payload", "value": "3ed40842474da5d2bfcaa9f66c2b76a498f0300bc0d7ca421e84ea308b22e5eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994231, "uuid": "80fc1103-ccd1-482c-aa8c-1f8a6fae93fa", "comment": "Malware payload", "value": "faf01632d9c50a465a53c4b93b1a7e26020cb96a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994231, "uuid": "bb06a5ae-77e7-4e28-8baa-11c63e48817b", "comment": "Malware payload", "value": "a40e791d5143b7a074a87fa504e5f09b246e899dcf1a35f255f892f32bc92a57586cd1639845263c20ffe83727b46708", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994231, "uuid": "b53a8b7f-8d35-422b-96a1-bb75f60620b1", "value": "T132E34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994231, "uuid": "a5f8fb47-a23c-4fc8-9994-5504c6787fb4", "value": "3072:Ib2NQviuoSKTe1a83P0eBCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a61BCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994231, "uuid": "905861db-c438-43ad-aa89-82a211098065", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994231, "uuid": "bfbd7fe8-1d15-4143-a7c1-94c165fd58fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994231, "uuid": "82108c36-895d-46d5-a27b-73830f377f9b", "value": "2cae9126c08786f93de4e92fc628d244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546e892e-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993615, "uuid": "5ddd3771-6b97-49d9-9a60-dc62fbab8ab6", "comment": "Malware payload (Mirai)", "value": "ed9d1a60acb0c105697eb1b7a532f6c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993615, "uuid": "4a6061c4-2730-40f3-8b94-058a9142cc31", "comment": "Malware payload (Mirai)", "value": "3f3a41837e9ac7b7c571150e0c291d4181494ffd6a80af3759b702b4871759f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993615, "uuid": "8ba0132b-ee0a-4ff0-9b3a-bee03dd46471", "comment": "Malware payload (Mirai)", "value": "6e754fedba836dd2ce13b086f04555b94441991d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993615, "uuid": "07673f83-4e4a-4602-a0a1-7c3a35a7e415", "comment": "Malware payload (Mirai)", "value": "a52f414ddd368dac929d73840403e271f0148a27dcb6d95577ca8bf3dfad129401aa374924ae5cacc9516ce037a3c1c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993615, "uuid": "ff317754-60da-4421-acc7-266fecbcd3c4", "value": "T18A335BC9F643C5F6ED930571203BEB379E71E1F81228E953D7B8A931AC53941A612B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993615, "uuid": "af5f869a-9d6d-4f6c-91bb-7460c1b9f41e", "value": "1536:XAA39LP1Ry7/OZPSHWhIEC6tPG51GWcRsAYWiozXSg0:XAA39Dry7/QSlstCAc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993615, "uuid": "f1a921ee-0680-44bb-aee8-efd02538cbb3", "value": 51024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993615, "uuid": "62a86eba-c5c4-41cd-b03c-404ad191d631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993615, "uuid": "59155c98-6bc4-430a-8d07-f364752cf104", "value": "ed9d1a60acb0c105697eb1b7a532f6c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d03d79-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1680964898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964898, "uuid": "1b282d3b-02a9-4512-8aab-cfd2ca87fdc2", "comment": "Malware payload (RaccoonStealer)", "value": "4036065246d9a62e15606106f620c712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964898, "uuid": "538c33c9-0bda-4483-903a-a2e491da571a", "comment": "Malware payload (RaccoonStealer)", "value": "409747792b09506248cd3e8914f6d8f2802dff0c287fe4385d3940bbdda4af74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964898, "uuid": "d312f4b6-1fe3-4a70-848f-a2d4edd9914f", "comment": "Malware payload (RaccoonStealer)", "value": "30b6106c498916d2869ee834235f36c8ea208901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964898, "uuid": "77902b4b-2e08-45ab-b5d8-eae13a9ebc4a", "comment": "Malware payload (RaccoonStealer)", "value": "9626ad065102e922dd9db83f82f16d780e03d6b1e20ea521924d1212504f33c4418cb94fcc6762133f372d7b508a8e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964898, "uuid": "556e95aa-4902-4362-a574-0b9d4caa42d2", "value": "T19F56237316980254E1E9CD36C927BD9532F6477B9A80AC3DD8EB6EC326229D1F307493", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964898, "uuid": "14578659-92ad-491f-8451-2c3d865e6323", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964898, "uuid": "4c7c3068-c5d8-41b0-baa6-7c1505bbf658", "value": "196608:o67KVuzKhW9FSHGTP41JWDSUkUpC0dGVmeDh:fKVu+GWPUkwC0dG8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964898, "uuid": "e64bce63-d4a6-447f-a54f-6e5a788479dd", "value": 6334464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964898, "uuid": "c6b6e34a-ae62-4d24-8827-7eb4d6ce5b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964898, "uuid": "2e6e61f5-5275-406a-a4fc-2e5d5721124e", "value": "4036065246d9a62e15606106f620c712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1902d56-d621-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680967679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967679, "uuid": "a8626bc3-824b-4320-912b-5cbc04437ca0", "comment": "Malware payload (Amadey)", "value": "706449ce8db2a90b7e16a59ee8efc2ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967679, "uuid": "5df47dc2-b39b-4a41-a704-01921da5ffb3", "comment": "Malware payload (Amadey)", "value": "413077cd3d7ea70a8fd41233059bcb09770d2519de529d0b10d8c7cc230a67d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967679, "uuid": "df8fa51d-569a-4b4d-a95c-7ec41bd64c79", "comment": "Malware payload (Amadey)", "value": "07a78d27fc648961870f66ac3f275427a36169cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967679, "uuid": "c43aa1db-5a9f-4379-85be-8b7578316019", "comment": "Malware payload (Amadey)", "value": "49e64d3f4cd84db57ed4d8afb8d10a9b2bc07bcf6b924a406971be0a7c5284d1d916d8a11ff698917c57307f1e4832fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967679, "uuid": "cfbc3b80-c397-4726-ae94-5995cffe428b", "value": "T170652303ABCD8175ECB61B7458F607431B76BC240EB0031B639BD9461CB3699BD793AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967679, "uuid": "c3f8797f-288e-4788-8304-de6daacb6eea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967679, "uuid": "407c0537-50c7-433b-8e7a-78a94018ad48", "value": "24576:YygwK2sFisSf8Yx84m0IYCqrODzCqVUSAdx7lpD2qIzIIxUWaAZ:fgasFDSUIHm0FUnVax7r2VEIx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680967679, "uuid": "26d7a44d-13f4-4d93-aa3d-403ff2d8fc6e", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680967679, "uuid": "addf39b6-0084-41b9-806e-751d164d9cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967679, "uuid": "3f16c1be-e2d8-453b-947b-128adeedb8c1", "value": "706449ce8db2a90b7e16a59ee8efc2ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a875ef20-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680965409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965409, "uuid": "1cc54412-ee13-4d42-9065-20de855fcb10", "comment": "Malware payload (RedLineStealer)", "value": "3dfaa6be57de6dfe84ad2bbfbf3eaa17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965409, "uuid": "2dee8797-cb1b-48ac-a8ef-ff9196b43c3d", "comment": "Malware payload (RedLineStealer)", "value": "41e2a5ca769250d31a78660c906f7959c8d85c7e30015be7a4774aef515090b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965409, "uuid": "fffd5dc9-fcf8-42ae-8dfe-d8b5edf014aa", "comment": "Malware payload (RedLineStealer)", "value": "d06c7aacfa9aa52772d8a458d889d8e5e08f382a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965409, "uuid": "043e947a-2c9b-4f65-91ae-d2456dd38bdf", "comment": "Malware payload (RedLineStealer)", "value": "ac0bc402391641fad5fcd0393eae31a9f322e933ed44d19137ab96c0c13db0f2be284a0a5bf0816bf7cbe81aef0bd795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965409, "uuid": "78144d9e-17a7-4be4-b07e-8e362f27f608", "value": "T14064F212BBD1C073E85245355471CBA4AE3EBC60D25683A7236C2BAF7E303C15A7E766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965409, "uuid": "0ef0106c-df6a-4ca4-ac29-a52b1ace50f6", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965409, "uuid": "0ab280de-66d3-44c6-bfd9-35cfc107bce2", "value": "6144:GHhaKmiFA2soscHaoXamcpGrt5O7KN/t+l/SmbrPCdnO:ghaKmeA2sLPm8pOt5O7KJIxitO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965409, "uuid": "1a34618b-a92e-4e62-ac98-d3912ae3d53d", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965409, "uuid": "01727109-73af-420a-a124-13dd2fc42439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965409, "uuid": "80193633-dd6a-47dd-acbc-5cb693cbc8a6", "value": "3dfaa6be57de6dfe84ad2bbfbf3eaa17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350e0140-d5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680914534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914534, "uuid": "c7b2c81f-680e-4ad5-8a6e-5c5760a2b461", "comment": "Malware payload (Amadey)", "value": "76c9f47d50ac66a2ef9062db24e5b7e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914534, "uuid": "2c4b130c-1b65-49d0-be71-6f79dc14e731", "comment": "Malware payload (Amadey)", "value": "46ea76efcc75cab83537ca8e1baceffe098748209ec4fdb40c758b8f7db7eaaf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914534, "uuid": "98ea7600-3ff2-42a9-bc9e-0bf0a2552043", "comment": "Malware payload (Amadey)", "value": "ae028c8a82049220aa79cb2e02f66ecc359c9128", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914534, "uuid": "604d92b9-bd7e-43d6-8089-98e0fcb71984", "comment": "Malware payload (Amadey)", "value": "52170cc446cb19e1c7fa81581991de2683c3ea4510de705128e3dc07247b27822d7e37752e1158d18c8ea406929b7c23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914534, "uuid": "ef887ffc-7080-4c0c-9b5f-55cbd8fcbf89", "value": "T105052342A7E8D031EDA067702DFA16970B36BCB189B9476B7745986F08B33C4E83175E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914534, "uuid": "a50ce578-ed58-41b8-b498-944284b1a056", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914534, "uuid": "75156304-1aa5-462d-a8a0-9c9d70eb8e42", "value": "24576:ByW3G6u38J/Se+LJ6aiR56N9wzUbH5L1Wi:0gG6Zrumj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914534, "uuid": "410327d8-4cbd-45cb-8d07-cffaa785c39b", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914534, "uuid": "46e6ea3e-febc-4f70-9501-c6384e3da6e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914534, "uuid": "27191c89-7630-4dce-9bf4-cad4dfaa5dc6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd137ab6-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976610, "uuid": "57495156-d5d5-4e8a-a877-d0675af1090b", "comment": "Malware payload", "value": "f7006b0b93055be587dd7dcab8e3907f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976610, "uuid": "ae911713-87ca-40e2-b162-0435b44f7b3a", "comment": "Malware payload", "value": "47bbfabbf943fd718ef3f44c8e125d2c4699e682144b95b8c163dee138a0f06d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976610, "uuid": "ffa3e878-0710-4c77-bece-db90d2ef6aea", "comment": "Malware payload", "value": "4d3f87bd16d5da7a5315ee0e19aaafb8a9bd98ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976610, "uuid": "0998d400-eb51-42b1-9c39-44341683473e", "comment": "Malware payload", "value": "5a004034ba3e16556e7bef018af8664b2c7112df7e56a09a64becb24a5e1b0cc17851ba7bcdae9b9afd61407aae9464d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976610, "uuid": "b46e2adf-01ed-41c0-974c-773b7e0ca57f", "value": "T16EE54C50F650C8B9F3E69978185ABF190CF5BC124E822E4E7088A71C5FF0EF4E972695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976610, "uuid": "018f742e-5287-4174-a65a-87c68215d6e0", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976610, "uuid": "917f864d-d32f-413a-b21b-e8a105c159e7", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCZ:eEtl9mRda12sX7hKB8NIyXbacAfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976610, "uuid": "687b8690-46f4-4853-ad81-e33be5124c57", "value": 3079639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976610, "uuid": "3b3f8f40-abf5-46c6-a2f2-66dc7b7281c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976610, "uuid": "7e89bfef-d4f5-4a05-98b3-3223b41b03cd", "value": "2023-04-06_f7006b0b93055be587dd7dcab8e3907f_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3bec7f-d5fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680951030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951030, "uuid": "7fcfe5b8-9adb-43ff-8e21-b8619cf558b3", "comment": "Malware payload (Amadey)", "value": "941d8401dcea3163556cc2618596bacb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951030, "uuid": "e76b03b1-8477-428a-9e7b-115f94d1ea5d", "comment": "Malware payload (Amadey)", "value": "47de00d106dd237c87aac8014aff32244f8c974dee45dbd512228f15673410e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951030, "uuid": "f4e85055-cd8d-486a-9a62-436d41501c83", "comment": "Malware payload (Amadey)", "value": "bda733cc8f5cef5cc056d8c3852e6f2ee8b00fd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951030, "uuid": "30c48420-af82-4861-a943-4cf51bf43f1e", "comment": "Malware payload (Amadey)", "value": "8fc6a938ac5581ea46181c8f004fdff66e36839b391232cf4ec41e3b8d8f1e3f721a95ac122d22822ee8712ec36fe5c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951030, "uuid": "5e45b0e5-968d-4d58-bacc-1db42e424837", "value": "T1A7152313BBD85472FCF41B725CF20783573ABD935CB8826B270AEA5A0C716946834B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951030, "uuid": "1dab0524-f212-402e-b6e2-439ed3491012", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951030, "uuid": "23895133-3c28-4062-a9dd-efd377014923", "value": "24576:XysUgKO2weNq+FRjSTB+bNjLIYwDVDqEgv:isUgKOiNqKRjSMjUb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680951030, "uuid": "34421bbb-88f7-4588-acc9-04df042216a9", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680951030, "uuid": "995bc326-c19c-476d-8b91-25d6d1fb0fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951030, "uuid": "c38976a8-0139-4330-b9a7-5afd9f18e51c", "value": "941d8401dcea3163556cc2618596bacb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5730d9-d60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680959193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959193, "uuid": "45adffa4-0774-4cae-bf81-3fab24d3df71", "comment": "Malware payload (RedLineStealer)", "value": "b6fdcf0e43d16a2f0232418e21952e36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959193, "uuid": "52ba1abf-9acf-470c-88eb-6152843f3d68", "comment": "Malware payload (RedLineStealer)", "value": "491591a7ee17ecc82de39bee1090087b0d9e5d1aca2164368b056a5ac936aeee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959193, "uuid": "811b5678-ce96-4d1f-9ef0-51b5d8aa5e77", "comment": "Malware payload (RedLineStealer)", "value": "fef27b4e70a98b0036a41b06dee2adeab7e1b77c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959193, "uuid": "55faf26b-683e-4e7e-8318-5f153f4cc659", "comment": "Malware payload (RedLineStealer)", "value": "1d5fd361d0754a87043cbf48a1f0918c8892115321388f7a4d585fc094bb21f17df71965e6ff65a6f7c310542b89d6b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959193, "uuid": "2decedf6-ac8f-45c3-bb6c-659c201840ba", "value": "T146352303D6E941B7FD751B7044F713A31B36BCA2ADB8824B3A85744F4C7268099B276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959193, "uuid": "6440a419-a469-4f95-be1e-d5aa2909f3a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959193, "uuid": "e1f0d5e2-cd95-4484-94d7-ac88f857df0f", "value": "24576:iyqCIYsZfI26RwJcew+raXX79bcrNVxlBQPFnoS:JqLY0UZIyXJbcrZlWFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959193, "uuid": "b7943e6a-789f-42c6-a314-fe3f8911bf85", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959193, "uuid": "6eb057a6-0829-4460-93f7-9819242a2a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959193, "uuid": "85ac0ebb-c191-4f02-b6b3-d9ce2cc6cd4f", "value": "b6fdcf0e43d16a2f0232418e21952e36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb089fa7-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997223, "uuid": "7060f8f0-675b-4144-98ce-f43143db9928", "comment": "Malware payload (Mirai)", "value": "0c6f13744276e96174a32fa17bb1ea5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997223, "uuid": "62cb675d-2e91-46b9-a1ff-5eaa9ed8a11c", "comment": "Malware payload (Mirai)", "value": "49c912f818082cd51f5197da2f0a669fab321c48842855fbc9cd9aa8b666a88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997223, "uuid": "6e921c91-45a2-45ac-b8ce-2ac50a8b37bd", "comment": "Malware payload (Mirai)", "value": "45490fdf0c2d46080b44bd0b5b61683f517d56f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997223, "uuid": "e6af97b5-e12c-475d-9d23-8cb30e4029bc", "comment": "Malware payload (Mirai)", "value": "3f48cd13acb1b596921c64a36a8ae9562a93e98e294f2f1dd40102588a3368a8304f5b9e81e608366dabdfe9b2651fe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997223, "uuid": "18f700a9-f179-449c-8ac2-7cebc0e04c85", "value": "T11243A615BF614F73DC9BDC7306E91F01388CA95B16B57B267930E858B60B28B19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997223, "uuid": "3310d5f7-fdd1-48d5-ae56-b21c4e57cd6e", "value": "768:sz3RbvDUjt0rIJYVkeh55YeGce+QdwVZlhuXidU3myyawbZ010U5MC:sz3Rb7M2eyAncFQd2Zlhkmzb+10WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997223, "uuid": "30ead7a6-356d-4da0-8f37-ea5c20f5b820", "value": 57316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997223, "uuid": "6f937b24-bc4e-4ca5-83d3-e39649edbefa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997223, "uuid": "9edbd7e5-3041-4085-a623-c7fe5163e82f", "value": "0c6f13744276e96174a32fa17bb1ea5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82be8fb6-d65c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680992833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992833, "uuid": "f31bcb4b-2865-4d63-9bfd-d0e3f33ddf54", "comment": "Malware payload", "value": "abcb0f57bf7db37004d889d70012634c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992833, "uuid": "16a62917-d1d3-489a-ae39-d2caaa09ec40", "comment": "Malware payload", "value": "49e4f7d1879fe0d8dc93b0aa95a13c878dc97f23120a56d25d8f61f18de00dbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992833, "uuid": "bbaf9899-8a67-4fca-8120-208ee23c26a8", "comment": "Malware payload", "value": "1773119b8ec5a43703a6a43b6cc8a2b932299291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992833, "uuid": "8c282d3b-4c70-409d-bf6a-9a63dbd0a105", "comment": "Malware payload", "value": "2cb03a7568ed0a89395155ac0bdbed9954b49106b4b02317bad8cb96896230be9378b3407ce948f6fbe3dd4edea89edd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992833, "uuid": "f402124d-c77b-444b-b17f-11cf11524f2f", "value": "T1A06302059F15ED46DF000C7326CD9BAC8EBABB5A4A9BB07598E1E84F97E11CA6C57300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992833, "uuid": "868f4b48-0c6a-4199-ba21-772cdbebce6b", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWJ:phNlHuBafLeBtfCzpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680992833, "uuid": "fbd68454-b31d-4116-b25e-8ec15b7d11ab", "value": 67116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680992833, "uuid": "b7d81a6d-833e-42bb-8a74-4da5f05b662a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992833, "uuid": "1c8c6802-8239-41da-9c18-0cbe94772478", "value": "SecuriteInfo.com.Heur.20230408212815789803967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0ef8e8-d628-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680970466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970466, "uuid": "74cf7ae2-2826-4f16-ba2c-913331d75ae4", "comment": "Malware payload (RecordBreaker)", "value": "5568d141fa12726ec966bd6e2a674892", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970466, "uuid": "614961b5-af70-410e-ae82-759ed2b85f1c", "comment": "Malware payload (RecordBreaker)", "value": "49f2dba3b2284da3f21c9bf2996242f9c975bde0eca44ff0a85562612a5790d0", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970466, "uuid": "4281da66-967d-4863-a754-d97670dec516", "comment": "Malware payload (RecordBreaker)", "value": "93bad320f7b021ce6818ef4cefe32a73aa9b32be", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970466, "uuid": "f5818a37-9377-49cc-afaa-73daab99d581", "comment": "Malware payload (RecordBreaker)", "value": "b2e62c2e31d36c8aeb9b38ddc2f0dcd7c206ce73aa5e8451eefcc00c65f6cfa863577ed4f7acbbccc11f3e074caadd49", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970466, "uuid": "c27c4699-a9d5-42b0-b018-9553b60430d6", "value": "T1DDD633349E766E656F8EED1E905C77F8D08E3653ED329C251D8B85080D6283CDCA378A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970466, "uuid": "ee430e11-fc46-4c5c-9fec-75040828d99f", "value": "393216:yMe0Sl6CyLQtuoVVcGMKwCV3phg0eMMbTSNK:Q860yd5V3JMbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970466, "uuid": "a89be61e-f00b-4cda-b6ee-408733f8d9b7", "value": 13827838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970466, "uuid": "366dc571-8a41-43f7-b4b4-d86d55e58704", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970466, "uuid": "c99b6f7e-990a-4485-990f-2b3277c92210", "value": "mod menu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d50cef-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680964971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964971, "uuid": "75745896-c8cc-4dcb-810d-ab08f66d36ef", "comment": "Malware payload (EternityStealer)", "value": "18d902fa2b6f826aedf4964c67ebec5b", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964971, "uuid": "6d34a9ef-6154-4713-860d-b9e3e8d3fdfb", "comment": "Malware payload (EternityStealer)", "value": "4c280217c29415fedd3c2e1011bf578addd9b5da54addca475e6932ac64bb09b", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964971, "uuid": "df456ec9-553c-4a35-9047-00f267adc4a6", "comment": "Malware payload (EternityStealer)", "value": "bc822cab45a8088cba12c62a3433a15c9c29fb6a", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964971, "uuid": "ea8b1108-91fb-4d33-9c84-9b91bed0bc6d", "comment": "Malware payload (EternityStealer)", "value": "af0d5a1aedf05247982fce2591fd91a97169f9d22167289a151939b669900bcd4bac9eec5eb04dd961e24d8fe456bc01", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964971, "uuid": "faba4acb-18a9-4ab2-9a12-f8fd4cb12a95", "value": "T1ED4243247AF44B2AF2A8633D0D63323717711643AF57B3408B47B4B22A952A5DD0B9BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964971, "uuid": "5972cfc0-8c35-470b-a5b3-57db9125da0a", "value": "192:rV00NU+WelU/5/1PbvgJAD23QB3g3UvVv3f9Bmf11utWv:B2J1jw3M3V9v3FBK/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964971, "uuid": "6a9a2f34-9709-4e0d-a49b-cb48b7184778", "value": 12962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964971, "uuid": "edf2fd64-db27-4bcf-af94-70a663dde085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964971, "uuid": "9ce6e22b-1f88-4c48-9f2f-c01b893d90a2", "value": "18d902fa2b6f826aedf4964c67ebec5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0181ab-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997194, "uuid": "314e110a-0234-4dba-871d-a70a41a5b2a7", "comment": "Malware payload", "value": "a13cb79b1aa33c61a8b5cd52ee1b82e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997194, "uuid": "523a2866-dd4c-4f5c-a5af-9c6a192f8d4d", "comment": "Malware payload", "value": "4d41b9af4ad141c8287c13ce95e97902aa1d5bf059ab31527667cff4aad72382", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997194, "uuid": "164ccb8c-0650-4f05-8b75-82f05d209031", "comment": "Malware payload", "value": "998735d4bed182e7377dd41a04ef129e441d56e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997194, "uuid": "0b7c0c07-5df3-45ab-89a7-c5dd21d03894", "comment": "Malware payload", "value": "b3b386971a1ba7c24cefd5bbf7cd8cd351aaf37b8da59d752a25576e4a7a528d664c040e0ee373a611020e940708d051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997194, "uuid": "e5e50953-b1b7-4d90-8973-37be94e53dbc", "value": "T152931937BB230E23C0CA147111E30731ABB5D69538F95397B9E06DAC2F16AC43956BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997194, "uuid": "ebac6eac-7096-40cc-84d7-485cbdeadcd9", "value": "1536:bD2fwoi3NPp0ta1Q5DtB8TTrid3mkO0FPXjDTfQCX:bD7omNPp0Iqv8Tid3m50FPXHTfQCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997194, "uuid": "1615a59a-194a-477b-9a8c-22f379d7f83e", "value": 96091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997194, "uuid": "91cce862-40e0-460d-93d1-b99c1fc4bf22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997194, "uuid": "f6cc4242-e678-4a63-9418-4cf3e9bbe640", "value": "a13cb79b1aa33c61a8b5cd52ee1b82e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363e3b99-d63b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680978531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978531, "uuid": "84051a4d-9f3a-41f0-9725-e16fa4a4ff26", "comment": "Malware payload (AgentTesla)", "value": "a3c1891d967e4fec035ee7791ea67623", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978531, "uuid": "29cb2a9a-b31b-4e54-832d-ca500b52938a", "comment": "Malware payload (AgentTesla)", "value": "4d8309a56f195e762267e80170b6e6a1f69934cca21a336aa62316748a51df9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978531, "uuid": "7f6bb4ef-1228-4ca3-9292-29527b148ae6", "comment": "Malware payload (AgentTesla)", "value": "333dbbbc0cb85c821c04a42b71d8b031e825f4a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978531, "uuid": "84b429a7-f7ba-483e-9b88-602c0a1412e3", "comment": "Malware payload (AgentTesla)", "value": "f133b6df57552b4855e1abdda935a9d99dd12307c5380139af8330a412d82b6011254aaeb811eadeec36852bc8945304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978531, "uuid": "926c4bd4-efc1-4410-9b25-bb4c791205bc", "value": "T12E95BFF35BC7FDA6E2A52EB4F82610488DA4ADBFC76CE14D788C35A90B756508D018F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978531, "uuid": "8bc1c807-cd53-4d68-90b8-755c39c8db6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978531, "uuid": "e65b98bf-a9dc-4a25-9d4c-18a25bf628b0", "value": "24576:kZRGDozfL1R0nrP8DGaPMOfw/wDQtNIkp1fFnnXSTsgtk/3Pju4nr3y1gRIvL:FQRK5Gw/woliif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978531, "uuid": "1cda09aa-d3a9-4cc8-812b-5e48398dff84", "value": 1898496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978531, "uuid": "0bd51162-22da-4e0b-a785-f6699374f6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978531, "uuid": "1da7a7a9-c197-49e2-b863-eb95306bd42f", "value": "IMG_20783_1123708pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6890a7c4-d624-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680968737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680968737, "uuid": "115ecf25-08a8-4c12-9e69-1a01080176c8", "comment": "Malware payload (Amadey)", "value": "db0e857b77a3630a6590dd6fc636dcf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680968737, "uuid": "e16ec7ec-6f27-41de-93b4-12fea3ddf31c", "comment": "Malware payload (Amadey)", "value": "4e0c0a1b54f9ce1e5639de2290dab048c040aa51eb6d102e3e2eb2eaeff2d236", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680968737, "uuid": "3c250cc9-f8b2-45ba-a598-3257e702e747", "comment": "Malware payload (Amadey)", "value": "f5173cc7fac6b83b338ea5cf7f4debcb8a614753", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680968737, "uuid": "ccf14e47-4361-4556-9536-b0e1d2dec867", "comment": "Malware payload (Amadey)", "value": "7d49f5491100ff878441e43905d33d7f3fca2f5739b2dae5c0cd82abc254f60f365c8fce8f9b2a81b0f8115949a21690", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680968737, "uuid": "568b9079-6425-4594-ae77-a473be1103a7", "value": "T167652342E7C98522F5B52BB01CF543C30B3778A62824636B679AD11D4CB26FC76B2376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680968737, "uuid": "842dcc19-bea8-47a4-bdd2-2792815966a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680968737, "uuid": "e9cdb122-cd3b-4842-ae69-dedd00e49c04", "value": "24576:NyUGvP2dPZnKi3gQIHUyXPclQL+IlmHhlxKsXI3AN4xQx06DK6c:o5vunKiwdUy/clQL+IShOsYwN4qtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680968737, "uuid": "4be005d9-decf-43db-9562-5f831f736c69", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680968737, "uuid": "2bf9fa23-674f-4077-b526-f8d6a0321a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680968737, "uuid": "4f4a2405-5da4-4c9e-a162-2f07e089c57f", "value": "db0e857b77a3630a6590dd6fc636dcf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbf2a94-d65a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680992130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992130, "uuid": "730bf4a5-0199-4163-b4b0-33c9b96a8394", "comment": "Malware payload (Mirai)", "value": "dbdd7f26d464c9c6ca455daf8ea4759b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992130, "uuid": "3b2254f5-a451-4ac7-9aac-b85cd637c1a6", "comment": "Malware payload (Mirai)", "value": "4e18bc9b4e556380662ab1b6176c0622a737fe2167b52a78a82a6157625b89a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992130, "uuid": "2f78d9b2-af00-4b09-8672-5cb4ef4b2a23", "comment": "Malware payload (Mirai)", "value": "a08320308b7e2ed4a734768450df2b5ebe03fd53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992130, "uuid": "a809606f-e1d2-444d-88e2-6983707164d0", "comment": "Malware payload (Mirai)", "value": "8861c0cf71ac936ab3de3922c709ff7d692665c83dbbbbace380f4d141f0ec8774fcedea8f3057cd5e602fe3b430a932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992130, "uuid": "581bc242-be44-4554-8d66-409af8fe3c3d", "value": "T153235CC9A643E4F5EC5715B5113BF7374B72F439203DEA93C7A99C32AC51A00AA1B29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992130, "uuid": "cbf1913e-5bcc-48eb-a379-f3e96a951ad7", "value": "768:dyq9WV9rYinRzkxiqxNpgTUKqlzlCVigWV6s8fzqcBPCnW5nRJ5wAs8jfS6IO:f9WV9rYuRzkxiyYaz0IRM96n4ZwAvfS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680992130, "uuid": "6f945786-13f5-40dd-a9a4-a8783d921db1", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680992130, "uuid": "e991fed7-57ce-4e25-9252-8464aa7e0a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992130, "uuid": "1cc411a4-3b0a-4958-8d72-74ad00518c8c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cbd796-d5f1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680946829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946829, "uuid": "64cc7001-00b8-4d14-81f4-0808a61a1dce", "comment": "Malware payload (Amadey)", "value": "48e2673cb8c34b181d9f60e9652d5fed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946829, "uuid": "24efc46a-b5f5-40b4-b23f-98b96ee44377", "comment": "Malware payload (Amadey)", "value": "4e25cfe68f0369c1c507738ef9342001938af9bf361dda318a087f70be457469", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946829, "uuid": "932dad92-bcd3-411d-a684-e46e271f9281", "comment": "Malware payload (Amadey)", "value": "f7af99201f0c4a298caffc25429a2b776ab3555a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946829, "uuid": "7f19b0b9-4ff7-4a1a-912d-b33f07e5ef25", "comment": "Malware payload (Amadey)", "value": "e7809cb873f5afcaf410a21ac69367a7aaa7cda4669010e13d81d85401029b4ae360acd5f1c17b4f6183afec340cb3d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946829, "uuid": "4d38cac9-7348-42c4-b1be-9ec27a942e38", "value": "T169152307BBDC4032D9B41BB06DF206834A30BDA05DE88B7F574AAD5B05B1A51B43A72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946829, "uuid": "db6de90d-ebc8-4e75-ab08-4530909c0f79", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946829, "uuid": "179a3ccd-dc1c-4b11-aaba-0fdfe358a642", "value": "24576:1y6edmCmCyfP+ikQS5OsbBz6OwZ9JepxgoZL:Q6ewCAHBkQS7BIrepi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680946829, "uuid": "8245b515-0c32-4db8-92c0-621a3ff03c75", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680946829, "uuid": "a41ff0dd-8041-4f97-9807-531c3da15c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946829, "uuid": "8fc7d9ce-319a-4c28-b29a-7ec7d0593cc3", "value": "4e25cfe68f0369c1c507738ef9342001938af9bf361dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9b677e-d5fd-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680951912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951912, "uuid": "587be923-602d-45a6-903e-7eed3b5cbe53", "comment": "Malware payload (CoinMiner)", "value": "a4338753a6169ced89e760c155cbd5bb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951912, "uuid": "16df7f64-d619-4545-8858-617f1089738d", "comment": "Malware payload (CoinMiner)", "value": "4e56ffba23f677694ad3b8a2dfabf17671bd77153e7ff1411ddf473b3a64ff5b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951912, "uuid": "c2d730fe-4fcd-4a09-bebd-e96003eb8ce9", "comment": "Malware payload (CoinMiner)", "value": "44df54ce7318af71a3ec6cd5a8e27a927f9b86c8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680951912, "uuid": "34acc31f-0f92-4036-84a7-77329e03adf7", "comment": "Malware payload (CoinMiner)", "value": "cda3b764126e1f28135c0fbe203bd73b1634f5a21d5daf1dd229623ac0fdcd44b31b6a1e03b0a7daefc2d128f1b2cac4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951912, "uuid": "d71a37ac-7462-44d4-b48e-aee82872d321", "value": "T1E714D02176B2C0B2D81741344534D7B47A2E78749BB2C6DB334B277E0F702D2AA7A366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951912, "uuid": "a4d2a00e-e350-4f3e-b179-31053ee59f07", "value": "e29976161a141f5f92fe5bca09916305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951912, "uuid": "6bc3ef61-3299-4f5e-9064-af3c570f55b2", "value": "3072:hb8IE8j3xW6RRcybPG8QVz0J82pvqh9CmU2wY/Xun7l5Prb1No:tj3kerGbSJ82pyPUvYmjro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680951912, "uuid": "d9bd0b29-3a57-4da7-8153-8bb0a2182422", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680951912, "uuid": "373279ac-bd3d-4e9d-84f6-a0b958af1894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680951912, "uuid": "18e9125e-e2c9-462c-bd4b-bad35566789b", "value": "a4338753a6169ced89e760c155cbd5bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d203810-d5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680914280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914280, "uuid": "5902a0a3-6146-4cd2-8dd1-780c7e6f5656", "comment": "Malware payload (Smoke Loader)", "value": "d3a2152919e02a8a24c4c9039ad40d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914280, "uuid": "44701c00-078e-4f03-8765-c29a727b36d1", "comment": "Malware payload (Smoke Loader)", "value": "50dd217a26eb36d8461c1e14de64e0de95893fb124fc6bab293643ca14896550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914280, "uuid": "2132bae1-8705-4f98-a49e-718d30c935b8", "comment": "Malware payload (Smoke Loader)", "value": "36237c9792df34cae61fd0ad681b31aa42b861b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914280, "uuid": "78de36ac-ba4d-4914-aa2c-0acbc7bfbf55", "comment": "Malware payload (Smoke Loader)", "value": "6c0b7dcdf4a413b507c7041cce5c4b4b9a25d00c6a11e5487de72c850bff8f53571ef17aa78b6832e8a3129f7ecbc7a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914280, "uuid": "05364bc3-883b-46b7-896f-ae90bad46d5f", "value": "T18514D021B9E1C4B2D85785344431D6E8667EFCA19B9882FB234837AF2E703D1577A336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914280, "uuid": "2374fde4-49de-448f-9dc2-7bdba6988bf2", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914280, "uuid": "b40a1b9d-f63d-4e20-866e-41f59f6564df", "value": "3072:LalOPY7wb+Nxsrz4DQ03U1dW6JgoEXNHoOmbMNELpH4J051drqG0:+YW8z4DQ03U1dWfoEdH+MNEdH4Gdrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914280, "uuid": "3bf90180-8f56-4401-9b50-6c37ddde9f5e", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914280, "uuid": "378bf420-defd-452f-91cc-0513475f2595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914280, "uuid": "283819f9-aadb-4e93-99d8-ea85b3008223", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15919e02-d5f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680950130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950130, "uuid": "bc2a7553-d0b5-4d36-85c6-5ee57d4ccdae", "comment": "Malware payload (RedLineStealer)", "value": "969114b484ddef1d0a1405016d253a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950130, "uuid": "83864d39-14a3-47cc-9c7c-6f7bb8186ea1", "comment": "Malware payload (RedLineStealer)", "value": "53069da8103b319980e687cba051c0f6a49e1806bf6cb30826b65f3507098e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950130, "uuid": "88b82244-e1bc-4b6a-814d-712cc3d8a064", "comment": "Malware payload (RedLineStealer)", "value": "8e0b33425cd6df7a9f0eeae267d047e7b44faa89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950130, "uuid": "f79fcc09-8400-47a8-aa9b-6a23f2ae1bd4", "comment": "Malware payload (RedLineStealer)", "value": "7ed9c76d6c7b1b98a07d12e8ceff03dfc082195501b1c665c3b0acab43e934943b4131b42af4b733cf1026716ae82d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950130, "uuid": "51c80aaa-0082-4070-ac7c-26fa4e52114b", "value": "T1A3352305B7D86432ECF82BB0ADF203C36735BCA1ADDC439665069D5E0CB2294E53976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950130, "uuid": "607e42d6-56f9-4790-bdbb-77f381e6c699", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950130, "uuid": "9250266a-4c22-4037-9d45-117dce6206e0", "value": "24576:Ry2JHY6fLoHvgfMwxUFmES6dSsPbsi58ibOz3yH:E2ZjfLAE0mESibj8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680950130, "uuid": "4b8dcebb-9a57-462b-9434-61d964247c0d", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680950130, "uuid": "bb32ed41-5b70-4ded-9a4d-b93a95805a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950130, "uuid": "4ad49dcc-7fa3-4fc6-b66b-763cfa0520a0", "value": "969114b484ddef1d0a1405016d253a6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ba3fe7-d5ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680930261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680930261, "uuid": "068af8f9-1e2d-424f-9f64-f1ea6ae51f46", "comment": "Malware payload (njrat)", "value": "50c94bab29abaffd665fa180337928ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680930261, "uuid": "8cc10da8-5f92-4e0f-9c9c-89d2e82798d9", "comment": "Malware payload (njrat)", "value": "5355e4a5a499fcde32196e0e47328ad6b61849687299e385d71235498015121b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680930261, "uuid": "7b2c816e-98ed-4f05-b0d5-17517edd3ca9", "comment": "Malware payload (njrat)", "value": "68acfa7782da1d15bf4f53262a2d9b17009a37b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680930261, "uuid": "11272006-124c-4b01-9785-228960eb0c65", "comment": "Malware payload (njrat)", "value": "95cf9902d2e2e490aa18b465fe561cbffc7e2c2e49d6ac50ae015a095a48c17e1f51f1f3b696cecf71ad2662081389a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680930261, "uuid": "cdbddd16-ea52-4a5a-8268-8707924eeaa0", "value": "T137E2184C73548A23C6BE4BB88E70990247F1C15B5512EFAF8EC510D61EA7BE45E00EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680930261, "uuid": "68262077-f67d-4a10-b782-53e44366c880", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680930261, "uuid": "d28f19ee-8103-4729-9955-84a35d5945e9", "value": "384:DtHwBPh5w1+IvfDivDxEF+pPAnw0BwKCGHGEYb3B+JVuHVHVkw3ccNwifGIyLslm:DpwBPh5w1Ab14w0BwK/4Mw3ccrfLEsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680930261, "uuid": "9830d06a-934c-4ae2-a199-829b2dd1b4ff", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680930261, "uuid": "9f9d2c79-0331-49e6-b38c-21bf79c39df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680930261, "uuid": "2fbe237b-41eb-4eab-82ad-ae11a5524b2a", "value": "xc2Yr6Alp1kb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9d672c-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994220, "uuid": "7558ccd4-dae8-46bf-acd5-353f48666de3", "comment": "Malware payload (Mirai)", "value": "439590df210f912be8b4fb466df7c57c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994220, "uuid": "b44c83df-72ee-48a0-a08c-4870036f16ac", "comment": "Malware payload (Mirai)", "value": "553235a03da33178fcd4e7a796e8315a097a82be2a0a5a05c971df6b1a85175d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994220, "uuid": "7bcf663a-d807-43f2-9aa0-c9699ced271e", "comment": "Malware payload (Mirai)", "value": "b7044e2ea50b702a35782825d43b33385f8a789a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994220, "uuid": "29c30952-03e8-4ed5-954d-122e7cc8d15d", "comment": "Malware payload (Mirai)", "value": "07773832bf3a0817d6a448502412269296b412ccce3566590c84ffb9deb0042e2d1f6faa9c84a5f52ac96e6d80956c39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994220, "uuid": "44dd4c92-6a7e-4a8e-bb15-2cfe73813f11", "value": "T1E8E31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994220, "uuid": "f8b80ebb-9474-4791-9b40-f5a54bd2e748", "value": "3072:Z41HOuaGVV3NfHUOjqyl7qCw3jkmhxQwoVZUNu:Ze3aGVVdqyl7q1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994220, "uuid": "17a639b6-60e3-479d-86f9-2d69022baf39", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994220, "uuid": "6645a92b-38ca-47a6-89d4-28aa6a2320b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994220, "uuid": "12405a11-2fd9-44e8-a215-e74a731d4571", "value": "439590df210f912be8b4fb466df7c57c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88d0d79-d648-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680984441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680984441, "uuid": "74bb15d2-9a5a-4605-a49f-d4cd4d4d62eb", "comment": "Malware payload", "value": "b8360ec6966f97abf29c53cfc6140f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680984441, "uuid": "4eeedf06-020e-4ea5-8859-d67cf9f56c94", "comment": "Malware payload", "value": "556a0de2e532cfc54e6862253ac1f33ed8e1c3ee06ae4a533cba709cccc38b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680984441, "uuid": "2b68a61a-eec4-40e1-bad3-9317b3a7f7b4", "comment": "Malware payload", "value": "ea3687b6de93caff8ec2f4c390f36b22ac62997f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680984441, "uuid": "f1bbd612-84fd-47cf-a0c3-8fe83828e0d3", "comment": "Malware payload", "value": "0b5db02e6f1b7050777863ddece01b7b979ca9c697752271b04ac26ce0a783a20c460de11522ac0a2f61677c044c7dd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680984441, "uuid": "f53605cb-497e-4aca-99a5-3edfee888406", "value": "T194E208067BE94219D6BC5AFC8CB313214772E3438532EB6F9CDC88CA4B676D04255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680984441, "uuid": "67263e3e-5879-43ff-ad6d-f87ef6b2d0dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680984441, "uuid": "d01a6b3a-a0c8-441f-aa28-a67833d93025", "value": "384:90bUe5XB4e0XGO7Aw0Q0mS03AWTxtTUFQqzF8ObbN:uT9BuVZ55dSbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680984441, "uuid": "ec0997f7-7354-44ec-be9a-dff513ddac69", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680984441, "uuid": "88ebb0db-c35f-4d81-b9a3-b6e48053f9fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680984441, "uuid": "6954ba6b-2193-4260-9c12-090429ae4af2", "value": "bLwQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60226185-d61d-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680965717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965717, "uuid": "ed24934b-f281-4d9d-b085-7a0075dcc636", "comment": "Malware payload (TeamBot)", "value": "ce6b8e3c5c6d8f94de86be18d26c70ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965717, "uuid": "9a057040-5de9-49a6-81ef-a0a4e8ad1e2d", "comment": "Malware payload (TeamBot)", "value": "574505898a63502d3cbf7517f9f1c2abd338d92b17461ee336999203db6619cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965717, "uuid": "f9ef98e6-eb25-41b6-a6e7-f2a12143e32c", "comment": "Malware payload (TeamBot)", "value": "e15b427099036dd0e674f59d439f1156db601eca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965717, "uuid": "df86b0fc-a32c-4721-89a9-551bb1211c9a", "comment": "Malware payload (TeamBot)", "value": "10295bbe754291878f60e5cce032e74c0f21a1f538b1bda91b37cb8e470032fb0b8ea6f41f9d14daf1f611863c8ff583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965717, "uuid": "82b9621a-935b-45ec-9b46-660e83c3fa1d", "value": "T12314CF22BAE0D477D85785354C30D6A4BB3FBC518765829B23583BAF2E303D05B3A766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965717, "uuid": "9ef358d0-9731-4a74-9568-21c6e50761bb", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965717, "uuid": "d77739d8-f2f4-41ac-b129-e5a604178169", "value": "3072:Ul1gA6+CPS0zi9XwoHwwR8f06rcYRYxgfC5rBPcRz3thJR:cXCP7zi9A52k3cYKfBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965717, "uuid": "c37a1468-9cff-44c1-a7d3-1b91c13efcf0", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965717, "uuid": "e82a37f0-d1f5-422a-b2ed-92c2dfd4a9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965717, "uuid": "2ba748bb-a192-40f7-bd71-b0f0b792c8de", "value": "ce6b8e3c5c6d8f94de86be18d26c70ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c54d95-d5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1680914157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914157, "uuid": "6a531a92-cdaf-4ca8-83e1-f354a0ab3d3c", "comment": "Malware payload (XWorm)", "value": "f602b0a8b1112ba1e5c315b5c3cd83de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914157, "uuid": "6743fb0b-62cf-4254-8819-a580bd12399a", "comment": "Malware payload (XWorm)", "value": "57f4c5126700392a7d6e6fa24d8c8f1c9efcf960e3019a84237ae1b54f9e9c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914157, "uuid": "b078d38b-8b83-4e98-a2b0-7ccf2868fd42", "comment": "Malware payload (XWorm)", "value": "2513d1984526d28132eab09e87e6b58af115c99a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914157, "uuid": "c860bd27-11c7-4ed3-88f8-6733b7e4eeb4", "comment": "Malware payload (XWorm)", "value": "65037f7ba776e90b8f935dc1f3bbffd492e0035d80ec62717c944700b1893068f2cff1ba5f2d1d7135516994484798f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914157, "uuid": "db33eaba-0bd5-42ca-8a0c-fb9d60e59282", "value": "T165F25D083BD88369C9FE2BF939B3A5115270E5039923D75E48D8499B6F77BC049063EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914157, "uuid": "88434e5a-2dcb-4802-abd5-e9687098789d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914157, "uuid": "3a5a7ce9-9494-4d22-bb4f-585acb26b9e1", "value": "768:prHZZd7rCwvsOaC7aOnVFX9juOxhNScBC:B55rsOVFX9juOxDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914157, "uuid": "f9278928-e583-4404-981b-6cd1398bbcec", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914157, "uuid": "48fdb4f7-69a4-4676-971f-394725f589d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914157, "uuid": "58a2e38b-8f4a-4481-8883-4ef7a288e9f4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6b596b-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976609, "uuid": "5901059a-141d-41fb-8646-6f1bd0d665e8", "comment": "Malware payload", "value": "e52619192ea881bf0a7a56817842eebb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976609, "uuid": "37071b6d-0a65-4b9e-8484-83b657a2ea67", "comment": "Malware payload", "value": "59392184da136d6b25e3f10855263834dc3880005d81f65992a459dcee9a195b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976609, "uuid": "44178ed4-d951-4462-8a6b-061218bef0e5", "comment": "Malware payload", "value": "7fe3c1d3c610f47630a98e1fff1815dc1cb35460", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976609, "uuid": "9750049b-1f37-471e-a11b-32d3fe60b238", "comment": "Malware payload", "value": "aeffc1c6915b64eb8659c124ddfb48eed50f97433e39c1ff45600c39d47f4c0a135c4dc9f1aaf4f3c92b5e7f44f0a7e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976609, "uuid": "f445abf7-22ce-4262-86a6-e3b946985a33", "value": "T14DC53A64A610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DBB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976609, "uuid": "7074dd66-5557-4cbe-9f31-741b71f037bb", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976609, "uuid": "bbe66f08-357f-476e-bb3d-828f1b1ab6ac", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCB:eEtl9mRda12sX7hKB8NIyXbacAfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976609, "uuid": "2090e967-6d81-4565-9696-df4d3103c267", "value": 2586808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976609, "uuid": "f9c20b6b-8774-4103-abd0-783a04fdae40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976609, "uuid": "f6befb25-b966-499b-beae-bd4539c19f6c", "value": "2023-04-06_e52619192ea881bf0a7a56817842eebb_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11eb6e4-d612-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1680961236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961236, "uuid": "fcfe3f87-0572-4df6-a5b4-ee97d47f6a2d", "comment": "Malware payload (Pony)", "value": "67c5676dafcca0f53fbccba0d3999b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961236, "uuid": "f28eb703-8782-417c-801f-2ebf476f632d", "comment": "Malware payload (Pony)", "value": "593b0f2f3ef3f79cd26f118b860f88b4743dbe5ce4f40e09a2858f08f2663697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961236, "uuid": "53f0c2a3-468a-4407-8702-9229cb760fb5", "comment": "Malware payload (Pony)", "value": "1456a056bbff99c5b94e4a6b458bd0e0f261788c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961236, "uuid": "ae1bf4ca-7273-463f-adf2-4a66f49e9676", "comment": "Malware payload (Pony)", "value": "4fd368fb9ea9906023fed8762c54eca3faeeadfefcf0ecb7fb0fcd4a5b502757790270c450924e6322c8f0a628319b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961236, "uuid": "185da1f6-acaf-4f8f-949a-de2ea1b582db", "value": "T13014CF1357D9853BE0F523B089FD22A31379BCE42B78A3AF824945D95C312D1AA7835F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961236, "uuid": "dc40f981-6171-4b19-9ead-cc34c7223cf4", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961236, "uuid": "5a611a89-7f73-4e9b-aba6-421eb464187f", "value": "3072:5nj9jtfU+INndIc0JJ5iiGfNgZsKmBz/q/hFA52eOMRkBYs+AeCq+0eANM8TClo8:5jbei3GfCPwmpFcrNkOsRq+dgM8TdcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680961236, "uuid": "9424d548-6753-48c4-86b4-a59be137bce8", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680961236, "uuid": "30979a8d-1a8f-482c-a5ba-a0418a68216c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961236, "uuid": "19fcaf60-4ce0-4de3-b17a-becafd276c68", "value": "67c5676dafcca0f53fbccba0d3999b17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f4154d-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1680964980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964980, "uuid": "086b0f25-eb7d-4d01-8e98-fe6b2dc1ac26", "comment": "Malware payload (GCleaner)", "value": "29f01b4e7cdb40b17ed55805b7ccc1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964980, "uuid": "cbb2f45b-38c9-44b2-b9d5-b17cd722dccb", "comment": "Malware payload (GCleaner)", "value": "5a454dbfc4aa1189324c2b5942b671bd2f8908a12070ddeec1cb78b97193f6fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964980, "uuid": "fed65b63-bb20-4976-a28a-024dd61aa6cb", "comment": "Malware payload (GCleaner)", "value": "665dbe9c0f7be9088ac9a11180cbbf14ae9db60e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964980, "uuid": "c880547d-b871-4005-a9e6-fcca1e25e943", "comment": "Malware payload (GCleaner)", "value": "8b4653229b2bc40bbc10cc4dc927a1a5ca66d395f006812cbd524b19e267de46efc01ec0352205af0ab2a707abc1e401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964980, "uuid": "12b34798-fe6b-433d-93ad-a320b77986fe", "value": "T14B849E4262E16834E9125E338F2EF6F4A51EF4B0FF27FA59226966BF0D701B1D122315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964980, "uuid": "1bc6d417-bf5d-40a9-9f30-682f5b5f248a", "value": "373596848c3cbdc7febfaaa8c664a13f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964980, "uuid": "69de59ff-3dc0-426a-adbd-d3b7b4d5369f", "value": "6144:3kvGi5m8vUzU+Yk44jqbJxeNnQvjM+ZAyvdkiUW:3kvp5wQYjSxeNiAFiUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964980, "uuid": "ac305f67-a4a5-4d8b-b262-83414b59ed3c", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964980, "uuid": "aea9e455-d7b9-4223-9c96-79c64b21de1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964980, "uuid": "a7ca8ddb-749f-4f86-98cf-7ba4d6e7496e", "value": "29f01b4e7cdb40b17ed55805b7ccc1ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0b5d8f-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976931, "uuid": "069c65b2-b086-4e29-88c6-4e7c23ea5be4", "comment": "Malware payload", "value": "e04aa3a6b658b95396943832bf985573", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976931, "uuid": "85e37843-e5e4-40d3-ac96-facb57ceb146", "comment": "Malware payload", "value": "5b5796f2098629008eedadd5420d5fc1845a305fe2d41fe03773f71b36219fd7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976931, "uuid": "5795faf8-ee7c-473c-b91c-54cc6e3b7c1b", "comment": "Malware payload", "value": "da70e2b4b0912a7bced95e0cfeb80ced99ad1b88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976931, "uuid": "457677c7-d519-4f00-a2c4-c66036a99ef3", "comment": "Malware payload", "value": "83149a3200621bc14f26b2fcca7d8bc94feebafcc304aeb9f5eccd2e4f13c2c1aad44aa1a1e5f73396e5a79856c14784", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976931, "uuid": "38ed3951-18b9-4863-838a-d6a27dd284ca", "value": "T1E1C55C64E610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976931, "uuid": "2c3a7dbe-db64-41d6-b3e6-527053650651", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976931, "uuid": "0b9481d5-b5aa-45d6-b15b-9bd539a848e4", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCa:eEtl9mRda12sX7hKB8NIyXbacAfuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976931, "uuid": "bfcc04f8-ad8a-46a8-b107-db600a6178d7", "value": 2564088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976931, "uuid": "707e6154-ab0c-4627-939a-2110de264bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976931, "uuid": "0dfe3e16-737b-4ab0-b63e-01c6a51df94d", "value": "2023-04-07_e04aa3a6b658b95396943832bf985573_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91f2165-d627-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680970161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970161, "uuid": "ccdda869-2b9a-4180-850d-d160afd2a648", "comment": "Malware payload (Smoke Loader)", "value": "71df8437efe2282d27cb72d5c1e765a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970161, "uuid": "8bccba78-436c-4350-bb8d-470955756c1f", "comment": "Malware payload (Smoke Loader)", "value": "5c8e279c03e06edd318188afede866376d1ac18afffb2b8c335950146de2f3e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970161, "uuid": "54a8d3d3-28f2-4fe5-b07c-95900e8d43e6", "comment": "Malware payload (Smoke Loader)", "value": "af7395f7b6a20e53e6263c0b9d9727bc885ee16a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970161, "uuid": "0541cd2c-9bdc-4d4a-8360-bc48a70b7a52", "comment": "Malware payload (Smoke Loader)", "value": "e66044b7c6bfea3d4c71bb5e106825236bb65dece4416c9964f2b2335e90524b9fad2acc4d5bac40ea41c8c03f8d6e2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970161, "uuid": "811208dd-a93f-4859-bdc2-a3beb3420b3b", "value": "T1AA14CE21BDD1C0B3D5BB44759830DAB46A3EBC519359A24B23683B7F6D703C26B3A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970161, "uuid": "caf00777-c674-4f7f-b053-9e2c3496fbcc", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970161, "uuid": "3668d331-7d3a-4b2c-a1c1-2fd6d16edacd", "value": "3072:PuwIPFqEafKshshTcltlYBZLA0W2cpgmUvArC5rB6yQR:PjCeKshsStWA/mvAEB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970161, "uuid": "16d2aa23-ea4c-45b5-86b1-b6d492dba44d", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970161, "uuid": "5c432d86-f130-4c55-bb1b-6691052e075a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970161, "uuid": "5857879b-dadb-49a5-898c-3995c0a34784", "value": "71df8437efe2282d27cb72d5c1e765a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadb4c6f-d5a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680915725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915725, "uuid": "aa1ef2b6-bfa8-41c6-97ab-b18521f20a1e", "comment": "Malware payload (njrat)", "value": "f7c1425d94ed522fb5280797b5cb2ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915725, "uuid": "335d4c9b-bbad-475b-b1c5-1de92e57e73b", "comment": "Malware payload (njrat)", "value": "5f67204de19f93005d5560099c019767f90f57815d022b0c111cf4dffedc1626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915725, "uuid": "53c71423-d3fd-4a2b-8977-368d88a81fe9", "comment": "Malware payload (njrat)", "value": "57639d64efce521520a032b7e46ba42550e98e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915725, "uuid": "57b6441c-6632-4bcf-abe8-df54857c2b35", "comment": "Malware payload (njrat)", "value": "e904734d8a15c58913518fb095ccc53a21cc51789487568e47d5d321ddb301261a18e5310b2b3da0f158484abaa96286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915725, "uuid": "a4ad97ba-9a84-46eb-876f-0a02eaf76720", "value": "T179032A4D7FE181A8C5FD057B05B2D41207BAE04B6E23D91E8EF664AA37636C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915725, "uuid": "0a0301f4-ea84-43c6-912f-e4f40a0303c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915725, "uuid": "dfcfe6cb-1e16-483f-b73c-3ee5bfe36c43", "value": "384:rjKvEiTbHvpWNcZ0y8f7CTvvrILkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzXZ:PKXTZ38f7CTv8FwKrM+rMRa8NuCKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915725, "uuid": "bfccd5d8-f268-4317-8b5f-6507196b37ef", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915725, "uuid": "d88fb4ed-9ed3-4e1d-b57a-7b44586294d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915725, "uuid": "ad6104a8-3174-416c-803f-19f2b5b09877", "value": "Roblox_Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65c51c8-d5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680914376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914376, "uuid": "5b7296e8-bcc9-4189-8ff2-31874b7b4225", "comment": "Malware payload (RedLineStealer)", "value": "300b9460cd998083bc7caa4036d5832e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914376, "uuid": "54afe3fc-6dba-4feb-aea8-ea458c8bde1d", "comment": "Malware payload (RedLineStealer)", "value": "6125023434ef6f84b86bf3f6a737c39ee6092ac356873b3f84fbea5691b13c8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914376, "uuid": "fd6a66f0-b932-4b04-866a-d693e996177a", "comment": "Malware payload (RedLineStealer)", "value": "1a57d3ba4d7b6bf3c2b2cca79517fc896823c87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914376, "uuid": "b37732bd-528f-403b-b935-7f4de5e0f555", "comment": "Malware payload (RedLineStealer)", "value": "7509e5494a8c1819070319265dfe981d9a14b5de14414fcf4730e4a5bdc2248cb22bf56055290055277289b396ff295c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914376, "uuid": "d5dab334-e707-4749-8978-8b7f47b788b8", "value": "T15D052252EAC86473D8B0677049FB038B1A31BD6159BC965B278AE94F0C33BC0993576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914376, "uuid": "4c15f3bd-ed90-49ac-b66e-642db1ff96c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914376, "uuid": "d0c82ea7-b8ed-4eb8-beaa-1231244e1c60", "value": "12288:8MrTy90HMwhlZr9QhACQI62BmYNYCYxUbUQ4io3hzQxTX4GRb7yliGInJ/Y8TO3:nyORhlZmhACTsdxdQ05QxTo0bAsBY8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914376, "uuid": "80a31e7a-4326-48f9-bab4-e986827eabad", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914376, "uuid": "7df15175-10ac-48ad-be1d-2c72cdb2fac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914376, "uuid": "b58b9a80-fa09-403d-b64a-d67bfa2615b9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e408ce5-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997121, "uuid": "913393df-2707-488f-a6e9-6b1bf64a63bd", "comment": "Malware payload (Mirai)", "value": "fdbe4eac86a5b510242bb8b2d7457842", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997121, "uuid": "022adcd5-ac6a-4063-ba88-d0600b585d63", "comment": "Malware payload (Mirai)", "value": "618f0537287823780149e50487bbd593db701a0b39a07f5d768118b2786f49a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997121, "uuid": "49b9f24a-e60d-47d2-a323-34e8172e1400", "comment": "Malware payload (Mirai)", "value": "21cc7ce32d8f6a1e5db32ef626908d3414f4aa4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997121, "uuid": "15a6b249-b9e6-48d7-b362-7bb2e40cd92c", "comment": "Malware payload (Mirai)", "value": "f57a06afad9b7f2c83ae7e128a8492fdf30bac950a13fe3d77d2968a233feb1ad07e2ccd11d280681a236f0df76710a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997121, "uuid": "567f0b94-4a36-43e6-83cd-b2623b358da8", "value": "T14BB33B56F7408F13C0D61779BAEF424533229B95A3DB73065A28AFF43F867AA0E13905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997121, "uuid": "2cc256b4-4b1b-40d2-8d93-a3a037c5b834", "value": "3072:l3S9polRqZwOd1VXYP9OZ0beDXsesiM/93bQP:l3S9polGwOd1VI1OIiXsehM/93bQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997121, "uuid": "1649205f-0bfa-4eb0-b814-c4ca8d1adcd0", "value": 116327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997121, "uuid": "58cbdd26-78e6-42a3-a512-18ffe2c749b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997121, "uuid": "02ef1dc7-d200-45a6-b26e-0a614a553890", "value": "fdbe4eac86a5b510242bb8b2d7457842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393b8c6c-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945465, "uuid": "2807b9b3-cd62-43a7-9cda-f118782fbaa5", "comment": "Malware payload (AgentTesla)", "value": "7aae4a8c384ab87497d2e862d67de307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945465, "uuid": "2f02e18c-4e07-43af-9a82-b58c5d49ad3f", "comment": "Malware payload (AgentTesla)", "value": "62ff100dd98d5bc6d3068bad8acb04bc39035fe33400364c016a9b01c21eb1e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945465, "uuid": "a35166da-7791-4e34-a218-cd1fd5411b8c", "comment": "Malware payload (AgentTesla)", "value": "43290ded5756bf7201e48895216e1937de1e5841", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945465, "uuid": "dac47bb1-b84b-45ce-8d18-5e9dfaa33458", "comment": "Malware payload (AgentTesla)", "value": "cf22af9c000231ecaf38beb32ba4dcf61ff1ebf0a20d802e78d3e946652f81264780c668f29b1f78157b56a1b7df8adc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945465, "uuid": "32674baf-d7bd-4f06-86cc-d879ebcdc500", "value": "T1A9C4EFF48689CFB7DAF801B4E01A01A467F2BD75D160F3A33D987092B7BA7A34765106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945465, "uuid": "148b34b9-863e-45e1-a97c-e6087299040b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945465, "uuid": "5db2ddd4-0ca3-413d-8e27-fd1da2ceff88", "value": "12288:1PwzDnnFyKn0Lb5+Lqwa8WYWqLha24iO9fwW5x:UnFBwboLxa8lWWa24dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945465, "uuid": "4971838b-84be-4eb9-b0a2-a93b9aa2ff05", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945465, "uuid": "e766d863-4209-4b67-906c-1c1a470cf854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945465, "uuid": "52b207cf-a35e-4993-b0e8-1a91aa78b14f", "value": "202105-USD122986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32c1174-d5dd-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1680938422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680938422, "uuid": "6d89fea7-2982-4357-b8e9-cbfd4b9ba10d", "comment": "Malware payload (CryptBot)", "value": "238509ed1c8581aae3e57ea7de78ffd2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680938422, "uuid": "133e9f6b-b74b-490c-9e6a-e10bb162ce06", "comment": "Malware payload (CryptBot)", "value": "631defcfe435bb021b408b39bc9130cc351d698791172f6c9db6050cf3db1702", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680938422, "uuid": "6039e799-4d63-4b04-b294-ac82eec4d937", "comment": "Malware payload (CryptBot)", "value": "72f5e44557541019d1303533c0063b1a739872ee", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680938422, "uuid": "2b52e1a0-f548-4299-8178-80ddf88b471a", "comment": "Malware payload (CryptBot)", "value": "e176924f5fd3eed68b505a0a57485526663343b42eea26bf93744b095c57f95f6066f99ce6490b52333095144ed4ce93", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680938422, "uuid": "2c302b0b-93ab-4b5a-908e-fe33dddc1fbf", "value": "T15B6623234377C046D0A5CC3ED627BFE936FB06B14B46EC35A6F66CD03519A92BA0A453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680938422, "uuid": "2096365c-de2e-4c81-a997-2914072b6642", "value": "36d75ecd818f0c5cde41f4ee2b1e9296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680938422, "uuid": "0ba78b0d-1f53-48d2-9858-7cfa1e9a11e9", "value": "196608:V0VBjQzX+gwvGJYwSRMBu+oKyV+r05N4+K/:KceGSNebyUQEt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680938422, "uuid": "7ade8f89-f039-4b22-bf82-807689da8f20", "value": 6962688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680938422, "uuid": "a4a29560-9ef1-4c36-9e2d-a0e92c641dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680938422, "uuid": "64b88169-af1d-4485-845d-d149b877d1b4", "value": "238509ed1c8581aae3e57ea7de78ffd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68a56e0-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997215, "uuid": "429128b4-15a5-4d0c-9995-7a561f9b3884", "comment": "Malware payload", "value": "81cc4665f17791b3e1788ed31b5b1aa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997215, "uuid": "08220c11-575a-41f2-aef8-340f09cbf945", "comment": "Malware payload", "value": "6499d0f4d8e082e7bfadf33391bd53fb184dc38deff867905d58c3085993ce41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997215, "uuid": "16531dfd-7483-490e-92fa-134c80e812cf", "comment": "Malware payload", "value": "6fa0e6f75891476de4d273a4d4ce1c5db49d2300", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997215, "uuid": "f1c736a1-f3e0-40c2-b688-ed08b3f93001", "comment": "Malware payload", "value": "f5c926337f38bee8edeeb5e75a8eabbe9e2dbb85aacea408f0889b42182da41ef66e44a0db8870b7197b861d99baac72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997215, "uuid": "eac45635-a9ec-4b31-ab1e-3b75e993a154", "value": "T158931A05F9458727C2D327BAF78F479D3B326A9497D733015A387EB42BC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997215, "uuid": "619a4577-7c24-412a-b968-045405b5facc", "value": "1536:xJ50W3OeXEKF/CIoEylxXOyCHtiGZsAvb4iWNVMiBhepeEPLifmqzgrQxFWOBX8u:eW36llmH7Lb4iQBMpeEPUmagrQxFxBXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997215, "uuid": "beeb46c7-c256-4036-bbcd-aea2a4ccffb5", "value": 97295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997215, "uuid": "4e688b89-064f-4dff-b2d0-2a0748424f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997215, "uuid": "d8c9be5f-12c1-471f-be4e-6ed66200f327", "value": "81cc4665f17791b3e1788ed31b5b1aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c7e304-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994204, "uuid": "c7f96407-904f-4d01-a425-54a2d38e0f42", "comment": "Malware payload", "value": "9b25b0727b2adb9c2ded78e5211eaac7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994204, "uuid": "b3dd9b64-72ca-44be-b314-46ab4cba7443", "comment": "Malware payload", "value": "65cfe9f55ffbb1f52d26a52f2e1a715a5b37c5f88c8d6ae46390b47fb1466b4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994204, "uuid": "3b9e876f-dcc2-41c9-a702-9b90b2d33e1c", "comment": "Malware payload", "value": "d514502c9f5841e5fc4b50e6622efbcdce34a47d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994204, "uuid": "cc94768c-0f87-4205-9c46-c095a2d68696", "comment": "Malware payload", "value": "135a32d899a3d7d97e17f2e1aa42b27b1d2c67503b015904596af779e7f1d3242d2725bd5b5ef881c37cf728ecf032d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994204, "uuid": "5d813dc5-75d0-4ab8-96d7-168dd2caca6e", "value": "T193933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994204, "uuid": "f175dc5d-8da3-47c4-9e1e-2220db2f6b14", "value": "1536:jW6Jk7jWNEqi+thy5ct1FNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+Fqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994204, "uuid": "295f38d4-6be5-4aec-929e-6c84324199ab", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994204, "uuid": "309f020c-b4f1-4757-aa08-77cbccdb56ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994204, "uuid": "d5492450-e9eb-45cd-a582-bae85633e39e", "value": "9b25b0727b2adb9c2ded78e5211eaac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fcf47b-d63a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680978051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978051, "uuid": "4e47c8a2-68db-4b39-8872-4b04e9d4733a", "comment": "Malware payload (RecordBreaker)", "value": "98eb36429341e7062e88653a63a1edd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978051, "uuid": "e0382dfa-1819-43b3-9a7a-ac2d509d7d8b", "comment": "Malware payload (RecordBreaker)", "value": "66cde4c75989491b5d4ded6401719558fc3aa49b93447c3b1c8d90adbbb6fdf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978051, "uuid": "3654f09f-4d5b-400d-adc8-a5bb7ad2ad5d", "comment": "Malware payload (RecordBreaker)", "value": "d6e1860c9ca78c3c87ac70f4d4951ea589bda3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978051, "uuid": "f97034b5-aa53-4001-aa56-6f0cbabd94a4", "comment": "Malware payload (RecordBreaker)", "value": "2bcb83365370e82521ae8b90a91420db16ab3c5a6dd362ce4453a3ae00c5a96f0dcb96b7155555950777a4c93e9acffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978051, "uuid": "f8c32956-3b27-47f2-9e46-a3f28a99aaa9", "value": "T17C14CF22B9E0D8B2C85749705C7CD9A0E73FBC619765828F23583F6F2E317915A7A312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978051, "uuid": "40f03107-ef55-4433-b8b4-f79234fbba08", "value": "b57501f26cbd338c9d36004199e16398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978051, "uuid": "80ef57f9-2035-4b17-893a-356057e29d83", "value": "3072:UpFzwn76nFJ7uYWGHJzBp/48DgOho5+S753DI7kWR6:c1W6n5dnNS753DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978051, "uuid": "3fd6cd2d-d763-433e-81f0-aa7985b0b881", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978051, "uuid": "57cb63af-21e0-4ed7-aa10-4039c173d2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978051, "uuid": "e3ba7649-1672-4669-b9ad-65ea4e75be0f", "value": "98eb36429341e7062e88653a63a1edd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2ef2df-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959694, "uuid": "54d9101c-01ec-45e9-b44c-c06595e0327a", "comment": "Malware payload (SnakeKeylogger)", "value": "cd020073e8cf77061a01eb95105c7757", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959694, "uuid": "4227e4d3-8102-42d0-a397-42588e9412d6", "comment": "Malware payload (SnakeKeylogger)", "value": "6814fda77ec8db64269a9a5b86777b1d87708ccecb96e6e762b3cdc4912940bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959694, "uuid": "8295e07f-7e9d-482c-96ad-a16553d56401", "comment": "Malware payload (SnakeKeylogger)", "value": "9365385fa86a34cf621a7add4a3a0b119e860f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959694, "uuid": "dce4cd39-0615-4cca-871e-64204bc73c89", "comment": "Malware payload (SnakeKeylogger)", "value": "861b99ec3df0e1e4722807d61dd2a1d1cb16898eee34bce4817105af194cc9fb2f2cd9e5647fcc1d9853fd90361ff46f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959694, "uuid": "da64d52f-e2a4-4700-96ca-98144c3edba9", "value": "T11125AEC46AC58BD0C037B075B04ACAF3C7D2092AD099DAF138D7658A95D2E525CF68EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959694, "uuid": "846885c2-28db-44a1-808c-fd056e6aeb81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959694, "uuid": "c5aa4d02-8ddb-4a84-b61a-35de381a16ce", "value": "24576:W1QhklU0YNGeZnv5uLkXBazCamCbXzzJF3:We0YNjZv5uLkxazCamCb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959694, "uuid": "316883ef-9116-4bc6-8606-8bf198ad08d4", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959694, "uuid": "fbe43557-205b-4a3c-8d56-0bad4f8c00ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959694, "uuid": "32a0839c-8615-4dea-a437-7e8a6ab2fc72", "value": "EDQM 0080527850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edea31cc-d621-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1680967673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967673, "uuid": "5e4a98b0-f893-4877-b2d7-641de54eaf49", "comment": "Malware payload (PrivateLoader)", "value": "021db70d51c7eb264d8e3d201987de59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967673, "uuid": "86e340a9-2e2e-47a1-82f4-4d30a752558f", "comment": "Malware payload (PrivateLoader)", "value": "6858af2688d2e14af2f506e8a268045e38a9ee1a69759ded34c506c112910958", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967673, "uuid": "8a787271-5fc9-431f-8f52-bc5c41b77e9e", "comment": "Malware payload (PrivateLoader)", "value": "a149857a61bf22d84960f4fbc3fe39cf6b1661da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967673, "uuid": "409a3b43-5fce-4def-b0c4-0da5aa1216e6", "comment": "Malware payload (PrivateLoader)", "value": "fb6c1702f7453867579b01cd74882782d15e7c74d6b5860d6d7d16da66f180cffcadeb3bdd74112453ac73bb816a5333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967673, "uuid": "a7fdb4bc-6860-4feb-978f-b0ecc303712a", "value": "T13F844934E601F027F4F210329C5E93FAA428AB30675518EFB7D95E6A97B56C1E230B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967673, "uuid": "48bc141f-f8fa-42aa-9a99-009ab039424a", "value": "8eaeaee9e4e4c899dd50ffac2cff753f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967673, "uuid": "fc86e81b-e274-4b24-a6cf-8c1cd5ecba74", "value": "6144:W35lLu/HzRf/kUDUltCdq4Zqc0W50fC0pw0pN0Obw2z8qhqscwE4jxoMv0fXhMwD:Wp6RfIl0Y4OMIY4j1YXhMwLnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680967673, "uuid": "b714ff30-59e2-42eb-a420-b488b9194d58", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680967673, "uuid": "6302d642-bfc8-4d79-b05e-c8a18131d1d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967673, "uuid": "1e957387-df5e-41fe-89f9-b9242aa06548", "value": "021db70d51c7eb264d8e3d201987de59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dfb512-d62b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680971662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971662, "uuid": "865840fd-b7d7-4764-a27a-280c045d70ef", "comment": "Malware payload (njrat)", "value": "a5b557ebe1d8fcedabe2c1a0435a764f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971662, "uuid": "1deb9db1-c3c3-49fe-9946-5ca1f685f623", "comment": "Malware payload (njrat)", "value": "686eb16ea290b1fc6b574fa3d8d12b235872ba9d2fd338e3bb68ddf537c2673a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971662, "uuid": "09fd107d-c7b7-424c-a4f9-5abefe71f30e", "comment": "Malware payload (njrat)", "value": "00dcdf07da763837607091ab03c1c7fd81abb88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971662, "uuid": "b452e3a3-0be7-486a-93a4-bbab0a823a87", "comment": "Malware payload (njrat)", "value": "605b09b45002decac035d4dfab3ab481eccefc7349848ca1b1cfe3799fdeccdd174204c49fec31436ef0fcf3f02432a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971662, "uuid": "9c50b0a6-509f-4434-9ebf-29fd6107b830", "value": "T10DB2094E3FB98896C5BC16748AA5965003B0A1870423EF2FCDC554CBEFB36D91D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971662, "uuid": "8d70b962-38d0-4e25-b094-d5c1c8e20ee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971662, "uuid": "2f8fc1e2-ebcc-414d-8c08-39645a07871f", "value": "384:JRWKCWs5Mx/YZPxvnjmQdFxH84GlQ6rgdAyZxLdmRvR6JZlbw8hqIusZzZkbp:zmXAOvnjDdF9cRpcnuZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971662, "uuid": "33d40a43-cc6b-4f7a-8811-079f8e455177", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971662, "uuid": "46554228-8f84-4728-b89a-37a8ddef128a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971662, "uuid": "ddbe6855-9212-4b45-8dca-8b2b107cc808", "value": "xXsAtCuZMbCw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e81af90-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997148, "uuid": "d3506377-3e16-46ab-b50f-eed8c82e796a", "comment": "Malware payload (Mirai)", "value": "8481d69b935d2700fa3c349634241488", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997148, "uuid": "4b95a265-431e-49e7-858a-add2a97969ca", "comment": "Malware payload (Mirai)", "value": "6a86d7b2a8ff86323bdc58b5e9f22e649e1f6627d7da4c1e90a677c988af40c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997148, "uuid": "7a89de78-de34-4354-9fee-22e591b70b93", "comment": "Malware payload (Mirai)", "value": "17597cf05011211ce5610f6c5c0086e896d143db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997148, "uuid": "b6c75728-0f90-4027-b613-e6de21cb3961", "comment": "Malware payload (Mirai)", "value": "76c93640dce6ccfca9fd7fd145607b43b852421d8948484614866f99e9d6fe3dc8abb08da1701d366f84e5a530ab543c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997148, "uuid": "20affa99-f1fd-442b-8e1c-ed9262333f60", "value": "T16613085273090F17C05329F0127F4F918FAAFEE21AE0B5C1B56EAED685359F22046E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997148, "uuid": "8b159d11-3680-44a1-bd86-8908bf5e6307", "value": "768:onV7Rp4b82ciWTdGK7IuxdK9IlWS3CvB7QxC2TcwbZ010U5Mb:8c83VdGn4mSyp/Wb+10mMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997148, "uuid": "06148c64-46c6-41ff-a303-068433b50499", "value": 42500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997148, "uuid": "3570baac-0ba6-42d1-a350-df0484059a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997148, "uuid": "57d7f89c-e84a-4dbd-80d4-6ce11cf10456", "value": "8481d69b935d2700fa3c349634241488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf6c501-d627-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680970218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970218, "uuid": "20700a21-0e39-42d9-abf0-150c2637b312", "comment": "Malware payload (Amadey)", "value": "c68c4cdc800b972e95bf6b7e62f07def", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970218, "uuid": "475baf86-f323-4e60-a1aa-5b48fb3ecb38", "comment": "Malware payload (Amadey)", "value": "6aa0a2c3b3384d22a5bebd150426f1f4549035275229f3fa84debab0406f0f55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970218, "uuid": "9da97281-7240-4707-acc7-41c4f9035c0b", "comment": "Malware payload (Amadey)", "value": "a128b483ad439a217176a46a02dec714f50d3084", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970218, "uuid": "71120831-f98f-4c75-a097-939a22adc1e5", "comment": "Malware payload (Amadey)", "value": "6d343c336d61e7732851a7a9b75611dd07eb23ac1c7748e37723a3e7f9bd19b58f21983f82711eee422109be97f78662", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970218, "uuid": "d58e7441-0af8-41ec-932c-c46543b25c73", "value": "T12614C0227AD1C077D457C9349470DAA8BAFEBC519760868B33A83B6F2D703C15A3A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970218, "uuid": "b6ae996e-df2c-4cc8-8e6d-9369a7540f4e", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970218, "uuid": "bacff5b1-2b1f-43a6-ae7a-4abc303cf17a", "value": "3072:EqASwYR/QZId75Igqgvbh46rHI0zuvJkYx4fHkmRYnUBmV6TgC5rRcDR:zBR/mw46ro0zozOfkEuUpHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970218, "uuid": "bff7dac4-7e8c-443c-9d62-44706a2e1af2", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970218, "uuid": "406fa0ec-740c-480c-a008-c5394322bd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970218, "uuid": "76963bb4-f9d2-4f48-a8cf-54c4ba1cdb36", "value": "c68c4cdc800b972e95bf6b7e62f07def.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b739a069-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994210, "uuid": "8edf6469-8670-4f28-b0e0-71691629b3f0", "comment": "Malware payload", "value": "2562e190bb244a249e0b09e2e9b9d601", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994210, "uuid": "cd5ad889-7ece-465b-9adf-af5bf53572b7", "comment": "Malware payload", "value": "6b09d4ab63091f29af65bbfb57e05f4fdad1af7757ba0b7ae4b67859341deef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994210, "uuid": "18c2b8bb-255e-420a-9d50-fea4ef0e848b", "comment": "Malware payload", "value": "32eb8989d7d8974082ab88b8fd2946df06f21b9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994210, "uuid": "0ad13416-b9c6-46d5-9347-26dafc65d94a", "comment": "Malware payload", "value": "1cd026588a6b4980f23429c0a15af1cd21992fbb83d54326806723363588f633ce8c3f801036fcf8bfab2e6ce8369ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994210, "uuid": "491bde50-a83b-481e-88b6-fc100630b9f5", "value": "T19B238D73CC299E58C15986B0B0308E745773F554C29B4FFA18AAC7699083EACF5193F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994210, "uuid": "f333531f-bd76-4e44-a0f7-cc9b2a20be8d", "value": "768:aarBEte1bfphLbmzSGmmfWSCOqEdKdLF/caQobHRBSCCLplNaf1KRiI:aarCtubfphnNIuSfJKdLFX/baCCLWKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994210, "uuid": "2ccc9f62-db7a-4294-8106-95d3f1d5f84c", "value": 49124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994210, "uuid": "0b980084-a5aa-47db-905a-2c8300b1d36e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994210, "uuid": "1a3f35b9-f7ad-42fe-86f3-16725659ddec", "value": "2562e190bb244a249e0b09e2e9b9d601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117386f2-d5f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680950123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950123, "uuid": "a5a1bf2a-e6ec-45f6-90cc-105d7f553366", "comment": "Malware payload (Amadey)", "value": "26f96d632b1e1e474469ba9c75a72ed7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950123, "uuid": "d9913eb3-e4fe-4ed2-9f27-7a72e8c8fd1e", "comment": "Malware payload (Amadey)", "value": "6c84778bc48d97d531a100907fce48025f4b9b49bf2df65a08a98af6e133d64b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950123, "uuid": "e151eb29-e4f1-4fd7-983e-d7e6caf7da3f", "comment": "Malware payload (Amadey)", "value": "af15362cf1d775d89e28860866f68e14a8636053", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950123, "uuid": "94f16fba-84bd-46f2-b369-c65a378582c1", "comment": "Malware payload (Amadey)", "value": "76eb0edc2e96ed4d9e9a1d7a75f885ade74a499f4f2fed7ec9dec0dd0467dae8ed23b8c57d2944b33d32ad7e35ade4f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950123, "uuid": "b93b0d9a-d190-4bde-b1d9-1556cac8985e", "value": "T12816D0B0C8834A572261FC76FDE85A7B5EDB21BE411FD84E0AD6125DE784EF83CA0641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950123, "uuid": "5b8ae1d2-3460-49e3-a235-7c1c7c28beeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950123, "uuid": "2c52a18a-c9cd-4869-a4a1-0fc03ca5a61a", "value": "98304:tI1FeWZ2aTUUYd0RaqDVq4NDWcn3q+ax4tOkw+0Fi30:tksWQaCWRaoo4paetO+cik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680950123, "uuid": "8f6ae163-eb69-45a5-b03e-1ecd5f53de07", "value": 4372992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680950123, "uuid": "eacc51da-d004-4846-a4e1-524a2af5b454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950123, "uuid": "d0c1ebaf-2cfa-4f0d-add3-ffa16d792cc2", "value": "26f96d632b1e1e474469ba9c75a72ed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33dd9904-d60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680959200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959200, "uuid": "0cc94a27-7e71-4709-98ec-874b0c1ba7ef", "comment": "Malware payload (RedLineStealer)", "value": "557476098e71a8dd02d2334e88c2bc58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959200, "uuid": "4f4a5530-3dcd-4a98-9f5a-c7672f6b2519", "comment": "Malware payload (RedLineStealer)", "value": "6dc5fdb2313c5624d945c0606617c7bc7959cb1175ad3c33b9a6ac11ffc07da2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959200, "uuid": "9871238d-2cd9-4e59-a7fc-c32d61e22732", "comment": "Malware payload (RedLineStealer)", "value": "d0058af5011db4d55ee5937d566786a0e09b8807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959200, "uuid": "a54423e2-1546-493d-a72a-097e326a46fe", "comment": "Malware payload (RedLineStealer)", "value": "cafe0f4f24cc4e02f3eefba02970db8ec158c882ea9ab2dcc7ee90f21fa830b2e0ee0726bc38c5ab4f8c6c692ee566fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959200, "uuid": "a9ad8112-96dc-42a5-9f54-ccf358686f3c", "value": "T15415234367E484B7D8B52B7148F702832F39FC619998832B7686E85B1C73550E9B272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959200, "uuid": "f60f702f-33d1-47b0-aa20-d7f2d349e622", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959200, "uuid": "19301eed-6a39-48b1-8e07-0f13af73cb67", "value": "24576:yy6Pydrs7iaIzZjd6ENucWzH/rSmvGDK:Z0yR1a856eucWzrS4GD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959200, "uuid": "af971d62-304e-4ca0-9169-9e201c693a56", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959200, "uuid": "24c4665f-11f0-44ab-87a4-cab98e23b4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959200, "uuid": "c02fb97d-0cb1-4350-8a58-513e15b9c4e4", "value": "557476098e71a8dd02d2334e88c2bc58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc6b3b4-d5f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680950087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950087, "uuid": "1686707a-082d-4328-957d-c4e5cd3b66fd", "comment": "Malware payload (RedLineStealer)", "value": "13232d4c8bafe88755fdc136a14dcc10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950087, "uuid": "55056927-5451-498b-9af1-7197e4e01362", "comment": "Malware payload (RedLineStealer)", "value": "6fed2ab08446e6cdb2c0ba81f108d3eaf5186ab8f45d6cd3d27d86bcf77a99e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950087, "uuid": "5a273b55-76ac-4be6-a6a8-e2aae10d2b7a", "comment": "Malware payload (RedLineStealer)", "value": "acd59c76665f727375db3fa6b951236a4ddb5856", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950087, "uuid": "16d88b0a-03af-4bef-9211-9d1a71dd53a4", "comment": "Malware payload (RedLineStealer)", "value": "69e8a8b12504c40c777a84e251f7b059e4484d0141dc92dd120899d7c055e8b6c7773256d9b66a4b0deb3f8127db7440", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950087, "uuid": "7a591627-baf6-48f8-ac2d-9c27daabbca4", "value": "T1B2352302B7D05436F8F42BB06DF64793473ABCA14D348A9B7746D85A0EB1184A93A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950087, "uuid": "e030ae92-3c98-41df-9ea7-61e81eb246dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950087, "uuid": "fa10f190-246c-4b4f-8814-55aced807295", "value": "24576:sy5avnxuIDa8/QmI+tpIBlGSmsS3M6qP0d08x2qf3S:b5GxuIDa8YmwBldmsSq0i8sqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680950087, "uuid": "57f792d8-0297-4f0d-b272-6348a6745bf2", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680950087, "uuid": "857f704e-8ba6-4a90-8a4d-98187bf751df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950087, "uuid": "be2a7434-d138-47a4-ac25-35cfdde8d99c", "value": "13232d4c8bafe88755fdc136a14dcc10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ba98f8-d5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680947088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947088, "uuid": "c3b0a1ee-0b62-4aea-85bd-779e90b335ac", "comment": "Malware payload (Amadey)", "value": "23ca8b7ca080e6c9ef8610cb060346a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947088, "uuid": "3e07a6ef-e246-4a51-a56c-9666d54ce412", "comment": "Malware payload (Amadey)", "value": "71bf3f169694a071ecf57ca50a1cab9f09a42bd63e744dad76240f41c5a8146f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947088, "uuid": "2ee148e9-426f-441a-9d65-863fdead71fe", "comment": "Malware payload (Amadey)", "value": "3656a2a97867b4cf634f20747a929dd79cabac5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947088, "uuid": "405e8bc1-a5d5-452a-8415-c9b0ac5e6572", "comment": "Malware payload (Amadey)", "value": "c3efaab2b8a0ea0707c65b1b991dfdb334e9a55f4a85734c005d42f96a0cae644adda4a9c8e0035e94f52e8213cc391d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947088, "uuid": "4e997992-e196-455b-9ea8-f5f1a679007c", "value": "T159152202FAD86572D9F51BF09DF307C356353CF189B882AB2789ACAA0D71641A13476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947088, "uuid": "2e422304-6be8-4249-a250-307c09266c5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947088, "uuid": "67d220ad-70e5-44e8-a240-abd931c1ba27", "value": "24576:FyQW+HfZdGkmAk54/bGO+pVbS+2AbL1YQmLDYrgUTygku8:guf3hkG/bGOiVbS0hKsrgEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680947088, "uuid": "8aadb4df-7341-42ee-b5d9-b9ba319f94f3", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680947088, "uuid": "f4d748a6-9f49-43d2-88ed-0df2450e8946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947088, "uuid": "5f32a277-3cb0-4618-8b9c-806b0de7dbf2", "value": "23ca8b7ca080e6c9ef8610cb060346a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0d7d93-d612-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680960934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960934, "uuid": "2cb25119-082f-4bd4-b51d-c0f188779162", "comment": "Malware payload (njrat)", "value": "61e0777507d727a6299b239107be602f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960934, "uuid": "4ac959c4-838d-4381-abd9-1bcc6cac922f", "comment": "Malware payload (njrat)", "value": "72aa28d35d6e72ef9aeea4197a0ff12a51e60c52b281840fbcb659516432a688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960934, "uuid": "d180567b-d26d-4c74-a14b-90d02b479d95", "comment": "Malware payload (njrat)", "value": "2f9b9881aad18dde68a49a408947d89fd0a7dab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960934, "uuid": "09f560fa-6a0f-442b-b679-23fa48669e3a", "comment": "Malware payload (njrat)", "value": "e46fc2be505de10a0e4c745109e92e27ad33e5985d97137d9566ef87cfaf3586aab896f414b8080d3007b6e1787ebe92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960934, "uuid": "b3d22076-3da1-4b23-8359-decf04bfec7b", "value": "T1A084C0083F59E674E190DEF6A5767000DA5AED122ADCEE44AE7A3DC7C63BE04740B067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960934, "uuid": "294d6439-0ccf-41b1-b37f-1be3d2876ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960934, "uuid": "3049aac1-5e2a-45c9-91e6-8c92af182ac5", "value": "3072:Iu9sK3M+yJSxLsssssssTsssLssssssssssssLgsssssBssLssLsssssLssssUoq:L9sGdH1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680960934, "uuid": "75af0758-9a3d-420c-a590-1473eb5abcb0", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680960934, "uuid": "5bcd4187-55ef-4c34-852d-6a57d5a17c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960934, "uuid": "2dbab789-a5ef-490f-a907-351c9c81b528", "value": "61e0777507d727a6299b239107be602f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32967b7-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994176, "uuid": "584ce6d0-0666-4bcf-b5e6-07cc7dd69bc4", "comment": "Malware payload", "value": "9aca975366691f6ff1a25eea63cf95b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994176, "uuid": "3cf554db-3343-4457-ac6b-e3e82c83b8e7", "comment": "Malware payload", "value": "72b9966c17fc52688e2ac4691f32cf6cb01a27e7c97e16be3e82ff6ece4030fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994176, "uuid": "32b64663-681c-42e0-988a-499e69e49c07", "comment": "Malware payload", "value": "c1075fbb7ebcbb2186882616cd2f15bfd0fc6f78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994176, "uuid": "e6607136-0b46-462b-866e-7502e26a9edf", "comment": "Malware payload", "value": "ebde2dd1c64426931606d67d9abb158836aaff76f6284048d501da63998141376739b256b37ffbe7e8df98e515e2656d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994176, "uuid": "6ae3784c-717f-4cca-b739-53a505dbdc2a", "value": "T11B63290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994176, "uuid": "63123995-f3fe-414c-a4f4-29a4dffe4488", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96CTf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS689/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994176, "uuid": "c2f3a9f6-efb3-437f-9b85-a7125ec97558", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994176, "uuid": "6540e704-00cc-4eae-bec7-04246b640a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994176, "uuid": "631de1c4-ef8d-4f09-b0aa-0aacc3a9bbed", "value": "9aca975366691f6ff1a25eea63cf95b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b53e14-d632-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680974719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974719, "uuid": "14695f9c-c87c-45cc-a6f6-e20334d01963", "comment": "Malware payload (TeamBot)", "value": "f25e189cec89abdc82c277c92149e84f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974719, "uuid": "d386d381-5211-480f-902b-935f85dce8ea", "comment": "Malware payload (TeamBot)", "value": "74ee8a01057756cf513978af26ddc53dc0e00eaa54976fdf1b0567dacb116069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974719, "uuid": "9f30105c-593b-477c-823d-4fad3f90d0d7", "comment": "Malware payload (TeamBot)", "value": "a0a9f94b982b1cf62a8ac590ff15d97d6317dcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974719, "uuid": "9fcd8de7-786f-4873-9e92-0c6b525d5b8e", "comment": "Malware payload (TeamBot)", "value": "009d0e91964ece8e4dfc99a21dcea115c3420cde41611423bc67f8eaab2e26efcf4903302b190aad25612f302895afba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974719, "uuid": "e92eaf71-975b-46e5-a593-68ec7cd0ea81", "value": "T1A214CE217AD0C073C8774A755B60DAE46A3EFD62AB55818B23683F6B2E303D19766313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974719, "uuid": "646bfe00-997f-4e8b-b09f-b0e117ac2a84", "value": "b57501f26cbd338c9d36004199e16398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974719, "uuid": "c29daad0-3774-4810-99f4-50f9d8c537c8", "value": "3072:8n4NLr/BPWfqXNrbG4CuqnUte8FNo5+Z9WRq:+8LN+SXpC4n6Ute83Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680974719, "uuid": "4613f039-d18a-4244-8c04-4f0e99624942", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680974719, "uuid": "08839c16-2d2e-4d56-aa87-f6d78f039d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974719, "uuid": "926b8713-5417-454e-b81e-38a504bac94b", "value": "f25e189cec89abdc82c277c92149e84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb427ac-d5ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680944803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944803, "uuid": "90b5334d-d7cf-4956-bd76-833c72ceb4b0", "comment": "Malware payload (RedLineStealer)", "value": "12fd174da56c787b22a284f004c94692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944803, "uuid": "462bd9c4-fc34-4ba1-809d-276b2b9a49dd", "comment": "Malware payload (RedLineStealer)", "value": "750bef67d8387c891f9f24da3e4e99be9fd57789d2490a1441db0455b1af0a82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944803, "uuid": "48f12b89-be3b-4b50-b9e5-37d07ee1e2dd", "comment": "Malware payload (RedLineStealer)", "value": "7fa1a938238ed8c2d2a5fa4ed2c4a1c2c63c4842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944803, "uuid": "a5716fda-b620-417e-860c-de9708ed31a7", "comment": "Malware payload (RedLineStealer)", "value": "5b577d40199f309b95c5bf22bc449f00e016d3d522e5144d7f27cb520ec4480affa0f92a9d516429c2fec9ccea1c2972", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944803, "uuid": "817e0b7d-69d8-4e88-9b74-eac7d163169f", "value": "T1E1352363B3E45072D8F41BB01DF302835635FCBA6D7C82A6760AD96A1DB15C1A53A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944803, "uuid": "a8cef4c5-fbe0-4837-963c-c071729e2672", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944803, "uuid": "0224f21d-8efe-4fb9-9c48-e8e1bc6e89c6", "value": "24576:tylbKC6KqYAKinMMaG1iGc8mYSmC/7PmPt9hEP2taNOt:IlwzfnMFG13xmYSLmzhEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680944803, "uuid": "f916e7d8-8c60-4d93-bb29-6fd56ddc1caf", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680944803, "uuid": "756645e6-93e7-41d0-92f7-f35846b0b1a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944803, "uuid": "6fa4ddf4-b22b-4ebd-97e1-b9723edc31bf", "value": "12fd174da56c787b22a284f004c94692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db02c08c-d63a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1680978378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978378, "uuid": "aa308b3d-1ad8-4aaa-bdcd-8ba2ba0416c5", "comment": "Malware payload (Formbook)", "value": "a57db5986573474a73f90e3636916805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978378, "uuid": "38b717ea-a86d-4aac-bea1-45e029a41f97", "comment": "Malware payload (Formbook)", "value": "75583232ee4a3c0e7e7f6f996b83ce4bfb4d5274a484962490147c285a58a623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978378, "uuid": "f99e50b4-5fcc-4a03-a731-1bb6e9c5e265", "comment": "Malware payload (Formbook)", "value": "05ad4f952565f8d4ab8e8d290c4656af3acbef75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978378, "uuid": "33e10bf2-248c-48eb-baf3-4675d036b81d", "comment": "Malware payload (Formbook)", "value": "c2eb8e14fa0255b9769acfec0daeea674e3f2525f53996129082197e0075ac4885df7b88a95ebadc3227a58ea9d0583b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978378, "uuid": "3160b5e5-74bc-4285-9e8a-4955ab02e6c6", "value": "T189A64B23B6E6DA66C6AA1777C6E652054FF4F8936213D60D308D23693F93BB14902733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978378, "uuid": "aa5d0bf6-d4c6-45b0-8eab-eff4119af5ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978378, "uuid": "cc40d98d-6c2c-4e21-a032-83e445dc03dd", "value": "49152:z+V8VP0/lXTYduaslZb4+sOpGdwbZKLXZmBGrxFnIqegHOnXt9HB2FDXP/QjkgSd:k/OpiZSOpvurxFAMOC9DRusl7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978378, "uuid": "a371b6ac-0f85-47eb-8351-040d731c3863", "value": 9892352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978378, "uuid": "b281dd71-5d98-4168-9e58-f59ab5f8521c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978378, "uuid": "5bf29cc5-fcf4-4292-a6a5-742f49d3fb7b", "value": "Vzofatscvj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5963f301-d657-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680990616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680990616, "uuid": "7192609a-d9a0-41a2-b5c3-6e945bf1952e", "comment": "Malware payload (Mirai)", "value": "d219cae24ada1bd4cd696e9830d8d96d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680990616, "uuid": "a70958f0-d13e-482f-a125-a73d57eebcae", "comment": "Malware payload (Mirai)", "value": "768d8a5e0bdea22776c1570bf82e7c8089577c7d44d0dee87101992c7bae9827", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680990616, "uuid": "0ecca310-33fc-4f3a-99a8-24dc21f403ff", "comment": "Malware payload (Mirai)", "value": "4d1b9ec042954e7c2ed9348629318b7936822a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680990616, "uuid": "9f63022e-8f63-40a4-aa74-574a5917755d", "comment": "Malware payload (Mirai)", "value": "fe4a326280f8af9c451a61aee1425b3d22960cdff61d9cf14b873a9ac7deca03e50475483d03da20a783885ecc80bbc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680990616, "uuid": "097f178d-8ef1-4991-97c7-06ab9d9e0336", "value": "T162B339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680990616, "uuid": "35747c12-861b-44ad-b7c0-762638ad8987", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJioub2yd1m7FnVqfJXoebNb:SKo/O8qtUbKRbm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680990616, "uuid": "a87f2811-1d49-4fb9-9f82-2cb9aa754151", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680990616, "uuid": "bbedcbea-47fb-4691-83bc-22ab64bf000e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680990616, "uuid": "553f964f-4c4a-44e9-847c-9127b0fd6817", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6718c2e-d5a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1680915181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915181, "uuid": "57497f2c-4e40-459f-82ea-d50b35cc7cc9", "comment": "Malware payload (Vidar)", "value": "1653c6e48dc26b080754dc104beef94a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915181, "uuid": "4321dfd1-563b-4fb9-b7e0-fb3714cc7ad3", "comment": "Malware payload (Vidar)", "value": "784bb9d5ac9ba16cbfb56d482be25437effc2cca13120d5947782d7f1974ae46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915181, "uuid": "850dc85f-b258-44c0-a690-00bb89e4cca6", "comment": "Malware payload (Vidar)", "value": "13934340b86a525340e1b020fa87ae4347b0232a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915181, "uuid": "39bf7048-141c-48bd-8ca2-994a86f39765", "comment": "Malware payload (Vidar)", "value": "11a9604f24f422558155687d6f1be31d4bd2e4f6c8c0772a89d4bd55c72c3368d68b86cd56853fee32098674989c58d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915181, "uuid": "56823dc4-90c8-4970-a46e-da3fc82ac780", "value": "T105A4D04331DA2021D472D3F780F2F25E12EE696133ED29DB36D8E05F5D191612AACE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915181, "uuid": "551b2ec3-af08-4eb3-8adc-c000de70192b", "value": "a0e60cc838fd0f681073acc8737e4ec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915181, "uuid": "e81cf411-ff54-42c7-be79-b390b7711259", "value": "6144:yjWJy5sBMxsNixbVvPxx7GcJac212xorx+gp4FWDpnuUgMavx7tedhpW9:wWJwsNiLvZLw2usgp4FWD9gNEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915181, "uuid": "f20f4f1f-43e7-463c-b106-02e588d222ee", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915181, "uuid": "af16726e-b113-4a4c-8b75-346190425a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915181, "uuid": "0b5c0b31-ac08-44cc-af27-3bd3c20dd797", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfdeac8-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976934, "uuid": "e988ae91-f921-4467-9368-c5bc55b8a6be", "comment": "Malware payload", "value": "310b02e1da6639192d8611927027d8cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976934, "uuid": "7539efce-d202-4231-9f03-afb96df47bf4", "comment": "Malware payload", "value": "78d4fce0c253356bf72cf72f260f27a3f0f3cf0a904a3618f3011cbe0b4e882e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976934, "uuid": "f75e3701-4073-4e75-825a-c43ece65ac5e", "comment": "Malware payload", "value": "ba5c0be3c0742a8119f701490f3f01b3b6abf49b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976934, "uuid": "f2e4a0f5-514e-485a-8daa-e7c376467cc0", "comment": "Malware payload", "value": "fb18caeda8b91799e4083f2004bc6845d264cd0d062514452264375bf077fbb13a99241d1153d6578f10ad951b618486", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976934, "uuid": "824d300e-0104-4c25-9fbf-4b4930074701", "value": "T135449E026612D477E4A708725B68EBA2A0B95D30476E81C7BF40EEB51A39FD2377C347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976934, "uuid": "9944881a-4c14-4dfc-bdb7-932d229428d3", "value": "50e1f8f4ffaf0027d5b9f05d6a625798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976934, "uuid": "05b57178-505b-451f-b91e-d22b5727599c", "value": "3072:DLhtgSlZAeKoNhb64VzKRJWpLXOe/TYUAk/M2lH0+6m6MU0NTMnr+rtnd9mTRp4r:PsxWp9TYUzX6Zm6MU0NNgX4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976934, "uuid": "f0071065-61aa-409d-9a24-9d65a437e0b4", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976934, "uuid": "d454eb42-7593-4ca7-9c2d-9c130b2eb9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976934, "uuid": "c87b09aa-f8b4-4e3a-979c-e698b8e567ea", "value": "2023-04-07_310b02e1da6639192d8611927027d8cc_teslacrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bc2962-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997180, "uuid": "ca0d15f9-751a-4329-9bf5-64c187803e24", "comment": "Malware payload", "value": "e1762eb8cb535400397dd876bdd7d02a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997180, "uuid": "5cc6eb04-4c33-4c5f-aed3-589e610eafc2", "comment": "Malware payload", "value": "795628ee91fce16c178849675ce3bf071925976fb08e0432265f9c93901b064f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997180, "uuid": "c7a9d414-72ac-4d23-983e-f7af550e6348", "comment": "Malware payload", "value": "184bcce7b93289cc2ada0cbef296ea15d974fffe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997180, "uuid": "c08045c3-6bf6-4d73-854e-32c4238a2b99", "comment": "Malware payload", "value": "34d630156bcc9eaf2cd356ae982f21e12cb054af24ac5397e2ba2f8153a5177b19fa7e01416c9577176cfef6a9f905e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997180, "uuid": "d3ddd51c-05f7-4883-8824-996a849a4537", "value": "T19DB3942A7E22ABFFE168863107F75F70879521D227A09386F26CD7181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997180, "uuid": "edf76a99-d856-4a10-bd11-39e629ab23f3", "value": "1536:V7j+1TuBq+bkYQg2rKlJWl/SgEThaAClfGemoJnimWt0zFufCy/02vI:okrwSgE0tlfUoVimWOzFufJ02vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997180, "uuid": "a874ba10-0030-402c-806b-359d2b068221", "value": 113280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997180, "uuid": "0264f968-1a7a-450a-b8aa-80e5144c1fd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997180, "uuid": "3a1c3a22-57b3-4f9e-826b-9393eef52099", "value": "e1762eb8cb535400397dd876bdd7d02a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec5ca3c-d5f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680947729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947729, "uuid": "9c5bea04-9270-4617-959e-ac06dedb5c2b", "comment": "Malware payload (Amadey)", "value": "25538f7f0ae242c6c4d653eaa344a28f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947729, "uuid": "115f2d6a-f074-404c-8659-cdfea982b122", "comment": "Malware payload (Amadey)", "value": "7a420492a6b132a40688165f244fec62096338b64d77e8921d587b33c85b71fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947729, "uuid": "7d818bd0-4485-45ab-b8d7-d87d6784deee", "comment": "Malware payload (Amadey)", "value": "25d0aa974bcc360c07fe7203245edc9845f585d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947729, "uuid": "614dd21d-1595-42dd-bd3d-74158587df77", "comment": "Malware payload (Amadey)", "value": "67da9feb580f566d76c6b0d7ae63a28f5272cbff7a486966edfd2aaa59e36b6fd3a78ba788cff192b1b93dbd6c9ecaf6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947729, "uuid": "00ecf704-3bf5-4d03-9239-bbc58451be60", "value": "T1C7652342F6E42872ECE16BF05DF303E31B313DA1A875439B760BE59A0C7258590757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947729, "uuid": "3ea6f36d-45ef-458e-bf43-7c5a30e246e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947729, "uuid": "9d9b4085-c6e1-474d-92d1-04b078825448", "value": "24576:Eyiw+Xmg+5Ej/M+o/V1v4kaFSwLJ5eEjk6WRvOG3Pvm+SawIXPcJEpBfeys:TmXM5Ej0DV54bdLJ5eEjp0vOG3Xm+Sqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680947729, "uuid": "ab84953f-1fe1-48e5-9223-ee6a78a7a579", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680947729, "uuid": "a1e50e7e-9a89-4628-8fb2-84c9fcf35c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947729, "uuid": "c7c846a8-1d48-41c7-b29a-a547f1a97fe4", "value": "7a420492a6b132a40688165f244fec62096338b64d77e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5c8c2f-d63e-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1680980149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680980149, "uuid": "f5ca4695-9e1c-4eec-a221-369b9fd564c4", "comment": "Malware payload (NanoCore)", "value": "129940eb6b4747b1569e7da5f37157db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680980149, "uuid": "dfa05c2d-08ee-4cb7-942e-8b9ef38483f3", "comment": "Malware payload (NanoCore)", "value": "7ba9294f10f99747124f01c3564c8a127057507932edda9806476f186e534c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680980149, "uuid": "f5453c30-e590-4f71-b34d-a201f3102974", "comment": "Malware payload (NanoCore)", "value": "833dbea5d5f6f2b6bf1f24d9ca2c6d807804b6d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680980149, "uuid": "f47589a4-5a17-404e-aa31-7d4c0a2259a3", "comment": "Malware payload (NanoCore)", "value": "8faaed5ddfd7d63635e0d870fdd30cdd2a2aa3ad64f77c9d9fc1e30071bf3e70dc86a30f1d5c70aab7227fe3a650215d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680980149, "uuid": "5ab2abc2-a1e3-4cae-85a0-c614af082866", "value": "T1EAF4E08C3751B59FC94BCD3AC9541D64A221A4B7530BF307A49728ACAE1EADBCE111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680980149, "uuid": "efe219c6-2119-403b-9598-cb77cb075a32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680980149, "uuid": "ec38b98b-eeb3-49f3-bd50-2465d6e1a6ed", "value": "12288:z1VLXCxGmsXPqiPnXkATcCPqcPRh17SMJU9fkPCldfKVWjzDYRw6gXZjZ81GidIL:RVLXkGXPqiPnXkAICx5hxSM68ydSqHp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680980149, "uuid": "5ad254b9-7b96-4d21-b73e-7f6665db27a6", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680980149, "uuid": "e796dbf0-ed27-480a-9aa0-1a47293862e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680980149, "uuid": "5f7f2f23-9907-455b-812c-541ee798a874", "value": "129940eb6b4747b1569e7da5f37157db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c44f58d-d65d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993171, "uuid": "22ed8dbd-881f-4a99-8f45-c3343a388c54", "comment": "Malware payload (Mirai)", "value": "5570920b201cc9ac6a49ec0d752e0d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993171, "uuid": "c5731434-627e-469a-8793-b0f09d05bdd8", "comment": "Malware payload (Mirai)", "value": "7bbe4653487670853fbfad5728a4faed1412ca7f7ef4faa7fac585d37373941c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993171, "uuid": "700c4b31-7ed2-4612-8c4d-bfd928e68a4a", "comment": "Malware payload (Mirai)", "value": "9dc538b7d98084c77f00e29f4fb32059dc246360", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993171, "uuid": "d15e4cdc-3d12-426c-8c69-44c0faa6f1e6", "comment": "Malware payload (Mirai)", "value": "7c572564648758dfa211620fd3a5f25568a11cfdadc452d7cedae8d8699a8b2329cfbf28c3386b388b457c3fde94b71f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993171, "uuid": "b4abe268-1b9c-4284-97de-ad2a2a4a162d", "value": "T1CF438D17684180FCDD9EC1B52B9F6635D633B1BF02B6B0166BC8ED625E5CE205F29AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993171, "uuid": "f1036026-585a-4638-9d4b-b8f7c6f3ae83", "value": "1536:PUl7sMFk0xAv8a7No4qziv73+MPF8KQTDIO:P8sMF3A0aK4qu7+MPF8KQT0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993171, "uuid": "6ec81c9d-e740-419b-8fc6-60e45d7ece88", "value": 56504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993171, "uuid": "cb6bcdca-03db-4dd3-8491-793abb7a0e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993171, "uuid": "2a1a8d82-b66a-4c4a-9d52-930d86a43bf7", "value": "yagi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfdcb31-d5ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680946196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946196, "uuid": "d4feaca1-c9c5-4b7f-a654-170275cfd44b", "comment": "Malware payload (AgentTesla)", "value": "adddf2f66c039150e14110080232b8d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946196, "uuid": "f17b8748-e0ac-468d-98fa-8c9ce7f8e9e2", "comment": "Malware payload (AgentTesla)", "value": "7cd0e2323c558d785fee043074b2b594b65a328002b48ff699980d57ffd72c65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946196, "uuid": "38de4dcd-f890-4aed-a2cf-088ddbcaf171", "comment": "Malware payload (AgentTesla)", "value": "28f27527502a36c6234e24824ca05a34191e113d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946196, "uuid": "b8be8f42-6eab-4672-b894-d50ce2d9b030", "comment": "Malware payload (AgentTesla)", "value": "31e17f185e5fbda195bc524095e719e946d88497388b1b6914251995c7a0bcb769042f8723abbe0e8fdf510495ead7d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946196, "uuid": "313abf34-9651-46bb-8d06-dda49c85c1ad", "value": "T139055BC43AD68E84C437B030F059F6B2C3D21D2BE0999EE13897697592E2F551CE69BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946196, "uuid": "710e343b-5e8c-4484-9871-14d067d39fd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946196, "uuid": "76df8499-6eb5-4611-888c-ad6dd182bee6", "value": "12288:KdAVGJRibzkheI4Ic2TBMKGup8SSwQnjxG/yVgh2eVh:KdEGJwbgh9k8AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680946196, "uuid": "f7fae8e8-df8a-45d6-9234-641c5d301656", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680946196, "uuid": "9095e7f8-abe3-4c54-b915-8e8dee223252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946196, "uuid": "ff63f09a-b23f-4eec-a5a7-760c7af4c4a2", "value": "SecuriteInfo.com.Heur.8043.16064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45d2247-d5f9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680950423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950423, "uuid": "087cbf5f-00cb-47e5-acf1-c6d4361d7f7b", "comment": "Malware payload (Amadey)", "value": "758c1e5167a1c8a7be2910eaae90f5e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950423, "uuid": "827fb887-0ae2-40f0-977b-12905ae5f532", "comment": "Malware payload (Amadey)", "value": "7d45b816c9f93dbce3a418112e7f8b17bf327e6c2de205b2d259e1e67004910a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950423, "uuid": "76380d37-063d-4491-b378-7feacf58a045", "comment": "Malware payload (Amadey)", "value": "1d6a3162d0568560563cd399d247b3a6e256e12b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680950423, "uuid": "2e4aab85-671c-42da-9021-9d0bd0579a6b", "comment": "Malware payload (Amadey)", "value": "06ee4494c2b44e9e8f2045d1308ad7b9335efbf6e781feb7d601d2ee5db5941f851696d7c384b0459af8b583373087d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950423, "uuid": "db7a09f9-7ca8-4571-9046-9366b5168536", "value": "T1F614CF20BA91D4F3F45384348461CEA479FEBCA16B9086AF37D83B3F2D70681966A351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950423, "uuid": "47556adc-e297-490f-b473-a20d04660519", "value": "7f2f76766a962f8a0db702cc8033dd98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950423, "uuid": "46d54f9d-f414-492a-8373-456ab8fca6ea", "value": "3072:lE9lmvCXlqa517XYrBN9gngmRdonHPjgKLZ4513dhr:lqQviLpXYrlggOqHrgKLa3dhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680950423, "uuid": "5d2d23f8-74c3-4f53-9246-9e75e11bfd7b", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680950423, "uuid": "2da56414-cdac-42e1-b988-c90bf5d6048a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680950423, "uuid": "960c7da1-ee57-4575-bc95-6bf0dc98c14f", "value": "7d45b816c9f93dbce3a418112e7f8b17bf327e6c2de20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582dea64-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945517, "uuid": "6a42ce0a-31aa-49d1-b12a-2d8d0ff0f136", "comment": "Malware payload (AgentTesla)", "value": "c68bc4e1718162606d1517101f334733", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945517, "uuid": "cd1898d0-b1e8-407f-bc7a-3ea5d12c87d4", "comment": "Malware payload (AgentTesla)", "value": "7e17a027d74d0e978c7ff2b028fa3bae217f620fed52c5a675ce09306519e09b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945517, "uuid": "538d1e94-9397-4c5f-9958-412aa8c2d2ea", "comment": "Malware payload (AgentTesla)", "value": "8b8e070b9fed621c991f57ba4a4c8e9757d1be27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945517, "uuid": "14d76b53-47ab-4d83-a4ba-308bac4fb603", "comment": "Malware payload (AgentTesla)", "value": "40e8961ae5367beb2b6f322db8111ce4bde0e65e27f7291ceaba773d9cde1f2e148826845937d26f5d3722f3ef267953", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945517, "uuid": "18d48245-3835-4784-b3b9-e7cf054c9357", "value": "T1D6C4E0E0460ACA7BEEFC1075E01901A46BF3BD74E160F3E73D997492A7B27978362506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945517, "uuid": "7f7c0195-3619-454f-9805-c49edc7ea249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945517, "uuid": "7ac0a2f4-519e-42cf-9460-6fe93ed0a22a", "value": "12288:sUxzDnnFy2G+hTJss1k45j5dS2EGMj0aP46OD:3nFNRqs1z5jTSNHfg6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945517, "uuid": "4e529053-0a23-4477-9d5e-f0f2f035054d", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945517, "uuid": "09edb2dd-6c5e-4da5-bbc5-6a0c8931b569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945517, "uuid": "89a5ecfb-f611-4f4f-97af-2e8f1cc86f23", "value": "S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a646a147-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994181, "uuid": "1407be6f-f536-40cb-831c-58a2f028569e", "comment": "Malware payload (Mirai)", "value": "a30c43b644f6fe50d494fc9c382c2d8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994181, "uuid": "21ee8ec6-22e3-4cb2-8266-cef9b24892b0", "comment": "Malware payload (Mirai)", "value": "7f59b894507b67eed4068a3dc132310af5f9e078384a44ec8e5df14fdb17d2de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994181, "uuid": "bd3ff24a-3a6d-4821-86eb-7a63db56080b", "comment": "Malware payload (Mirai)", "value": "b73ac24930c494f4078aca35fad7a61ca0f7a2b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994181, "uuid": "14ff475f-bf0a-4b63-889b-ff5f9be0df62", "comment": "Malware payload (Mirai)", "value": "537b01621de9ddc58d00ed1d986d8bb651c3013931a6a28c853257f744adc1ffcf568427fd5064fbeb1120c3aa6836df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994181, "uuid": "f4d5f6cd-b9ac-4a55-92a9-00d2f62af814", "value": "T10E433A91BC81AA13C6C4127BFA1E42CD37265398E2EF7303DE266F10378796B0DA7655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994181, "uuid": "4282c0e6-9fa1-4914-800d-1ed2197d9c2a", "value": "1536:b1QM24X1EIkRZOKeHLG9PiioJZjdas/LzTzlfvz:b1JrePGJZH/fxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994181, "uuid": "89dec1a0-c7b9-4b8b-811d-2539474a243c", "value": 58680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994181, "uuid": "a20fbe14-da69-475b-bb08-e7aa09e4334e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994181, "uuid": "1df18ea3-0bb7-4633-8a72-c9c612da8f5c", "value": "a30c43b644f6fe50d494fc9c382c2d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedf7573-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997202, "uuid": "f524c425-64ae-43c5-90fd-3289fcf4114b", "comment": "Malware payload (Mirai)", "value": "b78b8897b61ad91286d655b795c16839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997202, "uuid": "c8b2619c-2ae2-4cb8-b7b7-1f439c6f7f6d", "comment": "Malware payload (Mirai)", "value": "800618ba6d2c9f48d2cd8e8e7ccf451e13e34794a14bb63845a253c673f63973", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997202, "uuid": "12d5399f-8836-41b5-b67b-f83264593355", "comment": "Malware payload (Mirai)", "value": "75641378414ea05a09affbf3d4500d02a1fc37e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997202, "uuid": "8f4d8411-6845-4d89-b764-2fc290602e51", "comment": "Malware payload (Mirai)", "value": "2e4787193e89de9a9eed95d856119efc28523b47b80f61a9b814aba570a04118295b218f46027a4cb19aeeb2ea2f39bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997202, "uuid": "d667c000-154f-49ef-8329-bc365be193f0", "value": "T1CB43C8197E228FBDF65A527047F38E215E0837E62BE1D581E16CEA411E7028D341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997202, "uuid": "a6f80b11-cbab-49b0-b68e-b101f124b610", "value": "768:Lu9flDFb+syM5kHk88UJPf0+Pb1G5Ug5ya4uWBB0EwbZ010U5MxU:iXMsB+0ob1MzCB0lb+10WMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997202, "uuid": "e4593121-3fd6-49b4-9808-e47f3da12b2a", "value": 57316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997202, "uuid": "6375418f-b259-4603-9902-cf3bb5c77cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997202, "uuid": "5678f07d-ee88-48cf-a9d0-9897616ba4e6", "value": "b78b8897b61ad91286d655b795c16839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2abc0e-d5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680914489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914489, "uuid": "04243ac1-9e66-4dbb-b82f-38e9da5f3d61", "comment": "Malware payload (Smoke Loader)", "value": "b147de3d6bd723415163b75c5ab944cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914489, "uuid": "e23c03af-4399-4cad-ad78-bcbe880a6b52", "comment": "Malware payload (Smoke Loader)", "value": "80155f886e31b9331e2b72b21e606b41f80924aa7ae2003cb0ab8d9372e9923d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914489, "uuid": "ca52af47-bda8-48dd-a32f-7fd2bf80eac8", "comment": "Malware payload (Smoke Loader)", "value": "0bf0e473e0e817de04c09da7aec7cdfd04a20c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914489, "uuid": "8eab9e30-7051-4410-883f-2a8f27f6149b", "comment": "Malware payload (Smoke Loader)", "value": "56948c5ee30d176e7d341d892c683887e4edc1667e8d7ca010dd9c8141282d5753761f1fd6ecb349c8e720cc3246225b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914489, "uuid": "f68fca98-3a4c-4da0-83c7-c14c72c5373e", "value": "T1FB14CF217ED1C2F3D49745317430DAE86A7EBC69D781818B33946B6E2D383D15B7A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914489, "uuid": "689dfe95-b6e9-4625-a931-bc3f7e36c838", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914489, "uuid": "44cb85b1-5dc7-492e-be0b-1a178f5780c9", "value": "3072:FMDy90s8+C+8WknJkruzRkPltAZo2MflADMP51l8:ut9+8fGuVmTckl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914489, "uuid": "a2d42a38-a926-4c9f-9992-a4ff1aace718", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914489, "uuid": "c6614a77-e6ce-41cb-b404-6ebbee5b0091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914489, "uuid": "be08f934-75f7-4ac4-83c6-606809c3e769", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76111058-d612-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680961029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961029, "uuid": "166b56f9-1f7c-45d6-a911-706ebb56d6ba", "comment": "Malware payload (AgentTesla)", "value": "a3b08d594f16415a610ed44ed5af4cfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961029, "uuid": "128d8066-8286-4a79-94f3-a9f86167ea21", "comment": "Malware payload (AgentTesla)", "value": "803df40184cf585fc3e2e8172972b3e548971a193ed4af7b7d53e6bce2ea43e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961029, "uuid": "8905e586-a0ae-491c-9ef6-f5a628c5e0f2", "comment": "Malware payload (AgentTesla)", "value": "e6972c524f2d27adc1079f3ae8ca5c0194ab7801", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680961029, "uuid": "f7ea81c5-1035-48b4-8867-894e3cc790ea", "comment": "Malware payload (AgentTesla)", "value": "19187968a221cda4cf4afc711aa67b321454de235c8695c68e9a2f1d3913197a2eda7ce9c4d38027df828cd17458ddb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961029, "uuid": "1acebcf0-cc8f-4452-8bc5-5b6b40d996ef", "value": "T148056A121C6245D6C8B90FB444B93A4807B49C538FE4903F7D86797E8FFAB9B94893D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961029, "uuid": "c8b9de84-0002-403b-9579-1182115bacf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961029, "uuid": "f9a6845c-c14b-4a6e-90cd-24f7223d9a5a", "value": "12288:WiPsT2Y2iNdVD9rznImGPa04lFW4IWOknLiXwhycID0K47KxErdE:U1qPadLWboLiGyca47KxIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680961029, "uuid": "d0b81af1-6e7a-405c-8928-ef00310b729c", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680961029, "uuid": "1bff930d-1efb-4595-9da1-a1e664bc5747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680961029, "uuid": "5c0ed3c5-4224-4153-b1aa-1d5ab775fc9e", "value": "New Purchase Order_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23709a10-d5f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680947576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947576, "uuid": "f7ca3ed9-b31b-4cab-849a-d5f44d538b5a", "comment": "Malware payload (RedLineStealer)", "value": "6107fe9ebfbbd2a24f30b42eff9d9fbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947576, "uuid": "d9e0d83e-d165-43db-9ea6-3b49f00e5956", "comment": "Malware payload (RedLineStealer)", "value": "804c33adb410686c058fe376b00742c92bfd08cb015f32ddb49a578eaae64667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947576, "uuid": "b89215c6-e33a-425c-9e6b-f37e10b85191", "comment": "Malware payload (RedLineStealer)", "value": "ea92a1553dfebc5bd333d19990dbec9f0e3037d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947576, "uuid": "bd58f6e6-3c09-4786-be11-9cf51d3cf29f", "comment": "Malware payload (RedLineStealer)", "value": "2bee0b58bd26afecb4897796eb83c40c6752c35581a7210874a36a52c8040f4007d4019bfc4145b02a46bfdeda378186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947576, "uuid": "e1aad53f-a6f7-4265-9248-04d3cdc92a9b", "value": "T1CA35231572D86533FCE86B702DF603930B357CD1887881AE770BEA5A0DB1145E97AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947576, "uuid": "cca86af9-9d95-468a-89d0-c9b1bfbbdae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947576, "uuid": "8634a423-e1bf-48df-8554-c7e907d4311a", "value": "24576:vySKB4MshwcHXMGElDmNSWz0XPw/QZlof/z1yF:6iMnc8dBmNSrwYZ0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680947576, "uuid": "7741f968-9a26-4502-9ff5-9a7531348fb1", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680947576, "uuid": "3784593c-dc4e-438e-a27e-8b7dad9bee82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947576, "uuid": "57afd7af-c53f-4291-b226-c7148897c657", "value": "6107fe9ebfbbd2a24f30b42eff9d9fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c730e0a4-d614-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680962024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962024, "uuid": "3310fb6e-4b93-4532-8aa4-fb32d88a6111", "comment": "Malware payload (Amadey)", "value": "838801af09965cb852a42cc8fc2763cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962024, "uuid": "bbb59de9-c742-45da-b207-87621bfb9296", "comment": "Malware payload (Amadey)", "value": "81ad18c7b349c12ac95f5b595abb93548fbc816009b0a62d86ea81c403285f44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962024, "uuid": "c9fe90df-9667-4dd6-a595-4f910d55f1fa", "comment": "Malware payload (Amadey)", "value": "81b05a3ff571b0ecd8833e3151b21a766821dab8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962024, "uuid": "035cba1e-6665-444f-8448-145e48c92625", "comment": "Malware payload (Amadey)", "value": "546c5bf27a1c2f955a322b71558f98e737d3b81de9381a5b53dc931cb1c0377b2c0a5fcd7a7bfdb672c5e625a0e8d67a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962024, "uuid": "5011b8be-a2e4-4b3e-b68a-2e8ba5e98874", "value": "T1F035231396E88076D9722B7068F317C31B3F7C5169A4426B7B867C8A4DB3B88657037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962024, "uuid": "cf8a1142-c173-4549-9320-4542d644ac65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962024, "uuid": "ce5fb4dc-9c27-40ec-843a-dfad73508131", "value": "24576:8y/3hS7OZu+XuVVnJ8u0LRI7XbcRNHmJ3TZHze5YRGQe:r/3hS7OZu+gORNI7bcRMJ3Td6KGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680962024, "uuid": "631b99e5-fe10-4bcb-9d82-3a5a2d77a232", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680962024, "uuid": "4ac80a0d-a9a9-49aa-a284-43f1a90e2862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962024, "uuid": "82129642-8455-4aa3-b590-fe6bc423025e", "value": "838801af09965cb852a42cc8fc2763cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f37309-d605-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680955308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955308, "uuid": "4cdf5908-5606-46ba-8d05-ae80ec1c6596", "comment": "Malware payload", "value": "41a914406ffe2e73eeb89257cfefa2c3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955308, "uuid": "7dfd0d71-e942-44cd-8879-383d70b7df86", "comment": "Malware payload", "value": "820d6290dbe84f5231e03aa1cdc17ae834ad177c931586770e5092bcdd5064d1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955308, "uuid": "1cf9ac5d-712f-4241-aeae-a0973b751b13", "comment": "Malware payload", "value": "2153874cd451544995cf420d293a72bee723ef57", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955308, "uuid": "36e73427-83bd-4094-b9dc-c8afeceb1ffa", "comment": "Malware payload", "value": "d82cdf6e5cb0d6d2f31d8c28467bde8027ffcea570620a71fcb6a229573ef17930a5b5d462083479d6df947ef6075b22", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955308, "uuid": "1d0a69ce-0d53-4e91-978d-0d1b9051cc19", "value": "T1ABC5CF87F705E86FC4F7C2329A3506A656179C168F83E6832E54712C5DBB5C08F9AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955308, "uuid": "5925bb52-ef48-4a01-8cb6-b20c26ee9d84", "value": "49152:350LakyWgvZTczYUuEEGgi+pGBRV5I+msUoEdfrgJWbfrzTL:3KL7yWCZ4zYxEEU+pGl5HUHdfRbfrz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680955308, "uuid": "ea10a6d3-9a55-4da7-9db3-585617e33a32", "value": 2620067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680955308, "uuid": "ca12c51a-12c2-423f-9e87-43afd2477ca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955308, "uuid": "92968b6a-e877-430f-a802-66b792061e47", "value": "Softbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91573b22-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680964940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964940, "uuid": "393770e0-5b66-4fad-872e-7d63ab236d35", "comment": "Malware payload", "value": "21ba003015f53b71d8dbce1dc1a428bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964940, "uuid": "b96dcba8-76e9-4658-a5b6-6310758cd04b", "comment": "Malware payload", "value": "83e11774e75ac33d5e754c051e42a87c516a646d78d06375d8c345761fca7e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964940, "uuid": "f45234f8-33e0-4cc6-be50-38e4d7e05f75", "comment": "Malware payload", "value": "45726d00e82e1d60a6e6ea76c514c685ee5fb15c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964940, "uuid": "e4d790c4-e922-45d0-9031-60f6e0b5a2ef", "comment": "Malware payload", "value": "f2b3c3718ffaac844b9326c3e771f3b40eb894782a8fa5fa0de6a7872011d43f992cb56c1aba23ea5cb0bfcb4c0a4d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964940, "uuid": "80d37c45-d8d1-4a4a-8493-05c1da2b8358", "value": "T1B6071213E112C0E1E53120B110B667356AB4B770AD7B86A3E7D0EEB42E797B1A75730E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964940, "uuid": "c9024e67-895d-4bbc-b688-0549cee1d7bf", "value": "76927ea1177eae73165f536b8d2d3882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964940, "uuid": "169e904a-cce5-485a-a670-b48f6b5d0f97", "value": "393216:mWgp7ld4VqUPNGK2ybrI+p/N+XCLU9dfc/2KBKdzNTFEaI3uWqpv8ulb7ftDIzJ1:w10NHzrIFfK2ooFEaAH2vXlDIF9xFeJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964940, "uuid": "e7c875df-410e-4938-bcdc-5636532745cb", "value": 18178048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964940, "uuid": "295769fd-ccbd-49f1-b8d0-7ad3d3765ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964940, "uuid": "0ef3202e-ab87-40fc-b52a-1107ca9f0bf7", "value": "21ba003015f53b71d8dbce1dc1a428bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e3d331-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959688, "uuid": "ff047da6-b40a-4523-ada9-e311c5f047c3", "comment": "Malware payload (SnakeKeylogger)", "value": "979010164cfb5488cd66ed736629cb74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959688, "uuid": "da3f9a07-0fec-44e0-b5ef-dfad9346fa61", "comment": "Malware payload (SnakeKeylogger)", "value": "8535430345ce6d0d5a2a9d33f1792f3bfabf1735e9d36fbb7e9d022056966356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959688, "uuid": "fd8f1aa4-2223-4762-bc56-0976926be0e8", "comment": "Malware payload (SnakeKeylogger)", "value": "6eb1e28b942532f0b8a279a7ffd48113bdfdf7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959688, "uuid": "b135f882-3d28-4837-b84e-7ce83281124e", "comment": "Malware payload (SnakeKeylogger)", "value": "dcbda96b15cc674a02a0d6850d939415ad29b85c3296856bc071bc3fceb9ff863b78827e0725601d4690a2a3fe9afa70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959688, "uuid": "7e8b8630-04b0-4d29-9018-905b6846c3f7", "value": "T1D2E47CD42AD68BC4D037B030F05ACAF2C3D21529F0999BE1389B5949E1E2E551CFADBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959688, "uuid": "461eb4d9-bd41-4176-b580-9b1c1635e26b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959688, "uuid": "9f7b5867-49c6-463d-9a2d-05b6cd79b411", "value": "12288:PxVD86Yro0G4r8ITT8r4m64Bc+k5DvGEwLlH/ZtPc4gqaPyVgh2eV:PxVg3ostUzBJiBw9ZtPc4g/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959688, "uuid": "80e97fdf-f5a0-4178-9342-8761ab6b450e", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959688, "uuid": "8433ee8d-0ad0-4f56-867e-c269e71df692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959688, "uuid": "9b6e00ed-1006-4ea7-94cf-d5b9b36c1a81", "value": "PO048024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d73e25-d627-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680970240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970240, "uuid": "69da3d7e-4dd1-4758-a0c3-4444c3c3b00b", "comment": "Malware payload (Amadey)", "value": "fa8eb93edd1a593d1fee14776104c7da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970240, "uuid": "2433df0e-b10e-42aa-832a-35c28a4c120b", "comment": "Malware payload (Amadey)", "value": "873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970240, "uuid": "370b740e-239e-4a34-af05-f42119bb579a", "comment": "Malware payload (Amadey)", "value": "17878f35d9711aca307c0a9f90d3a6559f19f3f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970240, "uuid": "c35886f3-a962-41f6-bb87-232e52cfb566", "comment": "Malware payload (Amadey)", "value": "2723b9414bbf47112315e09c6350fd39c3a6174b05a499aedb8ad1b323ec3d1d1dba60df4854d499818676ea7d237b23", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970240, "uuid": "6abaa0a2-e062-47ed-9680-8011590006da", "value": "T113352307A7E8C532EDB117341CF623C34B36FC661D7983AB63C1681A1CA2598A87577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970240, "uuid": "8d7ead52-1fd5-4474-882b-a1a70cfecb1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970240, "uuid": "01a4793b-61ec-4e1e-8f20-f10db5f537b2", "value": "24576:Myu0SaCfLF6KOWWaYleBDoIp8mGzB58PI7MmoW:74aYLgKOJ6DzqmGz8womo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970240, "uuid": "e691a45a-0015-4221-acc7-2237844dfd2a", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970240, "uuid": "5b5c8fe5-a796-469a-82a4-b05660d0c471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970240, "uuid": "f34ec146-e908-496c-95f6-ba64ea12d1dc", "value": "fa8eb93edd1a593d1fee14776104c7da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edaed91-d63b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680978653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978653, "uuid": "39580f54-398e-4dd9-9423-e4a645a34faf", "comment": "Malware payload (RecordBreaker)", "value": "2b618672399187e0159b5de354a40d32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978653, "uuid": "759ed99c-ad0e-4b54-b807-57e83dcbb80c", "comment": "Malware payload (RecordBreaker)", "value": "87824af996bc15c757d4545ad7a7ffd9609a4bcb83490e1019935c5e6a5f9cbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978653, "uuid": "3bccfcdd-02b4-4153-90e4-8033e9ff5cee", "comment": "Malware payload (RecordBreaker)", "value": "0b27083a65e150932a7eacda9dc2fb6db945708b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978653, "uuid": "568fd852-39cb-46c1-a3a5-b1694a220ce5", "comment": "Malware payload (RecordBreaker)", "value": "f93de19de0999b16d758e912f26fb46b5f0d8cd4c28582ae8f4a448de750a5e0d2b2a31940f74083a07951710d41ee76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978653, "uuid": "337fb93a-605d-41bb-bab4-a52c9bc927cc", "value": "T169D633A3239004D9ECB98C348537EEA531B61E7ECA9168FD71DDBAC12973564E723843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978653, "uuid": "cc0f4f1a-18fb-4514-966d-e7fa3e1c409b", "value": "36e133d2e4b3eab9be975e6d64d2f3df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978653, "uuid": "106b3fb6-66ee-4f57-a3ea-dfb64efa4fa3", "value": "196608:nJWLb/NtKatYNZ+gMSM3Jh+1DvGJtr9LdSmW1iRgjYO2V3xhqDxRKzayuS/JIVXY:ngNtnrZh+1OXWQaqxhYkvJIU7lWB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978653, "uuid": "5f5244b2-64bd-433a-89a1-b9cd837d2499", "value": 13364224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978653, "uuid": "d4e9cac4-f80d-4579-a38f-616a0a72b8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978653, "uuid": "9010dfd1-e7ea-4af0-b953-6190a54543c2", "value": "2b618672399187e0159b5de354a40d32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9ef738-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976935, "uuid": "3be15926-11ca-460e-afba-c697239d8b50", "comment": "Malware payload", "value": "cb28c211ca8292894f3eef43ce5a6cd4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976935, "uuid": "3b805c65-2c54-4413-8a9e-80d1bf00645d", "comment": "Malware payload", "value": "87feca94fc02b098be787060da09fc6f6473221ddf4aaa2f19321db3de256c0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976935, "uuid": "312096dc-a46f-48cf-a2bf-15a52d6409e3", "comment": "Malware payload", "value": "70e0bc5fce5534e6dbe5200d9c965c925b596ee3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976935, "uuid": "fcce7ced-3641-40f8-9551-929569488e55", "comment": "Malware payload", "value": "0c7eaeecaa4b5408759475f8fa8b192e628c8c50e13bfa4ba5d05f3e457285b4118a30a112564453778b74669b12ec30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976935, "uuid": "865d7c12-2027-4fad-aa8f-1d100584b6d9", "value": "T136E4AE026612D077E4A708769BACEB62A4795D304B2D81D7BF50EAB50E39BD2773C343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976935, "uuid": "eefa1825-dc8a-4806-8ecc-2e428cbb6162", "value": "50e1f8f4ffaf0027d5b9f05d6a625798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976935, "uuid": "22fe0eb6-2d2f-49fb-84c8-f2e06fed0fbb", "value": "3072:UkmGgnjAYn2Fj5ohpzBovjtALLXOixtjOQ0hV09ZIR5YkHk7wELOhr1DwTTRpAe:g6mLD1OQW094YkHk7wsO7wPXAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976935, "uuid": "f0332518-56b2-411c-bfd0-6532e553934a", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976935, "uuid": "2b36ee2f-55ff-499b-a473-8a4a70ca2152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976935, "uuid": "80eb4199-f276-4c63-aade-284873207146", "value": "2023-04-07_cb28c211ca8292894f3eef43ce5a6cd4_teslacrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c7dd90-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680965137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965137, "uuid": "c314e07e-0e83-457a-a7e2-fced5cc3a9c5", "comment": "Malware payload (RedLineStealer)", "value": "474e56940b0f4e75e4eee8d381f08203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965137, "uuid": "8c18b898-edd5-4e33-96ef-030973cbe8d6", "comment": "Malware payload (RedLineStealer)", "value": "889e36fd2964ef45faeb33370aa19105c02fc6fdd659048ef34f051a8f771f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965137, "uuid": "4ffc1f11-2018-4a5e-9a12-781f37b4eb19", "comment": "Malware payload (RedLineStealer)", "value": "d49ced28c12eb57996e36fc94bede25f0041190a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965137, "uuid": "43488609-d90d-4f25-91ca-3edd76c39b68", "comment": "Malware payload (RedLineStealer)", "value": "621430f7b82ea5a01ecda703d80768b992785960b028d118f115ce9cc4c9ec89941c9215da26a91764d06e02382e0899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965137, "uuid": "e21a0dbb-889d-4414-bf31-700dccce4251", "value": "T1B7152316A6C58071ECB0173469F31393473BBC725E68932B13D6A96A2D339E4393A377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965137, "uuid": "1e3b8fdc-c0b7-4c59-b4a4-164db6ab62df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965137, "uuid": "51f37fc0-08e8-45bf-bef3-1ce16ac77c49", "value": "24576:Myj7rhSWay/zlu2l/A94IsPeHhpb8QYlG:7/rsW1lu2C9ji0pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965137, "uuid": "b58f3de3-036d-45f4-84c7-8486a42fe9f6", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965137, "uuid": "ee6f996f-5f8a-4674-ab7f-33a13c6206a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965137, "uuid": "4e50953b-fcef-41f9-9f0f-02192580bd89", "value": "474e56940b0f4e75e4eee8d381f08203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016e5070-d5a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1680914448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914448, "uuid": "55520440-d51f-4bcc-a270-791340d74d18", "comment": "Malware payload (TeamBot)", "value": "7dcc1db2d26c2f7ee5804f7dba255c29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914448, "uuid": "fed9c44b-708b-4712-b28a-bc3bb38d7a8d", "comment": "Malware payload (TeamBot)", "value": "89d1590e6dccf803e39945f97cd26987896215574f5ac9746433c219d537efcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914448, "uuid": "bd4d314e-eda3-45c4-b2d7-46db353c27d4", "comment": "Malware payload (TeamBot)", "value": "dcf17c75677306842c096003d5e5908073d86a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914448, "uuid": "a8bdd465-1494-4bc2-a3a3-284d794b7a15", "comment": "Malware payload (TeamBot)", "value": "2ac94a0775613b093e6dc938d127982ca6c1a433706c72b9c233cce88e8ea3c6c681b44dc375ffff9a0cad052fe5b826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914448, "uuid": "25f9c885-edb6-4235-9089-89c747625d95", "value": "T16A14D0227AE1C0B2DB6344345424E6A4A67EBC62579582CF37183BAF3D303B15BB7356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914448, "uuid": "aee95e86-8db4-4e4f-8aa5-7d7c74136419", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914448, "uuid": "0f91b73e-3069-43e5-9cb9-5623907fcaa1", "value": "3072:XjkTA2+r+yxl727wd+UyCF81omIsI7KcjpMTTocgtWg051tDhSqn:zjL9K+mIsI7KcjpcgUbtDht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914448, "uuid": "0d6a2815-1e37-41c2-a928-0e49f7a8dbfd", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914448, "uuid": "50055aad-a349-439d-8446-b310493cf6a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914448, "uuid": "914b2678-b3d0-452f-9b09-6c9a95f72e5a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06de237-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680964966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964966, "uuid": "c1cfc038-9830-4f0a-8c3f-25352c272222", "comment": "Malware payload", "value": "f4df53f817c548c7c8d9135a37e30789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964966, "uuid": "6e54fec4-f69a-4213-8fd5-3f157edbfc6f", "comment": "Malware payload", "value": "89ffd56131f21889a4809ac2c1d49e4092645510bfaa53cb7aa0a91e932ca13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964966, "uuid": "b6eceb4f-b52e-4fa4-be22-bcdeb0836970", "comment": "Malware payload", "value": "a20c0d9aa53e38c7578138eeabf32f7b12448ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964966, "uuid": "6de733cd-82f0-4f09-ba90-8f88595b3cc6", "comment": "Malware payload", "value": "14eb0f11cbff917d53f82599683e3a25cdf70db7c0abeee7f807966afd39e22e9e11641edf45bcfa71d7d5b5f7f0c26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964966, "uuid": "8560360f-28fe-4fd0-ba95-4fbabcbe916d", "value": "T19DA53351B3EC043BE6744B3009E602970539BD35AE7C435FAB92ACDA1E33A9070B5B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964966, "uuid": "9ed200b5-8287-4492-a176-24570f2e094e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964966, "uuid": "8ba1e61e-f18a-4936-b718-53c2a04d4087", "value": "49152:BS4OP5COu3O1nMS3kA877PA1uYl9G1VxV9S16KPyVz3KXaAPH:okOu3G3Z1u+9G1t9MpoTwaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964966, "uuid": "16b0ada0-7b4c-4b2f-b044-03651f98ec11", "value": 2219008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964966, "uuid": "a3c8b7c6-d929-4c04-ac05-c496062047a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964966, "uuid": "b53fbb5f-1bdd-45f1-80d7-127c632491b2", "value": "f4df53f817c548c7c8d9135a37e30789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2fb7ba-d658-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680991240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680991240, "uuid": "7a0da9c5-786a-4c56-908f-667fd9419395", "comment": "Malware payload (Gafgyt)", "value": "b4d18380a63be8dbf1f52270d9224776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680991240, "uuid": "9e979cec-cb5f-40d6-9cf8-2e8e07f9eabe", "comment": "Malware payload (Gafgyt)", "value": "8c9bb3a9dcce4ab3c03a2352b826f60ebef3cdcf2756dbb51986e49fbe9cdde8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680991240, "uuid": "2e922d1f-c3df-4a69-af83-1f88cf8add0d", "comment": "Malware payload (Gafgyt)", "value": "ddee3152c553dbecae6f244e33ca4a41e11e7f6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680991240, "uuid": "daf7f9d9-7563-4ae4-a8c8-23a30c5863ee", "comment": "Malware payload (Gafgyt)", "value": "ab1ef29500c705d218329ef483065e88dc6646225d8e1b3993e3d164eff8cfea91869e32d1f8461d90fa3b99f499745b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680991240, "uuid": "462e1f5b-7b6c-4caf-be55-a9f9d39fbe10", "value": "T101735B136991CB7BC4C747F92BDB952144A3F83E1B32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680991240, "uuid": "0e5d3658-9c73-4f62-9a10-181f4eb08a2a", "value": "1536:47IZuSaH+1iDnD+Q8bQ8O32Ls0FnswNLzvmA+JbOm/coZ3ymj:eCae1ItqQH2LDnsELzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680991240, "uuid": "2b06dcde-c900-46cb-aebb-e741b7c7d085", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680991240, "uuid": "a5c3d041-52aa-4896-b8dc-c4a884a60026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680991240, "uuid": "3b4d204b-80bb-451a-976e-b7c1a649facb", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072b9a85-d639-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680977594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680977594, "uuid": "106e6f45-7130-4d78-97ac-572c25a7a64e", "comment": "Malware payload", "value": "0259909a0ce31e08bcd688852fb6b806", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680977594, "uuid": "59ccb4fb-5b2c-431d-8781-9fe99a44f162", "comment": "Malware payload", "value": "8d5c41543fcc5b7b652b1a16cd3fca0fe3062f8379447c04968c5261cde7deb0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680977594, "uuid": "3df404c4-8785-49e0-9e21-5b4433640d6e", "comment": "Malware payload", "value": "36387bb427780af78cafddf40df5185fcb86316a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680977594, "uuid": "d183bf70-98f8-4cd5-bc77-e7263d176513", "comment": "Malware payload", "value": "1ebac4dd653f6669ee9c65545b0199436eb6d3309176080b5664447253cc06e6371331ce17331d383cbc80df90385960", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680977594, "uuid": "a471c70d-411e-4083-a396-c0b38dba2ed4", "value": "T1A4557CB1B683C63AE96250B08D2CDA5E505DBE240F7605C7E3D8672E6E314C35F3BA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680977594, "uuid": "b2246a6b-95f8-470e-b5f4-3839719fcbc7", "value": "c226ac4bab6f48634bacbb7a1d34f8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680977594, "uuid": "2af02964-2c4a-40ac-a3ca-bc32598e618a", "value": "24576:AtjNyN2LPDCfSXu21PpIkfQYInn9RbEhHSO+SA+GnaQ/SOM:EjyMmajEDYInnjEocA+GaQ/SOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680977594, "uuid": "cd63b9ff-9c66-4fc5-b341-47e3b230a33e", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680977594, "uuid": "b6f135c8-d3fd-476f-9dc1-62d41ad2e28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680977594, "uuid": "2220dc92-7a69-4cc0-bd46-176bacc8d30f", "value": "2023-04-07_0259909a0ce31e08bcd688852fb6b806_locker-goga_metamorfo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1a9ebe-d606-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680955837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955837, "uuid": "4b45629d-6cfa-4135-8833-54d33b0c7703", "comment": "Malware payload (RedLineStealer)", "value": "467bcafc8150696dc9146d51850b2013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955837, "uuid": "99f18791-e2f1-47bd-b3e4-724eae4a18b3", "comment": "Malware payload (RedLineStealer)", "value": "8deeee05e2eb5d2faee8e02325c1698cc5f02efd1deca81b548fe653022a1a78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955837, "uuid": "01bf961e-2030-437d-96ba-fe2179c97fb2", "comment": "Malware payload (RedLineStealer)", "value": "dc4a6e750691b2b9f27510f1b637050e7ca223c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680955837, "uuid": "6299539b-43b5-4257-93cb-fd1f316500cd", "comment": "Malware payload (RedLineStealer)", "value": "481a401c5c2d7c5407bb1b9845e92bdd082abdca6e940dc52ec4c3abde7658d39ff0723c24ca63046c887ba70e0daad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955837, "uuid": "e88bf01d-c9a9-401b-886f-0e6f5e007505", "value": "T1E6152217A7D49463D8B41B7018F712931F7BBD509D78C38B7BCAD45A0CB2A809A7236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955837, "uuid": "d548c38e-ade1-47f4-8e7c-276926993368", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955837, "uuid": "f0b412e7-9f77-4903-95d3-b2277bc73f59", "value": "24576:XyK/Kjzzfytd6fKccU3KbXlWEubk1nfnkGvO/Bo43r:iLydh7UabXljbnfXW/Boi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680955837, "uuid": "43a09618-7261-4c75-a861-92e62a96b9dd", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680955837, "uuid": "1f2452ee-3c1e-4d24-ab94-fec1e73e96fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680955837, "uuid": "287593a8-2608-4234-bb4c-3ec758053d57", "value": "467bcafc8150696dc9146d51850b2013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0ed775-d5e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680941844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941844, "uuid": "3ff8fa2c-4da1-47c4-a5fe-b36666bbadb7", "comment": "Malware payload", "value": "a926b22e1db3b1dee31553184d653ef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941844, "uuid": "a9317412-ade1-4945-ba18-ba29f15d3184", "comment": "Malware payload", "value": "8fd1a1cc1a253fd58693c181895d392ba20fc2a638aaecbc2e8f5d004db8fc27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941844, "uuid": "15411b78-95b2-4284-89d6-7e08ad026ad5", "comment": "Malware payload", "value": "0cc211039f4febc3cca2476d5b985c8e0eb0fc81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941844, "uuid": "d5f044f4-6983-4511-a91d-64eec2f372b4", "comment": "Malware payload", "value": "22f6955d1486d37ba8cac3f39af4247ea7ab9cfb6dbbb8fbbc4e92d203fa572e60a335e3712e25e611437988faed057b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941844, "uuid": "ca566f6b-7394-4401-a349-b3c5acf6eb40", "value": "T111351740AE5E8D71E0D24070DF25DEB547A46E243A3B809FBA76BE7FFC713821A25215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941844, "uuid": "3ccb4d92-7087-4b36-9f5f-fe349ba73929", "value": "896d88db0161dd9ab4b5ce4f5ef9929e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941844, "uuid": "840f5bca-802e-446b-bceb-f41d5874d4a9", "value": "12288:NSY9DeF40czDvWtoD3j+xq+8u/0OmC8tkaCom5r5SZDnKtTgT+b1VBW5akpkLR4v:L620cz6+Dzo8Oh8I5StnKtTgyb1XW5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680941844, "uuid": "b972e96d-0b5d-4319-99f0-467a4cfba6ae", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680941844, "uuid": "044ca8d7-2792-471f-94a7-abf299198f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941844, "uuid": "e442de5f-8051-423c-9158-8318a70b4cca", "value": "PETools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5e07fe-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994192, "uuid": "fa310dd8-edef-4b69-bb41-a2e393b05658", "comment": "Malware payload (Mirai)", "value": "4ca3839dc742f0d4e2d416602108fe8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994192, "uuid": "f8f62289-7e6f-4abd-be5d-938e4a8fbb01", "comment": "Malware payload (Mirai)", "value": "90ae7d05feadfe54d50a19015e99e9712258445bd2e7016c797bdc8ec6b9fdbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994192, "uuid": "784c7e85-e457-4948-9ce9-869ea9b9245a", "comment": "Malware payload (Mirai)", "value": "10fb4ff5261c477c1f309a5eb022cc2e781157c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994192, "uuid": "5a51cbc1-098d-497b-ade8-842fb517c5df", "comment": "Malware payload (Mirai)", "value": "e06f478abffe04d0f4d5b3502ff99389fcab905e3866eafe75c4f2ffb3f3efe25bb6e22be710cf21e59bc21b5eaaf224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994192, "uuid": "f19bebf4-4d1a-4cc6-b774-d9f1c5fd7694", "value": "T110334D02730C0D47D1636EB43A3F23D193BEA99131E4FA84651FEB869271E325596ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994192, "uuid": "cc751bc1-221b-49af-a609-d61d8b4ccd08", "value": "768:xVHpa8RM+IIfwB38F/qCiggbizbpsDFr9NhfgyHcpT77ncIzJnFBQtjX6AEIU:08dyHtccFBNdvHYXcI93QpRE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994192, "uuid": "693dd6c2-c3b4-4862-903a-1e0e71820f76", "value": 54684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994192, "uuid": "257d6860-cfa6-4c4f-8c6e-6dd8caae72b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994192, "uuid": "385227af-6f8f-4fe2-9784-e648fe3c7aaa", "value": "4ca3839dc742f0d4e2d416602108fe8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e349270-d664-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680996235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996235, "uuid": "ffb58963-025c-4d6a-9cfd-1960b0ebc5a4", "comment": "Malware payload (Mirai)", "value": "3298d7b4d9f1e33a2488275153703d04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996235, "uuid": "5ca263ac-de18-43e7-85ea-671952c9e086", "comment": "Malware payload (Mirai)", "value": "91aba378a2178145a31ba9bc9a1de39a887e9d5de8ce872662630448f850ada8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996235, "uuid": "51e98cef-a41f-4e0e-b44c-3e68197f26b6", "comment": "Malware payload (Mirai)", "value": "ccf3c04824196060adaafdf315981a32dc891f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996235, "uuid": "6537b4c3-bab6-4866-a475-fe3d6a0a3187", "comment": "Malware payload (Mirai)", "value": "7ec901f52fe7635c8e83485fae10aa8f30cfa1e022b9f8cbdc01c514fa412a131c66dbd6fe3f91063311a7268e669632", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996235, "uuid": "35aacc4b-b9d1-47a9-a55f-1518859ac029", "value": "T1FD13F941F5078AF3C40704B021EBFA3FAF30FDE95565965AEB66EEB1DA530C26103A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996235, "uuid": "f2e87dfc-635b-45b0-9ef2-3e6cf318503c", "value": "768:QxCf/IMv/EgDR8R5prC42m4sgqnKY1nwsvKQLD9:84IMvsgdkC42m/gqnKmV3LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680996235, "uuid": "7988fa55-3d44-43c4-aa3f-67bc5eb53a31", "value": 43792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680996235, "uuid": "07b48a0b-cd56-4f2f-907f-0df32a2fca1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996235, "uuid": "0dad3e57-4406-497a-af44-6006e5593c03", "value": "3298d7b4d9f1e33a2488275153703d04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85da799-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680965435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965435, "uuid": "0d06b11b-03c6-417d-938b-db18fc9dbb9a", "comment": "Malware payload (Amadey)", "value": "162b616c3a4bb8b482395e6b2d5b15b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965435, "uuid": "9dc67378-943e-496b-b5e6-8e1d15974f95", "comment": "Malware payload (Amadey)", "value": "91e7fed743251bcdfa101650bbc81bc31706888d4e0c3322294293e73071af22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965435, "uuid": "037dce9d-9c16-4023-a907-813b0f3d74aa", "comment": "Malware payload (Amadey)", "value": "6fd5608d2ecf6cab8b2c47ae27551462aaa38a44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965435, "uuid": "a507b7c8-6148-4468-a15d-6a46610b3556", "comment": "Malware payload (Amadey)", "value": "4065ed5e73d3c9b097241ad6cc0f539bbd2f592254f17194362b966d300c93da1566b34711d705c8288e2b9b058986a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965435, "uuid": "59d41c13-ed7f-4e70-9f66-cfece691724b", "value": "T1D86523139BE940B2F9B2533490FE46534D317C924EB8DB572BCE8C690C626E87B31766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965435, "uuid": "1505192d-0f59-467b-9318-36538653d5d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965435, "uuid": "78261f0a-50db-45f0-a474-aae5b4ae3e70", "value": "24576:gy6mngqaYDBBpb4D2ZM639VCYB4fK1c/k04I4mKII5fZy2KiBiTUB:nfgqa0BlJyk9sYB4ft7om1OZy2KiUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965435, "uuid": "feacc7b2-96a2-4bc0-aadb-2970d9d54ee1", "value": 1410560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965435, "uuid": "253100cd-29c5-4e89-a74a-4d01ca54024b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965435, "uuid": "656db451-adb9-42b2-aa82-c472d557357f", "value": "162b616c3a4bb8b482395e6b2d5b15b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5761f7f4-d664-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680996196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996196, "uuid": "e90d45c7-3c76-416a-a408-63dfe6d14060", "comment": "Malware payload", "value": "11e0ef04e404a1ed9fb4b30f199b6246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996196, "uuid": "7b322aba-b3fa-4b37-89ed-04fa370358a2", "comment": "Malware payload", "value": "94d5d057577f36631295c46fcad47598e682e35d26fe8d7de1542911fa307190", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996196, "uuid": "9a9d86f0-c853-4b05-b171-6a1075c668ac", "comment": "Malware payload", "value": "333cb51dc0c150e33d030056861c3945d0f1bee5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996196, "uuid": "0bce3cac-8d8c-417f-ad10-3d59cc3cf081", "comment": "Malware payload", "value": "eb7ec3cc78c5884991603df592328ae7017d0b002ba8c708d29ead95a00da11a9ef73a1751454c79603b821becb0976a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996196, "uuid": "efaa0d4a-e8a3-4f07-981d-3db43bcb9fea", "value": "T13CB3B617BB518EB7C85FCE3305AA4601208DE58612E96B6F72B4DA6CF74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996196, "uuid": "eb07c97d-370b-4a2b-b96c-053dd304ffb2", "value": "1536:XWeTPtQhxLw9BFY6zZLExRtdKzY8nqqswptjMi8tbOimWt0zFufCy/02vI:XrtQGFnGKzYQswvf8taimWOzFufJ02vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680996196, "uuid": "d985c6bd-8885-4384-9335-6f2ed5efd3a9", "value": 113280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680996196, "uuid": "fc2dc931-9db6-4cb6-9005-c3c03a0a003c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996196, "uuid": "a03dfc1a-c140-4ea5-aa98-877fd4ab5f65", "value": "11e0ef04e404a1ed9fb4b30f199b6246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43032c58-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993585, "uuid": "452e7360-76ad-4628-abb9-a27ebe3e3ac2", "comment": "Malware payload (Mirai)", "value": "993c0956bb790c02b216ee8b9e2d1f1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993585, "uuid": "b5883aa3-48be-4736-8afa-de97e35541a2", "comment": "Malware payload (Mirai)", "value": "96bc77b75a1f9a4946fa773156b7a9388945c9500f9d96d7b8ddf8eec2a6c5a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993585, "uuid": "4d1be50e-2abe-4f14-89ac-016f85665505", "comment": "Malware payload (Mirai)", "value": "fdf9d59b08fd0c03e0fd2f5ff99b11bbab5042da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993585, "uuid": "036b004b-066d-494f-b500-07234ad03fcf", "comment": "Malware payload (Mirai)", "value": "71587cf89d60d6490b193d578a63355f49876ab7d415590c82486f4f1d9cdd307ba7cfd26bd524e7a9b3818a6a4ecbce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993585, "uuid": "e2d4189e-d814-4e75-bcd5-b98102e5df90", "value": "T1BB631856F9818F12D5C512BAFA1E028E3323176CE2DE73129E246F2077C796B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993585, "uuid": "1520c91b-efc2-47ad-808f-ed61c2392436", "value": "1536:9lnpLYtGHmfSYC2M+3DYXvTaak8RCQHbMViegxUdf5LAY7:pYUmcqDmvTaak1gxUdfGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993585, "uuid": "945572ab-9f9a-41b3-a99e-739b628620ad", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993585, "uuid": "e83a125e-2222-4180-8841-79ef7f865cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993585, "uuid": "1e65466f-e5d0-4a5a-b7a6-cea18d35b33b", "value": "993c0956bb790c02b216ee8b9e2d1f1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbdc899-d61a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680964478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964478, "uuid": "32f57f2f-a4b9-42e0-afab-c19432338a2e", "comment": "Malware payload (RedLineStealer)", "value": "b501e45b14947185448561057c996f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964478, "uuid": "222f16bd-efb7-4d4d-a9f3-a33fe985eb0c", "comment": "Malware payload (RedLineStealer)", "value": "9adb3407f722015e8b470395752f3023493e95d3bc3bf0db8a36c315c20aa032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964478, "uuid": "62794892-be15-4943-9448-58fb02385063", "comment": "Malware payload (RedLineStealer)", "value": "ddd1180ac7fb4169b9e40801333d8181f4f675aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964478, "uuid": "4e83b197-fc41-4968-a63a-d5f1daa97679", "comment": "Malware payload (RedLineStealer)", "value": "bef470d983f559cc109d4addefccd50a7ec9c39d824be72a96aa6e9b0632f0522f8424759cb1a1435b46936762a80b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964478, "uuid": "e70f6dd0-93c0-4201-8001-8439a76992d4", "value": "T1195528CEBAC0AD72E5D21C3005BB57AF3D2FF96037BA07566A885E150ADE14B4C6163C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964478, "uuid": "2200948b-acf5-4c7c-a5d6-252516a965de", "value": "5131925e2a63e384d473ce1212d177ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964478, "uuid": "2d98ab4d-ce45-456c-a351-e617edeb2817", "value": "6144:DeqpgV+H0R4XFqfpNHV88Mh59/BAOa534z/uZToML0p/5K30v:DeqpgV+H0RKqfFqBQ4ruhoML0rKEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964478, "uuid": "22284323-1664-469e-a975-d6bc4a12d8f3", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964478, "uuid": "f2bf11f4-8342-4e93-b0a2-1005cf76991a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964478, "uuid": "9ad80bee-e6f9-47d1-ba58-386581c573f6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023b9756-d5e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680940219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680940219, "uuid": "879cae42-e018-4b38-83ee-647ab982234e", "comment": "Malware payload (RedLineStealer)", "value": "e0a60e823375515858e24c05310ddc80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680940219, "uuid": "81f26844-ab3e-493b-937d-7154315f0011", "comment": "Malware payload (RedLineStealer)", "value": "9c85f3940d382be20fe222e4d481fd1f048fa099e961042b088b6195d3bed0a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680940219, "uuid": "bcbdaa05-ccf5-433c-9630-639e439bc530", "comment": "Malware payload (RedLineStealer)", "value": "eafdf8db40a3f30d3eb49d6cc5e673e6130e0349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680940219, "uuid": "42eaa4a4-cb4d-4e95-a061-7e8fe74e07a6", "comment": "Malware payload (RedLineStealer)", "value": "ae8f6af9ae43e259aeedb91aca136e27158df5011b341250cc17a83e9148c69051dc6c6c38eee46bcfd5955cc58ca371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680940219, "uuid": "ccd37be7-cb30-4252-bff4-f565dec20e32", "value": "T12464F1217BD0D033C65A48754410DB95A97FB8616A8682A3370C777E3EF33C1AA79F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680940219, "uuid": "bae8ff17-fa74-4e03-956a-be17c1d6c2b0", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680940219, "uuid": "aff939dc-bd5f-4494-bccc-aa61d5e6a069", "value": "6144:HrbG22o5o/8aYFVBdTdpCd7drIF5LsJ6JezfMfdYhJv6h:Hrb6o5gXQVBdHqdrMA8Je7Mah56h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680940219, "uuid": "ff5059ad-6ed0-41db-91a9-4152352f137c", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680940219, "uuid": "6dd95462-7bfd-49e3-9dd7-8c0155fc3bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680940219, "uuid": "b888d2df-cff6-46a9-8970-66b275eb42ba", "value": "9c85f3940d382be20fe222e4d481fd1f048fa099e9610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3485c4eb-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945457, "uuid": "7613d891-60bc-4926-9c8b-a5acb8fe5951", "comment": "Malware payload (AgentTesla)", "value": "70addefe2c3ba685b6058b0ba6170998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945457, "uuid": "4cf3ca5f-05e9-4e89-8905-f8f0b5eb06d3", "comment": "Malware payload (AgentTesla)", "value": "9edbd07d33cb9c940090984401da39af7529ac97ce11c9e2411de8ad32b11780", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945457, "uuid": "bf2f58ae-9db5-4f55-969c-068d8a09a161", "comment": "Malware payload (AgentTesla)", "value": "ffe5a35ec78238514e9bca9f91f0b2b8c05bc954", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945457, "uuid": "92eb72fa-e4d5-4958-8add-660a2d0f03d3", "comment": "Malware payload (AgentTesla)", "value": "daaf6e4d2f3cca9cab11be1138b98ab2b8c4319dcdaef4de0cb46afab4683449e3f8da7f0e58defed2654cad4b9153a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945457, "uuid": "5fc8b01a-429b-430f-a5a8-ea0e6e0ddcd0", "value": "T1A3A423CCB64FFC8B577BC6BAD2AC9D17A731C26350B9406184AA22317A499F32C5D35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945457, "uuid": "23dd6146-f337-44be-9b5e-c1cc9a1c4f04", "value": "12288:PUuB1fnAjFyD0L55yLqQasWiIqLh62ScOFlw25TUgW:P/AjFgw5QLjasBIW62SDL5UgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945457, "uuid": "81b39897-4a94-4a23-bad3-0e9c5affd65e", "value": 488585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945457, "uuid": "0369bfb4-18e1-4d39-a5a4-bb89f9e0b67d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945457, "uuid": "077351be-bc46-4de7-9af0-ee2b3d30dcba", "value": "202105-USD122986.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6aec2c-d61a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680964691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964691, "uuid": "99eb5bfc-de8b-44d8-b6e9-c044d2f57d79", "comment": "Malware payload (Smoke Loader)", "value": "330fb5d55a6eae596486c175adcdb16e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964691, "uuid": "cd3d1787-f0af-4e49-97fd-d2a0759b605c", "comment": "Malware payload (Smoke Loader)", "value": "a29a47baba8561d4741a3c9e4cc6b1ca6baf98f4e2ba2c07b8072a97fec3e55e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964691, "uuid": "9d05bbc3-4ae9-4d10-9160-f13e08b2099d", "comment": "Malware payload (Smoke Loader)", "value": "bd0b60cb985bdc1618e8a4772c4e374ec73270fb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964691, "uuid": "8741c2fa-e091-4d14-b6d9-8031a81a3c9f", "comment": "Malware payload (Smoke Loader)", "value": "62e774dc404427bf94fec08721a1d9853a41b432a22637fca52bbdd23f744e4e00d66482ee14cb180a9d044ee5d4d267", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964691, "uuid": "10a9c06f-6f19-4638-93fb-71e649f47b12", "value": "T11C14C020B9A0C4B2D41785345424C6F5BA7FBC92DB85858B33C83F6F2C723926B6B755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964691, "uuid": "bbfdb8bb-1846-4214-bd34-74475902ae4e", "value": "5b250269b3029bf9f1db422179f30d8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964691, "uuid": "c8bdba39-28e1-4878-a22f-c3710b529618", "value": "3072:iHbANHTSOvv9U4RVJZi2jJOgo7cD7R1rdmNmeFlIQvi5WdET:gAZSONU4R5vjJ87c51rYNmeQ6dET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964691, "uuid": "17791d73-2c81-4b68-9255-f6ac783268ac", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964691, "uuid": "a1c40d1d-a94a-46a2-9360-bce7e3384a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964691, "uuid": "c258e9ca-de5e-4c48-93b5-788727ee1acc", "value": "330fb5d55a6eae596486c175adcdb16e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c353bc-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994226, "uuid": "d336fe81-7288-4b89-8691-aee9e2ea9daa", "comment": "Malware payload (Mirai)", "value": "2ba97c0f7c57d6da328bee6d37c91eb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994226, "uuid": "27a0fcdd-1448-4453-ae1a-d513e4f1eb9c", "comment": "Malware payload (Mirai)", "value": "a32b1293c9d626e680e68c088a2e314b3d5deccac75716d5a101504f8a978299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994226, "uuid": "efd75855-8709-41fa-88b0-8caead6b3c61", "comment": "Malware payload (Mirai)", "value": "899f41b416377b6d3461da807769cf378faf7b87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994226, "uuid": "56ed55e7-1785-46d9-b45f-609296a44255", "comment": "Malware payload (Mirai)", "value": "f91803955c6c032554a9fe39427fdf731076b5b5ba0f40db89a614b338af4961eb544cec5095fc23d24172201da0289e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994226, "uuid": "6af01fdf-3750-454e-a3a9-8aa2723023e0", "value": "T195433A32BA760D2BC0D4A47A21F34725F2F6479A25ACCA1E3D720E4DBF6194022536F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994226, "uuid": "b5eff249-c677-4887-9a7b-bdc8c94ba204", "value": "768:C5olARpIfTYQR5RhDPveG9Cw4Prtml//cO+c5V1L2KTKtGIt:C5XRS8oz7eG9r4PrtoOc5mtGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994226, "uuid": "b2574179-0335-45f7-9978-908bb5f7b856", "value": 59448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994226, "uuid": "cec92581-78bb-405e-a3d3-6705f74dac8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994226, "uuid": "85f9c847-59a8-4b3b-b1d4-237d7e37658e", "value": "2ba97c0f7c57d6da328bee6d37c91eb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8585f57-d60b-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680958161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958161, "uuid": "aea1099f-f027-4b3f-a327-7a180f0baec8", "comment": "Malware payload (njrat)", "value": "15c39952b26ae0b706e9b5b4bf7503e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958161, "uuid": "a2cfc930-ba89-4e38-bc15-d3e1a209f1b7", "comment": "Malware payload (njrat)", "value": "a5fcab62a97f68d16602a16f4b75da37a83f8884f59fadf6f81fd7d68564137d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958161, "uuid": "6303e13a-a270-4341-a1fb-fb63cf2a578a", "comment": "Malware payload (njrat)", "value": "a115720ea604019c927c01533b930867486c22b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958161, "uuid": "8598461e-321b-4358-87eb-3d9711e96f2a", "comment": "Malware payload (njrat)", "value": "8660fb841d6a31cb305776f960ec6734d02e3f329b1e058602f579ca4d3dcc0f94c26af8b7eb1312b552eedfcdd28d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958161, "uuid": "7beb79ab-d889-4b29-bac6-e744c747e3e2", "value": "T163B2194E3FB98896C5BC16748AA5965003B0A1870423EE2F8DC554CBEFB36D91D48EF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958161, "uuid": "63dd2398-8ffd-45a6-a094-eb7dc79e3c8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958161, "uuid": "3e4ce1b2-ea2e-4b8e-a0df-48b4b416a746", "value": "384:FRWKCWs5Mx/YZPxvnjmQdFxH84GlQ6rgdAyZxLdmRvR6JZlbw8hqIusZzZkbQ:/mXAOvnjDdF9cRpcnuZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680958161, "uuid": "0f36981c-573e-492e-aeb4-0918d555db85", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680958161, "uuid": "a1bd2b6b-7ab0-46c0-950b-86ff4e3da419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958161, "uuid": "d01087fe-3caa-4cbd-835f-59d6d4b64985", "value": "x5ggFxTEeJdm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f094f9-d615-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680962524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962524, "uuid": "a8da0069-a492-4315-be4f-1b6a2712dcb1", "comment": "Malware payload (RedLineStealer)", "value": "7ac4ae6068b0c81f35b326357cf0d66f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962524, "uuid": "5705e2d5-e64e-4b14-8988-1aeefd926968", "comment": "Malware payload (RedLineStealer)", "value": "a74fb348d0d23ddc72498bf51132e55f65bf890c90b63197207484521d6bb661", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962524, "uuid": "329aac19-c590-48b2-9484-3cc897449b89", "comment": "Malware payload (RedLineStealer)", "value": "629de49ad1ed19616a4a122f3e8ad9ba2280c132", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962524, "uuid": "ff83ff9c-86d4-4ff9-9137-e93a0884392e", "comment": "Malware payload (RedLineStealer)", "value": "1b4e140dcbbaf0ba27ef44d360750820189f96e4e6c928fbea0f045a460177b8b3e4d2b43394f0389ca3a26e100c185f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962524, "uuid": "e7d4d6fd-d588-42f2-a215-10398a1907f3", "value": "T1F67523AB19D1BA8CF7C4D67151664D33D87DAE02FB4BA82B591500FBFA072013FD8A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962524, "uuid": "e191e72c-4dda-4a6e-88ef-b23ec1d712c2", "value": "24576:3yH6VSntrOeE8XUkZCaK18mPELDV9GoJYEhd9y:3fVStpEpQC1e6EfLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680962524, "uuid": "f3d815e3-e23d-4489-b339-1d999ecb76da", "value": 1622670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680962524, "uuid": "aaa22332-c951-4271-8646-5a32d4d1e153", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962524, "uuid": "94fbfb3f-2daa-49c5-a2c0-4a95d4c1d4ad", "value": "ExpressVPN_GEN_vers.1.1.7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e13b62-d632-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680974751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974751, "uuid": "389134cc-aed0-4a03-912a-9c86394165ad", "comment": "Malware payload (RecordBreaker)", "value": "ab74674e1d15fade28f9a894b61e4ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974751, "uuid": "fb1be92d-3df7-47be-931a-457a058dd9fa", "comment": "Malware payload (RecordBreaker)", "value": "a8d69d44306c9a3981cbbf05daaaf1c618d5316bbbc108fdd5e946366a584f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974751, "uuid": "77fd3080-314d-4179-aef9-8c23970cf696", "comment": "Malware payload (RecordBreaker)", "value": "7d6333eb1065bba7440e1f31d9201dcd81a36d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974751, "uuid": "bc982925-a0dd-4713-96cf-435a7b05ecac", "comment": "Malware payload (RecordBreaker)", "value": "b09d7bf7046c73b9d9e57e1bec872ff453fadc39d1a1bf19331d31838fc3277d85c2dc7ce3e056a7e3fc1e621787428e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974751, "uuid": "b54d5c2d-2f11-48a2-b2f3-d43ecf242fc3", "value": "T1BB14CF20FED0CC62D59BC5B44420DAE4A97E7C6297458A9F23583F2F2D392C15E3E35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974751, "uuid": "33de3eff-f6ba-4107-a966-3deef520bfc1", "value": "f291746bcf1daae8a43c71f2189d062f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974751, "uuid": "4f6c365c-f6b5-4637-9185-a5cc88bf10a9", "value": "3072:BsE+YTlSX77vHuby75gljT57bfI/C5rBYsBR:mQSXP/t5C57zIQBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680974751, "uuid": "11e7821a-0b1e-47d9-aff3-a53dd11ad39d", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680974751, "uuid": "fdce06a0-28f7-4afa-9fd0-85d59071e1ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974751, "uuid": "7a7611ce-a73a-4b2d-8673-1a52b8d1019a", "value": "ab74674e1d15fade28f9a894b61e4ff7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b0fcb7-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680956140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956140, "uuid": "8b319fb0-3c13-4604-a19b-319c7f0d78cc", "comment": "Malware payload (Loki)", "value": "ab44699c4752e30e168816d5bd47fac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956140, "uuid": "13155de2-8f1f-4212-95f3-d23fc0308620", "comment": "Malware payload (Loki)", "value": "a9a640c3df3b4e0622bdf6ec03fb360bf5892cb080f0c888c5e813aac53762d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956140, "uuid": "5afdd8ce-036e-4f0c-bf6a-bd4c2a0b82d1", "comment": "Malware payload (Loki)", "value": "a6d40d030ff7eba93d5b73ad867393db886b04ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956140, "uuid": "76affb32-cf35-429f-af72-3905e75d62ce", "comment": "Malware payload (Loki)", "value": "06a807374bfc3293e4396fcc6e653a0f9c0391a93b78433ba60209290c94178c9145c2c0efa7427b75954219e29c922b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956140, "uuid": "ab52a85f-bb07-4f6b-babd-8107e1b9ef28", "value": "T1E8A32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956140, "uuid": "d7ed7331-8ad6-4760-9999-81e554079617", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956140, "uuid": "8fe9280f-9c24-4882-8da9-86899ece7389", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq4Izmd:nSHIG6mQwGmfOQd8YhY0/E9UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956140, "uuid": "c2d511db-7db6-4ea8-83ae-89be1c65c0c7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956140, "uuid": "0e2efbe3-7dba-42af-9b3e-047a959d8db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956140, "uuid": "5caaeec5-2418-416d-8299-1556b829852d", "value": "ab44699c4752e30e168816d5bd47fac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416036cc-d64c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680985852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680985852, "uuid": "6ebcc1e8-9844-43a1-b16a-6e5df011cb1f", "comment": "Malware payload (RedLineStealer)", "value": "76195e91acad6442ffcb3b627701b4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680985852, "uuid": "96cc9ca9-7299-4117-96f1-7c2a3a4461f2", "comment": "Malware payload (RedLineStealer)", "value": "aa43b6618abd368c09f2f8896728c958a09d282fe438e6fd8a134383da861a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680985852, "uuid": "8f72e92f-36b2-4408-b7f1-4f095881c033", "comment": "Malware payload (RedLineStealer)", "value": "8c9937b4d1333c23f2a9fa05f00f84d629d9037f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680985852, "uuid": "c44c4239-5d89-4377-bad7-a664d8a68c2c", "comment": "Malware payload (RedLineStealer)", "value": "65101156ba4a6e13f4f72c026ff7eae0feddb0a538c7d768b24c1df46f5e7b37b535f8fb0e12c6e6c116b03cfe4304e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680985852, "uuid": "7ba1d38a-f725-4171-b2ee-d8301647b406", "value": "T1DB242307B1672E9BD3183774EBF73D2D86B4D384747981E659ACF6408DA2F1184213EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680985852, "uuid": "9e8b44b8-bff0-475d-8ce5-1113428b67b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680985852, "uuid": "b26c1738-48eb-4f58-a051-af8ce7751cb1", "value": "6144:v1qjiFLrnH6ZgxiLf3KrIDByx5XqIrFv0B1wYJbE:tqjiFLW2gLirQByx3MXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680985852, "uuid": "7e023cc7-edf1-456d-8a81-4b57e03572fc", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680985852, "uuid": "e84d2b94-f14a-492b-8872-1deff2d28c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680985852, "uuid": "f773c0d5-4b7f-4671-90a4-17d2ce6a3c1b", "value": "76195e91acad6442ffcb3b627701b4db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd66082-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680956133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956133, "uuid": "5e87d653-6cce-45dd-a722-a52fa519de02", "comment": "Malware payload (Amadey)", "value": "5f43f7bc264808e0f0a428851315b2ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956133, "uuid": "86d74d98-4f8a-450f-b4ed-9cb0e7c65049", "comment": "Malware payload (Amadey)", "value": "ab27fd35aa6399cb00ae034b071448ddf55cb7ccaf1215dcebdb0a420d633d0c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956133, "uuid": "8ac8bddc-8562-4bd0-ad86-a211ef0a5d85", "comment": "Malware payload (Amadey)", "value": "08bd75a5f6fb00b76ec3e5fbd31cc63bbce8b866", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956133, "uuid": "5a642d56-6a9b-4f1b-8c3f-f31fc5f55968", "comment": "Malware payload (Amadey)", "value": "bb81416d8bd7161aa1c2e9527b067e96f3c22ff0a63a1a359ccbeed5036d3d07f52cbe15809c59b95112a3e0a4374ddc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956133, "uuid": "d6e8d7dd-b3a2-4442-ba38-80ed090e469d", "value": "T1C6352222A7E4483AF9B46B306AF356D31B36BC419624536F3246A46F0C72E907C7173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956133, "uuid": "ce3dd38c-9b24-4f76-82cc-338929b51821", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956133, "uuid": "964e6ec0-98ba-4bcc-97c7-575c5933a99c", "value": "24576:6yosjo+twr0WsieFld9W1tRrN4+Nb2I7kbcbNk/YSa94gMGRy9Qy:BxoL0zDd9EjqIYbcbMZgMGRy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956133, "uuid": "9812cbaa-e2b2-43a9-b229-62922382e214", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956133, "uuid": "a6e192b5-79a1-4001-b1b0-f8b5fab62db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956133, "uuid": "8ebf8093-e898-43da-ba19-b04e6d72ee1c", "value": "5f43f7bc264808e0f0a428851315b2ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2709fdbf-d5e4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680941140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941140, "uuid": "880622e8-c842-4be6-9adf-37ac75ee580a", "comment": "Malware payload", "value": "011e08e1833e96a280eedd66c0670859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941140, "uuid": "e7510ab2-f11c-48b4-b3ec-98e9e1a78718", "comment": "Malware payload", "value": "ad6dd5d6218a1ddd8ec9d6bcfd2e5802b4b6a39f86dc67acd61a6273fad94ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941140, "uuid": "d71fca6c-af67-4aa7-b484-177dff509d38", "comment": "Malware payload", "value": "1cf4358befd3d4b7b135881f16041f9a935e8e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680941140, "uuid": "095b782b-7fe5-48d0-9bbd-5270e1abe7a3", "comment": "Malware payload", "value": "3bbfef93c642ec8b7d016f840ffcafff5c5b558a0731c3656d9129f9cc5a6d12f2cff63f3deebf04a4124e2d4fe38898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941140, "uuid": "7ee89a47-80a1-4958-bfb4-99d04606cc80", "value": "T11BB5330B7F702DA0EE60B93365B68B007DEED97D8321863552927510EE021A1FE5ADF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941140, "uuid": "7d014bc1-fa22-4fae-b443-ede2529b5b2a", "value": "c1f9ea6d51ba4934aeaee8b1f7d283d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941140, "uuid": "c06d33a5-0d52-4b23-ab35-8ad41fcf95f3", "value": "49152:W0psLOmC85RiIvDnxh+oVx3PGlx/tabTg5Q6BkfgjE:K6mziIrnj+lja96/jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680941140, "uuid": "35eec480-15ba-468c-a2be-22dee077208c", "value": 2482722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680941140, "uuid": "d1f5c50e-7961-4893-85d6-38f90164b31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680941140, "uuid": "cb5709e2-f540-4ae5-a725-b571729c6d1c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127df20c-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680956138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956138, "uuid": "0eb6b4da-d390-4e9f-8b25-76c063b4231f", "comment": "Malware payload (Amadey)", "value": "9821b37fb75d63f96c3d644f670d3592", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956138, "uuid": "c2958ec4-8184-48e1-aeda-4fed9231a1f3", "comment": "Malware payload (Amadey)", "value": "ad87fff54c6386ba282fdb21d283c187aeef155263d52f7da25baed2968ba7ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956138, "uuid": "ca1b116a-1a87-45e4-b5d4-7fc472ab13d1", "comment": "Malware payload (Amadey)", "value": "25ca3c26f07326cf6935e2b4e5e0409925ab2a8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956138, "uuid": "0e085488-4809-4dfc-ba96-0eb10300845e", "comment": "Malware payload (Amadey)", "value": "9d74a341c53c7730603ef71e14f6b1cd68fe7f00faf941b3e36a8baec007ad64fd990a80a4aa49296d83ddfec41a52d5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956138, "uuid": "a3e2d914-69a1-4537-bb7c-9c58d4834c3c", "value": "T1A4152313D3E45477D97427B028F623971A32BD5219B883AFAB819C1E19F3244ECB176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956138, "uuid": "18d49110-d2e3-4986-a288-baeeee2322f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956138, "uuid": "7ed918a5-ad2d-4474-9dec-cd352775f414", "value": "24576:DyRsldQVVR98DoxAXxG/CObc9v3qA1QcnHH7:WcdkVX8D08s/Lbc9PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956138, "uuid": "2c63863a-621f-43a1-9903-a334ced05c69", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956138, "uuid": "7db7305e-5492-4624-bd5f-36d7b173f1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956138, "uuid": "96969100-242a-4e0b-ab2b-1b4b93877dc4", "value": "9821b37fb75d63f96c3d644f670d3592.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ba36b1-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997209, "uuid": "7f79c492-788a-40bc-ab84-4f20a6665b87", "comment": "Malware payload", "value": "5c3d290bf5320c2ce62b652248272e56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997209, "uuid": "84d35720-4111-45a7-ab00-5754310d4b8c", "comment": "Malware payload", "value": "aedf438f61c37b5cef0d03b1dc4a62c7b55fc481f44a74cdacdd27d3b90a927b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997209, "uuid": "032d31cb-31c8-48f5-b550-a2a3849f7a61", "comment": "Malware payload", "value": "5be4ec6067487ba5e0892fa4fb6fad39c6e11e70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997209, "uuid": "9c3066a7-4df7-4ed7-9810-2b7109ad9cc0", "comment": "Malware payload", "value": "cc4596a5c08996fba9ca84984291af02bf3fcbcc5629dfdf53f7758000dffcbc2ba3ef04f34efa05f5345e9c3988ed45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997209, "uuid": "0e4fb233-86f1-4f3c-aa47-5226e272fc61", "value": "T1A9633A02B791CAB3D08306B506DB9F114933F9BA1B569F46F36C7CF0AB15184B226F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997209, "uuid": "68535c8c-e0f9-4469-8ec6-8e7c021d8fd4", "value": "1536:r5M1Fp9tpjJWgRtotARSlEwyWpi0PqUuXQC+0mjm3+lVrCjmxfZp1:r50T9tpjJWgROAwlbQ0PLiQP0mjmOlVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997209, "uuid": "51c47093-9864-4eea-9482-008adf2c1b29", "value": 73026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997209, "uuid": "4a2b6a45-7676-4d22-95b8-d0603936505b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997209, "uuid": "a4b65f29-c9be-4d30-a9e0-670b6027cecd", "value": "5c3d290bf5320c2ce62b652248272e56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f421aa1-d667-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997471, "uuid": "816b6a0c-ccbb-4b89-b601-5f0373db36ac", "comment": "Malware payload (Mirai)", "value": "d0a17d99be546d5aa49ba313c1f8798d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997471, "uuid": "a0cb937d-1cd8-477d-ae8b-1c6be07ff63b", "comment": "Malware payload (Mirai)", "value": "afb8f6fb9e67d732035d7c6005c73bf557915fc4dc87f226164a272e202fbf5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997471, "uuid": "1eca4386-d50e-4c77-bedf-82ea531d6de3", "comment": "Malware payload (Mirai)", "value": "3a8ec757049bc177bdf0bf2f40c5477debd4e228", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997471, "uuid": "b98282c6-98e2-49d2-b3c6-79238d1ff987", "comment": "Malware payload (Mirai)", "value": "61041c261f699617e3da2f06857d6f66c97b50699d25169fc2853929cab8a76bcc7e7f2871ba46bc76efafbe6c654f2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997471, "uuid": "5e76a8c1-1cd3-4b51-b612-51861d33634e", "value": "T1EB435BC4F643D8F5EC8705712077FB379B72E1EA2268D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997471, "uuid": "6d3cf604-c2d3-4c61-9b3a-30ed6fdacacb", "value": "1536:JeESt/basV2rcZhG6+KN7TqqpW1ZzWOIaEjrqMWs:JeESt/basVTgW7Tqqw1ptXESp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997471, "uuid": "4c00f95d-445d-41af-96e7-f685c527ebd8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997471, "uuid": "8b9f53fe-e1dd-4181-8b7b-4d6c6ddd7cb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997471, "uuid": "85067e73-fb60-4a7b-83c6-6b794e0f3dad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a8305c-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959690, "uuid": "35576223-6aa4-4f91-bd57-1598778ceded", "comment": "Malware payload (SnakeKeylogger)", "value": "bf1b45251b65fccedacd7a951e19859b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959690, "uuid": "763890c6-626d-4903-9034-e7c6252ec550", "comment": "Malware payload (SnakeKeylogger)", "value": "afc9834855cd9025cd9287adcee151ab0375829b19638cc41ce355cae7e3dc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959690, "uuid": "bf50bc8b-b785-4883-8539-291320b2b1e9", "comment": "Malware payload (SnakeKeylogger)", "value": "662cd86c31901ee3251a05c3a88b1052175a672f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959690, "uuid": "c0c46a26-30b5-495a-bf8e-1f6ae3efd7d2", "comment": "Malware payload (SnakeKeylogger)", "value": "8010da3e420d5da3fe36840ee32d2a1e1343a74e740d51240466e1e85d563083b9901b63b82dc679ea131a3c9530be80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959690, "uuid": "e0d9e486-3e24-4d4f-bcb0-f1c1b30939f6", "value": "T1EED32A1D67F88800E1FF9A7300B15122C77AB842196ADD1D5AD2F5192A7E790CE1BFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959690, "uuid": "380425b4-a503-426b-8d54-64894f61af0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959690, "uuid": "cae4bfd9-b575-4152-a866-f05f6942b409", "value": "3072:dkngByVBAGRh6fiMqvEWb8f+QTwBiO9FbY:l0CDqvb4NOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959690, "uuid": "18ddb516-477c-4281-b2b2-2ba49e4817c0", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959690, "uuid": "c72ad518-9d51-451f-82ff-10cfc0b0d912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959690, "uuid": "ad82911d-c25d-4b5a-a5c8-475ce81f2092", "value": "bf1b45251b65fccedacd7a951e19859b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c066b7-d632-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680974742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974742, "uuid": "27af330a-98cb-4a62-bc1d-42b989cd72ce", "comment": "Malware payload (Amadey)", "value": "d671a43cc433dbff920e45965f5810f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974742, "uuid": "7e87af8d-5c23-410c-8e23-d75544373ac4", "comment": "Malware payload (Amadey)", "value": "b181e8afd4822f75f69f62c09ee9194631a6669ca9283b575e855119316ba6c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974742, "uuid": "28f16ca1-7d9c-4499-b330-48d9c52ea95c", "comment": "Malware payload (Amadey)", "value": "40180f91329335c841fd8d081e832e95af8ac826", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680974742, "uuid": "01976413-2eef-42db-b1cc-1d72d535cbcc", "comment": "Malware payload (Amadey)", "value": "435d974d5880cca627b7d84680834e67388c8a0ae82d99cbbbc632ab7554f930074deb738ef435b8ccb643ee2fb6f39a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974742, "uuid": "7de9bd91-5813-4594-9b7e-7e9a2747a0a2", "value": "T169152302ABDCC436F46A17709EF252530B37FC820C74536B27C66E69ACB25986972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974742, "uuid": "54d9c00e-a8dc-4a11-ad6e-1b9b79a5db75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974742, "uuid": "27cab0e4-504b-4b6b-b100-268a6770522a", "value": "12288:RMrry90NAWuTHqbZRztu/KbFv1d+bWlUFoWK4IkpixJMPATx4cSSkxu3+uORf/bz:Gya8SWeFNd+6lUbK4IVVASYymbuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680974742, "uuid": "3793855c-382b-47fb-9402-2750c6874bb7", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680974742, "uuid": "a375a7a9-f52f-466f-b14d-b47c8668cea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680974742, "uuid": "d6cd8fc4-a19e-42af-907d-7533d6ba05af", "value": "d671a43cc433dbff920e45965f5810f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4ed135-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994242, "uuid": "fa703e21-8d0d-4d29-8f29-890ffb28e881", "comment": "Malware payload (Mirai)", "value": "e738b181bb46981c30dfb5a34dc90400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994242, "uuid": "653d1135-09c5-4475-a003-85f18d610d1b", "comment": "Malware payload (Mirai)", "value": "b2f3191e421373ea0d47636229baf4282cbca7f5f9f18760f35debf897a12ccf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994242, "uuid": "bb319d32-15cf-4353-b019-5408635e4588", "comment": "Malware payload (Mirai)", "value": "16bca6499983fd4260aeb487ac658e23da47cea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994242, "uuid": "8385e3bf-a5a4-4a23-b508-5222ceb02b5c", "comment": "Malware payload (Mirai)", "value": "86a6e5fe781f483390174d98a99f36ca4fa51f37b0de48dfb34eb1dd30640b0f7c8e6d1b398286035e1ef16d8742e12d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994242, "uuid": "e4956ca9-239f-47a6-b921-9c25b6ff6827", "value": "T13BB32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994242, "uuid": "6702d0ff-b124-40e1-8278-69a9fec7a274", "value": "3072:Uvc29uyIcxE/sZxw+OqtKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOc4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994242, "uuid": "ee0a38a7-5534-41b3-b9d0-a0c4e31a199c", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994242, "uuid": "1ada0a1f-7254-4056-90a3-cf5a252acf59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994242, "uuid": "c326f091-50cc-4fce-a3f9-c3d61138b108", "value": "e738b181bb46981c30dfb5a34dc90400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056c4818-d61c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680965135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965135, "uuid": "ae3adc74-28a7-47e0-8021-4bddced31d76", "comment": "Malware payload (Amadey)", "value": "2a206b44cb6752b2dfeb4ef2393010fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965135, "uuid": "33cc7494-11d1-44b5-be6b-79410109fb96", "comment": "Malware payload (Amadey)", "value": "b308892503b0e611b09435cd9621c79295cd1c6358590d04aab7030e2ed585fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965135, "uuid": "72daa419-2eb7-47a1-93ad-e53422b7e7c9", "comment": "Malware payload (Amadey)", "value": "7be7d6236574ff69059e42294158482abf9e3db2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965135, "uuid": "a3831391-d716-434b-b0d5-18723c1b2097", "comment": "Malware payload (Amadey)", "value": "1b0f7ecdfb2c9be11cfb4e06cb5f106dd2134d8cc2a95c50e1d33f8faeafd50de544ac9304fcb2e5d9e08cd576ce5200", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965135, "uuid": "b41a2cf3-f6c4-492e-90a1-0b87d4c58d9f", "value": "T1CA35234677E99125FD710BB01CF143530631BCE24E74472B6392891B4D73AB8BAB6B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965135, "uuid": "3d06e5e5-bbf3-4bde-87a7-adfce490987e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965135, "uuid": "225c20e6-0aff-42c8-9188-e0ac268667a1", "value": "12288:kMrxy90S8DN5Mn9cCNnb4c8TMjfOnGoBVfzkfHpmmklE27gDfI7pimzDQ2kvQfL9:dydFcsbFmGoBQH4zlE9DfIRMHZrYHpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965135, "uuid": "3d65089c-c9e5-428f-85ea-39529e307137", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965135, "uuid": "a02b75fd-ed12-4d03-b721-496d21b3ed1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965135, "uuid": "924f01c2-a9af-4897-9a57-55a9e8fc852f", "value": "2a206b44cb6752b2dfeb4ef2393010fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1017dba-d614-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680962014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962014, "uuid": "f2527f2c-a6b9-4621-bcde-70d467b4df7c", "comment": "Malware payload (Amadey)", "value": "4061d8dd5006b99d06fa208c0063dfcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962014, "uuid": "50302296-4877-4323-84d4-ea7710fd1a10", "comment": "Malware payload (Amadey)", "value": "b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962014, "uuid": "29f0d070-3c3a-4d40-863b-90647d44db21", "comment": "Malware payload (Amadey)", "value": "38e7df8d8e631f3e9b227df3b9326d187e18cce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962014, "uuid": "9610bd57-bd3d-4cb0-b0d4-f748765584b8", "comment": "Malware payload (Amadey)", "value": "095e726856fa55734c2137f14b59883370487720b494e43d0633bcdf911ba387f9965dc757ca35730dc333efcb0b4722", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962014, "uuid": "5de26035-1a55-45e9-9622-635e509c2e89", "value": "T196936B1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962014, "uuid": "7c232bc0-5977-420b-a2dd-35eac2550aaf", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962014, "uuid": "0dff0aff-3ea8-4600-9cc9-42a8fc0e1374", "value": "1536:Ro4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU0GaB89p:RoUCWbBNpplToUs1uNhj25LJUzaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680962014, "uuid": "b5774a32-335a-480c-b2fc-e01716dca0dc", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680962014, "uuid": "a33bf43c-2f3f-4d37-a9a9-53601aa486c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962014, "uuid": "f12130ff-ef8d-4b39-b39c-1fb6dab052b6", "value": "4061d8dd5006b99d06fa208c0063dfcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee84160f-d626-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680969821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969821, "uuid": "449537b8-e74b-4654-aeef-dcb3a5aea1b5", "comment": "Malware payload (RedLineStealer)", "value": "025e4f27d3eb7abc1ce50439b4878140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969821, "uuid": "0811ed1f-5643-4a45-8c41-67c87d6d65be", "comment": "Malware payload (RedLineStealer)", "value": "b424938e2695192fa43b19177951d59c889969c2cea2e702977a9254e1230ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969821, "uuid": "71f337fd-0cea-46bf-8c30-0354ecbb6b31", "comment": "Malware payload (RedLineStealer)", "value": "1adb5600072928acb831e535da143611ad720d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969821, "uuid": "a050b9e2-3232-4f70-a1e9-7b718df38cda", "comment": "Malware payload (RedLineStealer)", "value": "0b6d3ccc54d56dd214ed8921b7763e1ff0fabcfa379a602c28df194c2802c2e7b8a187af022d78002fd8c4e36c629a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969821, "uuid": "370a5e29-2253-422c-812b-d423d3755a47", "value": "T124547B8721C92471D837E3FB80F2B55D52DE192073DD29CB3698F04B6D292611AECE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969821, "uuid": "7cbbc755-1293-4d15-bb5a-8ec41f13f827", "value": "a0e60cc838fd0f681073acc8737e4ec0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969821, "uuid": "39e53ac3-843a-432c-874a-c884714f0851", "value": "6144:l25a5l6iYggrwEabIK+hOS7j/1g2qlIzocSpzRjRFND11qhHzHR:g5amiYMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680969821, "uuid": "9858a03a-7163-4284-8ed0-1bf09c9ecf0a", "value": 285856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680969821, "uuid": "9b2cac11-828b-447d-9a8c-a980341546b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969821, "uuid": "7ec3faa8-765b-4862-87f2-a212f18ba47a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299e7a0c-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993543, "uuid": "5ed084b3-e97a-4c9d-ba4f-5880e3872422", "comment": "Malware payload", "value": "0c2613392e0ae7f4432d9cb7b20b2f54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993543, "uuid": "9217cee5-42f2-4691-aec0-58fbf2be6c4e", "comment": "Malware payload", "value": "b4338ee0aa302dc2883d6fce81143197a12a7d10947a8e572618ca2ff5b79acb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993543, "uuid": "1b758d28-b3c1-4dca-969b-cc1b2fee91e8", "comment": "Malware payload", "value": "f7dc4e5b144e7e0b154eb0f5e6dbe3b7d93d5850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993543, "uuid": "1073e34a-c627-4391-989d-b53087efdd91", "comment": "Malware payload", "value": "fd954163e7875456727e7e0a06333de3373dc69a2a98de34a2c1dfe08b867e0e20009ef622dce51fd40478281b0f349a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993543, "uuid": "e6c60419-d9c8-4aa2-876a-b54147064d95", "value": "T1CC63C509BF650FB7DC6FDD370AA8070534CC551B22A87B393578D828F65B64B4AE38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993543, "uuid": "b41a638e-99b1-49da-aa72-3db592a8cf26", "value": "1536:gh3bDYczHGBMiikaOaUVZMmXZmBSNzD6kpkH:gh3bzTii8ZrX6MkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993543, "uuid": "ea3970dc-b679-47c4-90d3-b0c82184a5f0", "value": 73188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993543, "uuid": "5627bf83-80a5-4c0f-a1d1-e2a0dcbdb089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993543, "uuid": "24fb410f-f743-4538-9b9e-8b4fc4941f3b", "value": "0c2613392e0ae7f4432d9cb7b20b2f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61601ff2-d664-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680996213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996213, "uuid": "27c2024d-8e40-43e9-9186-52e2a68eb8d3", "comment": "Malware payload", "value": "a135e76c05d67dec6d438e500e5405ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996213, "uuid": "29b6e4c9-f335-4b93-9c85-f929293401c1", "comment": "Malware payload", "value": "b472c8bfaa57e5b25ed2eab68f0d1a945c52475896038bba149e17f41a007c12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996213, "uuid": "b23b3f4a-9070-4076-8859-acacec29ee94", "comment": "Malware payload", "value": "3cf28d911dfd0ede2a8b9f2429d3979e2d42ec60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996213, "uuid": "6a3ee9fe-a811-4848-b54e-0d00e64894ae", "comment": "Malware payload", "value": "5039b069ff5ce824d3434c0056f8f17ddb622f3ced31fa1501a5c2f6c62ecfed06f08e364c37b4f8198049ef526cb968", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996213, "uuid": "83675001-5b20-42de-bad1-23e7cd2b611f", "value": "T1F3834B43B71D0B53C49B59F028FB2BF18769B9E112A66181B21EFFD41373AB02512F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996213, "uuid": "cf5dd250-769c-41db-89f1-96c5e54c61b0", "value": "1536:HQyRtjtNIIISOTOwwTALVtm4dztsgVmkO0VPXjgFf6TX:HJ3NISACf8ztsgVm50VPXkFf6TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680996213, "uuid": "c0da9060-069d-4813-ae6c-4f525eb79fa2", "value": 85005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680996213, "uuid": "f93bd636-e4cd-410d-b83a-de578f44dd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996213, "uuid": "08c73d4f-56a6-4702-8879-980ad54463ca", "value": "a135e76c05d67dec6d438e500e5405ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf12dc8-d5d8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680936021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680936021, "uuid": "9ac491a6-ce3c-4f91-8efe-5a1e8b267c57", "comment": "Malware payload (RedLineStealer)", "value": "c0c33b893e1e3e41dfcbece9beadb8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680936021, "uuid": "090f24f7-5f64-4bc4-9eb5-7506f1d1a80c", "comment": "Malware payload (RedLineStealer)", "value": "b538f36452294a608712507dba867ee7667241daf9cd59758bb21481c84e5232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680936021, "uuid": "51fff06a-f1b9-4b96-93ae-dc7c8d288541", "comment": "Malware payload (RedLineStealer)", "value": "73418cada56ab86f67f54b609be422604cf0ebcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680936021, "uuid": "5fe29398-87b8-4802-802a-16fea47cc2eb", "comment": "Malware payload (RedLineStealer)", "value": "d98254544958d87377d61c788fe20c5728379455ffcbdca627ae2540db5700f88a2f7f98ddf9b9d223a65179fbfde2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680936021, "uuid": "b4bfa25f-49d2-4f1e-a4c4-acd591c03fb5", "value": "T14ED32BD93348669ECD6E8970D4740C648BB0A0676207E347BD87F4FB6E5DBC29B091E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680936021, "uuid": "5b9a3a04-7ce0-49bf-ba0e-7b78d601490e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680936021, "uuid": "44c7a868-b14c-41f9-907d-a423444a3b94", "value": "3072:c/Vk2oWf0mXdjqW40BAOE2WpH9YgafJlL:qN5qx2WpHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680936021, "uuid": "ccc63fd9-3995-4d97-9053-f6584e96e962", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680936021, "uuid": "f8138357-f8f2-48cd-86f7-7d5681897e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680936021, "uuid": "15eff40a-e3ef-4b79-8d0f-a66a66a53aae", "value": "c0c33b893e1e3e41dfcbece9beadb8db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1db0dae-d5a1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1680912623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680912623, "uuid": "5907e058-254a-4a56-9f7e-cc1849615985", "comment": "Malware payload (Pony)", "value": "ae9ab1c93d1fc6eb77fbcf948ce74c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680912623, "uuid": "1d287c84-eadb-415c-a449-8239e220bc30", "comment": "Malware payload (Pony)", "value": "b620f69c6dd98b0c8935f223b1d11b4526f63c9aaae62577564a786220d3b2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680912623, "uuid": "06d63d9e-ca4b-4f49-98af-fb3a70670c70", "comment": "Malware payload (Pony)", "value": "14024bb23b2edadb8142961f49accb424eb81b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680912623, "uuid": "6fe13a88-7677-4636-b172-944d19b9ecb5", "comment": "Malware payload (Pony)", "value": "2dae6806db6d173dd41adf2ba7a6e90eac4ab15b88c48eb15e1f68e08480b4b0af98b752c87a1f43386f09fe104762b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680912623, "uuid": "98a5dd45-977c-4110-a606-109a3348abf5", "value": "T184F37D4DDA0751BDDC22B8742540065AC8E6E7E410BF6667D2036EF2197A220FFCF9AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680912623, "uuid": "1f753372-d4b6-4cf1-a399-d9a6afb9cb4b", "value": "5fb31092c03d52d6a5941ee60c1249f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680912623, "uuid": "57505b25-d1b9-47c9-8af8-96832cdbc0f4", "value": "3072:aIvFYuVT+wiEEYW+vpwugjxYJQXlY2UbfVAiiHe4Sm0uoWlzKguB/Bgy1Xp+w4hc:aIvFYuVT+wiEEYW+vpwugjxYJQXlY2Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680912623, "uuid": "8327f95a-2589-4203-895b-0099673b2986", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680912623, "uuid": "2c9a5edf-d9f3-4959-bfbc-61311314ed0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680912623, "uuid": "824f7eaf-28ad-43cf-88aa-95238b243802", "value": "B620F69C6DD98B0C8935F223B1D11B4526F63C9AAAE62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8811bd-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1680965018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965018, "uuid": "e1eee27f-a17b-48c3-8761-8fc179dc0b8e", "comment": "Malware payload (zgRAT)", "value": "0ea2e9b9e8a551c55377aa57b2c7d93b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965018, "uuid": "b87ba1d6-f50b-4914-b69c-632c69209d14", "comment": "Malware payload (zgRAT)", "value": "b6a8c799ddf7067366ab2864ca1573ba1d4afbc2d9fc70688bc8a7be54dbc78d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965018, "uuid": "ee1d07c0-ff02-40b5-bf85-425585119be4", "comment": "Malware payload (zgRAT)", "value": "94149642bb3bc489bd5691f6781c33bec0d128cf", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680965018, "uuid": "7e478fb6-e822-4ca9-a720-3e0b47fc9139", "comment": "Malware payload (zgRAT)", "value": "3c94f9714ff19440a475a0e360d2c796b7fba990f8ef7dc2dac26d651e1bb9d97aac26fcc5a0dcab0875ceac4a0d6d1e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965018, "uuid": "adb678db-0673-4a63-90c6-c8dfc63a0733", "value": "T1B4617C1457DA0308F3F2A73AA9BE52954E3B3956E932C74E0059414E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965018, "uuid": "a7273ced-d8e4-4e4c-9994-c82823803a8b", "value": "48:8KHaKU9Dmel0iglZ+PlpQfYj1sAT1rTRRSJxodgImcC:8KHkB0+96YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680965018, "uuid": "bed60ca1-7ae5-42e1-b688-16e63c06cc5d", "value": 3452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680965018, "uuid": "238683af-4683-4a8f-beaa-c04d6f5c5e37", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680965018, "uuid": "70d8a981-73d1-4aaf-a478-b535a1adf0a0", "value": "New Bunker Quote Request.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5940681-d621-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680967686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967686, "uuid": "7b5c13dc-daa3-488b-8f5a-206f19a82ab7", "comment": "Malware payload (Amadey)", "value": "846d00634429d1dfd48cbdbc24e8b8e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967686, "uuid": "86b94915-2f93-41ee-b78c-b1a5dedf06a3", "comment": "Malware payload (Amadey)", "value": "b748f7ed33e333933d0b199f8f7456c66060a616c67a14c1acccb5732bb2cf2e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967686, "uuid": "5b13aa47-551c-4302-bc5a-f980ea65ad65", "comment": "Malware payload (Amadey)", "value": "fcd151b8544b2f0cc22ef988d2216e2574129091", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967686, "uuid": "c3d4d133-8deb-4b9d-8ef6-1ba16efbc2df", "comment": "Malware payload (Amadey)", "value": "ce361f270992c16d5e36ffcfb87429128cb1a8ef8f5f55e47be9b5b385e17f74ab10a9b6913e34e6d04467ce8a93dc03", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967686, "uuid": "33073a8b-3187-45b1-ad0b-e1916c4c77a7", "value": "T1C0357C1BA26601BCD4BB9178CA275A47E7B5744603309BEB17D04AA63F13FE16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967686, "uuid": "023a44e5-3675-47c0-a42f-b0010a801f2e", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967686, "uuid": "8627ef30-4460-4785-b005-59ef1b194993", "value": "24576:3Nq//30h5a8zrC+azFbWZhvjhKuTZyRQYe:3Z5a8zrCHzQZhvjNAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680967686, "uuid": "bf780b00-4e29-45a5-b0bc-5171a2627fa0", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680967686, "uuid": "ea17bf7d-c40c-4119-b387-f0c7944abe4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967686, "uuid": "982cd7ef-dc27-4591-b9d1-0b9d84180a01", "value": "846d00634429d1dfd48cbdbc24e8b8e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c9bc81-d610-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680960332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960332, "uuid": "90911817-c374-4882-92c8-eae9c6ee1389", "comment": "Malware payload (Amadey)", "value": "d75390e0a1e3a329e3c3b3a87a5a010f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960332, "uuid": "13980c69-b0f0-4435-a14d-65168e1af180", "comment": "Malware payload (Amadey)", "value": "b9111378abf5d1a5e8bc6b042fd428705e32808e68f8cd867e9cafca4f27c23c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960332, "uuid": "c0bb9582-83d8-45e5-9dbb-5c61719b9ff2", "comment": "Malware payload (Amadey)", "value": "7d1abf91ad6acc847e7c38a8a5361e2a34cf0d05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680960332, "uuid": "db856b74-6fe9-44c8-81bb-e9e5834fe738", "comment": "Malware payload (Amadey)", "value": "be656a112b0f0f8d65b4142f5adc6f67296f12c0779aa59ff4ce61738d8a2e4225be0098f6e026c84b9580b3899567c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960332, "uuid": "d155c37c-9ff7-4971-b527-1305f7c6a1f8", "value": "T197152303EBE45433EDB127B118F617A30E26BC6099748367279169AB5D72B40AD3137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960332, "uuid": "cecca330-c14f-4e9d-8f3e-04b82f0f7107", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960332, "uuid": "4a94da79-e487-4bb9-9e8c-d64986e31f78", "value": "24576:WyrlipPo7kWWw+AkTWGIJhbcZfJylMbuu:lxcWHWhrIfbcZWqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680960332, "uuid": "311012f6-69fa-4033-b990-e612ea99d7f9", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680960332, "uuid": "b9bcdef9-0df8-4eb4-836f-166b8a5ec4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680960332, "uuid": "f2a4862a-0614-40d6-b9d5-26c422a79c4f", "value": "d75390e0a1e3a329e3c3b3a87a5a010f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c8fd57-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997158, "uuid": "ca5f59b6-f3e6-4ec0-90ea-80c682247a5e", "comment": "Malware payload", "value": "f45dc498c9350e739806eb6ac395f3c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997158, "uuid": "5fd678a6-61ea-479f-b1c5-51bed9e55687", "comment": "Malware payload", "value": "bc115d1d699a603126e831813eb5204bca6749610f381f1273ad00f925f6d009", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997158, "uuid": "2932b826-7f3f-4255-9bb8-555a26f6d7b6", "comment": "Malware payload", "value": "f5dd82204f46f2cd9e00b99f9c88031300f4be81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997158, "uuid": "f5ade4e8-5989-4885-98b5-f5639f87ce23", "comment": "Malware payload", "value": "bbbb41f495cb947bc011def864aa7024a004e21ce68aaebad5aba6ed1f6c5d9f33ff8a6d1fd3d6deda42d36fe8ab2186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997158, "uuid": "ef45cf33-ec5f-4b05-9073-5af5b1424893", "value": "T1F9B31801E5508727C1D3277ABB9F465E37332BA893DB33115A24BFB42BC279A1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997158, "uuid": "145f3bba-ebf1-4381-80df-c703ace899d1", "value": "3072:xbb5LatrDOa8YDOZ8Gvmpr5womiQ9WtX9+a:xbb5mDOauZ8GcwomiQ9Wx9+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997158, "uuid": "47ed381e-e665-4aa8-893c-d7275fdecb0c", "value": 111063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997158, "uuid": "db33332e-2965-4f3a-9f97-43c5e6368429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997158, "uuid": "54c431f3-f56b-42b3-af65-03ca6b7a7f77", "value": "f45dc498c9350e739806eb6ac395f3c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7cbc10-d664-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680996205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996205, "uuid": "480e696c-d551-454c-aa70-c866c48cd6ef", "comment": "Malware payload", "value": "bf607f1bff4d0d609703acba7870c199", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996205, "uuid": "6633969d-5f0e-4741-ac6a-76d8cce91a01", "comment": "Malware payload", "value": "bcd0b1a75f39771150489cef597c14cb4ae6c2b1da6b821ac920cf73e9e958b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996205, "uuid": "340e8fba-4c74-4f52-b916-5aa6d20fb9cf", "comment": "Malware payload", "value": "99438cc9fbaddb667316735581247c2b360c5d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996205, "uuid": "45dc7744-f027-44a8-a425-58f8509fe494", "comment": "Malware payload", "value": "91344f0699536e97b7fc8d4b7a185a8abb33dfa0da210d25d3b3b4575529a28d86b0065731ebd546f91a33675044d895", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996205, "uuid": "b1500bda-882b-435e-90f5-6347305914d6", "value": "T154931845F9408727C2D337BAF78F475D3B366A9497D733016A386EB42BC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996205, "uuid": "278d6778-e4a4-4ff4-a7cd-e08261272b12", "value": "1536:hMP0Wve5ZXjKF/zI/0m4xXOqf/As/HF08BivxeDLu+O8emuOhqQFb/aKXkCX:JWvgr4r/FHZBivxeH0mvhqQFbCKXkCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680996205, "uuid": "028a1a7d-d0fd-404a-83bd-3903da7247a7", "value": 92437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680996205, "uuid": "56e72ed1-23ae-4e52-b93e-42a289333e74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996205, "uuid": "3fe26202-1055-4130-978d-04d46f8b3415", "value": "bf607f1bff4d0d609703acba7870c199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19650294-d5f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680947130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947130, "uuid": "891210ad-6a69-4f61-90cb-2a9bab344af6", "comment": "Malware payload (RedLineStealer)", "value": "62361d9cca323376b8394d0678090cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947130, "uuid": "6af8eff1-1158-467e-8b41-d80856c56519", "comment": "Malware payload (RedLineStealer)", "value": "bcf1ab4912e5d137130554513cd7b8c94377ecff8a1a51fe0061d3fb8c2a0f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947130, "uuid": "4b884556-1d37-45bf-86ba-ccaec143ab94", "comment": "Malware payload (RedLineStealer)", "value": "a053093dbefad3b6be5a905758b7635dfc15ca1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680947130, "uuid": "47b8d0a3-cf68-4a42-ae9d-a65afcb04713", "comment": "Malware payload (RedLineStealer)", "value": "6f478daaab40d6c25b3c6379a48feacd1379d67bcab09fe1a4ebd94261b3e7e604d0ff2270a809b1e688d78db83c8e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947130, "uuid": "b9d92ce1-4b29-42f1-9e6c-00bba3fa10f2", "value": "T19C352356EBC44033ECF817702DF207430A79FCB55D6946663247ED6B88B3184A9B63AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947130, "uuid": "d8da1b00-b7a2-4ecf-a126-c857bbd3172b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947130, "uuid": "186bd05f-6843-4379-841c-175d86d838df", "value": "24576:/yKXw1MsknwZHnvmmTSBFXgPziR8WVVTa1nTik:KKYk2+mTSAzQ8WWTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680947130, "uuid": "ba815eb2-6e42-4975-86f7-19e17750f03a", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680947130, "uuid": "468566e5-43b3-45b1-ade3-fe42ca0bbde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680947130, "uuid": "0f682d69-2d85-42d5-bee4-b1eaa08fac52", "value": "bcf1ab4912e5d137130554513cd7b8c94377ecff8a1a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fae2af4-d5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680944322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944322, "uuid": "0c75989d-7963-4d63-bbfb-e5ff6a631a2f", "comment": "Malware payload (Amadey)", "value": "940af61872686e1bf02772033d5c544d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944322, "uuid": "f304a751-e5e8-4614-9a88-42be95ba75f9", "comment": "Malware payload (Amadey)", "value": "bd1ce0f25dd06b0df4198c996b12eb64531bf638e73924a25a278359740d6401", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944322, "uuid": "457c7bc5-fd8d-494a-8c1f-227f3dba47f3", "comment": "Malware payload (Amadey)", "value": "e622d16212df65473df0666029006dcbefe1f493", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944322, "uuid": "6a1ac62e-2395-435a-ad6e-bc639b83585c", "comment": "Malware payload (Amadey)", "value": "72419e7b7a89b509847ec9d7ec5ce333f9d2bdf64f38a989794e761886b5c1a82e9fd98da6d3a973782d1c3f34703f86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944322, "uuid": "8a12a9b8-3f0b-4a9a-90cc-b0ea6012326b", "value": "T1A9936C1030D2C471D97E55351478EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944322, "uuid": "ff72df9f-d6a8-41cd-95b3-b21ac9236575", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944322, "uuid": "d0b7aa5f-77f8-4e7d-93a9-0317e5fd1252", "value": "1536:juON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUfaI89p:juhVZbtvbpxLHoUsYuNhV25LJUfaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680944322, "uuid": "7d862263-76ed-44bd-905f-8f1ed77428da", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680944322, "uuid": "2760ffce-8cc3-4e65-9cec-d24a59515e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944322, "uuid": "631eb757-4f11-4984-aa45-2a775fa438df", "value": "940af61872686e1bf02772033d5c544d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96f9516-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994187, "uuid": "02a39093-b214-4e3c-8656-05ac4d157847", "comment": "Malware payload", "value": "9382bbce9b3f5ec26efe44f463f88148", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994187, "uuid": "7b2d555e-b019-463f-bf08-d92609088318", "comment": "Malware payload", "value": "bd360d7ff33b81957178eccbca08ecb014d10e85f3ed73db85760c5eb40960c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994187, "uuid": "3fa0f88d-3b6a-4bb7-a5ea-fd80ade1cc54", "comment": "Malware payload", "value": "0d921e9ad8364388f1205a7190e6b43e758b437d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994187, "uuid": "bba7481f-6421-4f45-9c24-fe373ca2aadd", "comment": "Malware payload", "value": "e67a90c3bec9ad48804d4d616ae469e532394932b62643b1e0954db3b0acf48da4edebec15f6e7285c247ffb370f8014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994187, "uuid": "cdc6667f-8c30-4ff3-9607-681f51138fa6", "value": "T1AA830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994187, "uuid": "a5190c16-7aaf-4820-9e38-5c3139a9b32f", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1/8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3l8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994187, "uuid": "a4b0108c-eefb-4a8a-b14b-3fdc55516b8f", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994187, "uuid": "294df5c2-1595-4fb5-b279-9d593d43a6af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994187, "uuid": "c68f78ec-80fb-47e0-82c5-442be21d9712", "value": "9382bbce9b3f5ec26efe44f463f88148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da3e90c-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680956130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956130, "uuid": "aa3b0fe9-8259-49d0-95b4-107daa8012d8", "comment": "Malware payload (RedLineStealer)", "value": "2ccfba54f5f853eb1705dceafc0ffe59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956130, "uuid": "34b53ccd-6e67-43dd-98b0-dc9a47ff60a7", "comment": "Malware payload (RedLineStealer)", "value": "be2a4634c8cea6ead9547bfbec6557629a8a19fedc559f17fa93f0c3d16b6b7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956130, "uuid": "ef9865bf-2629-454f-a3ff-43bef231f9f7", "comment": "Malware payload (RedLineStealer)", "value": "4b64183fc7c3f90664ac95abb39d39640efd0755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956130, "uuid": "79f21846-a9f5-41be-baef-b691092af605", "comment": "Malware payload (RedLineStealer)", "value": "b3990d7ae1d9639a280d24938eceac43de62c1d1a6383c0c0ffec47e60bcac761c92fe6c118c5ea992cab25cd0889345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956130, "uuid": "1ddf0320-9a1b-431c-968c-3264c2e906a7", "value": "T10D15230197F18433CC75177028F663D71F337CA09AA8978B3949A8AA5CB2B919972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956130, "uuid": "7bcd86da-8391-4cf9-a7cc-bce6e335e89d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956130, "uuid": "dae50270-e0f8-418b-ad7c-e2b1f831cf95", "value": "24576:7yfd605RgG+yNYWjD9XbcnvgMpjHIwzeQO:u1605RN7GmDBbcnoMpzIwze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956130, "uuid": "5a6e7469-a590-45cd-9d76-de7fc5c894c0", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956130, "uuid": "5ffcfaa6-6ed4-48b4-bc4a-15fc32e476ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956130, "uuid": "4c01ab63-d39c-4bc1-b238-88c28f93db62", "value": "2ccfba54f5f853eb1705dceafc0ffe59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5b4783-d5a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1680915381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915381, "uuid": "c4b2f552-3cbd-4187-ae43-de457346f429", "comment": "Malware payload (Rhadamanthys)", "value": "f429fd679226ab4f60b5f4df81d941a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915381, "uuid": "5dc4b35d-a42d-42a1-824e-a2c70e543591", "comment": "Malware payload (Rhadamanthys)", "value": "bee408f8a719302224b40ebacef5bd733b1aa4262dd7552c0e95f808b5c9aefc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915381, "uuid": "058a9409-c906-4da6-b417-ef58adb442e4", "comment": "Malware payload (Rhadamanthys)", "value": "c6465b0b57d6716405c14f40abe34ec200934f40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915381, "uuid": "6ac91800-60cb-4956-af66-b4b1c6cae531", "comment": "Malware payload (Rhadamanthys)", "value": "feb1184359cb6c2e4d8cd533dc072b7df70225064b64c3cb427cf56468eec8b9c7ddf56bae0cecd34676d7cd88df32df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915381, "uuid": "c7ad1aef-a132-48cf-97f0-0a4b6037cba0", "value": "T11C44E011FDD2C872D85680785861C6E86ABFBC619A91C2CB33583F6F3E31281576E372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915381, "uuid": "e86d8328-b967-441b-b584-02ca2a37415d", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915381, "uuid": "268e6c8e-731c-4175-b809-859ca33148ce", "value": "3072:OvZ99I/9hcwXHS0fG+DA6nKTM/JsajLY50bPBVks05qTKmAG8zqEl0051mM0S4:yh6O+gTMBspGpnDm1mM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915381, "uuid": "4df97082-25c1-44b4-8fe9-0c258abb7517", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915381, "uuid": "f5c53953-5f34-4554-8369-a58aec111b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915381, "uuid": "525e3983-5e2d-4695-9045-a28f604423ad", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933fafa6-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680964944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964944, "uuid": "76e1026f-d986-4767-bddb-f0a54ca29a5a", "comment": "Malware payload", "value": "b29eb88391da83417f39e874b1362e17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964944, "uuid": "3eb88645-c89f-4222-bc65-46ae94ac32cb", "comment": "Malware payload", "value": "beed2594ae836f63b8a063ae02de0c53ec11c0ea9a95f33f541ffa585da1526e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964944, "uuid": "755adae9-7361-4258-b263-4b17d5d117b1", "comment": "Malware payload", "value": "0648af5a39218eae6e9c52f92a21b9708e38ea4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964944, "uuid": "42a3f9bd-9649-47e0-9398-4c4c0e1bd3fe", "comment": "Malware payload", "value": "594bcdb2026a08f0908a937083af887ee86904f0c1b61b2ab81705ac6ab40e08324c60c4c72be2b127614f996772967e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964944, "uuid": "3bdcb84a-ce8f-40bc-92a4-cddb508f6f4e", "value": "T16146333CE2965E7DE01F217E937B8E9AC2970ABB48704C233312F56EF15926C55E6027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964944, "uuid": "7eacefba-e20c-46ac-862c-c847196cfa5e", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964944, "uuid": "3720d9de-bb6e-40b9-83e3-e458bb43cefb", "value": "98304:jlwdVVFBImjVkNYfYCWaIWhlVBxL9VraEN+QdBZaQsEO1KhQabSwHNm2McvJChx6:jGeGFI6nvaEN+QdBrsEKiQhwHNm8Wwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964944, "uuid": "8f0f3625-8aca-4665-86e7-b8bcccb47c72", "value": 5848402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964944, "uuid": "93515b1a-c3ae-4ebb-9149-bafd25d8324d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964944, "uuid": "6c3b4d95-4d92-4bc2-952a-43e2d771834d", "value": "b29eb88391da83417f39e874b1362e17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f932bd99-d5f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680946646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946646, "uuid": "58b9125c-a73e-4779-b4be-ab06f4d360b8", "comment": "Malware payload (AgentTesla)", "value": "d16c780799fd5208be04cb9d51fc3f34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946646, "uuid": "7a5e43e8-ff3d-4758-b574-14056f9b0c6a", "comment": "Malware payload (AgentTesla)", "value": "c019a1557e091e0ea974e4def500b3073a4b8975d42705cbf5b0324e8c85c655", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946646, "uuid": "22d1e2db-96b5-4262-b9c2-c5ef5e53b116", "comment": "Malware payload (AgentTesla)", "value": "225b2156421c6bedf398d6f6e05c6a536cb1a141", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680946646, "uuid": "0d3f1881-c3f3-4fad-a7bc-73db88f3843a", "comment": "Malware payload (AgentTesla)", "value": "fdafc18f74a45a907d32f85b071fbd8b299c2f677b8a7bbeffd98bb680b14c8896f5fb3daf429c43c313b2af140bbf66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946646, "uuid": "96b40527-391d-40c0-87c2-7f4b05347c17", "value": "T178C4233377763E2EF1D171E44AD9130A58293E0CB95C6BF1EACB99D81636C9D24A881C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946646, "uuid": "72f4a6f0-cefc-4f37-8175-697f3c9b8c80", "value": "12288:e/Z9GHka9VnaGKNDCn5fINY0FkCwxFJIcENoEignz66ACtrH9HC:eB9y9yG2CtIoZEKF6HHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680946646, "uuid": "f3e6b7f4-ec89-4cd2-9880-b33b581872f0", "value": 579195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680946646, "uuid": "538b3eef-b10f-4d00-9a15-9802481947a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680946646, "uuid": "fd106d97-a3b4-451f-85c9-a1b561365bae", "value": "BANK TELLER pdf excel.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a9fac7-d65c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680992991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992991, "uuid": "f43672cd-b54a-4b2d-b5a7-8a7317be76ea", "comment": "Malware payload", "value": "9022fd5b8377af711ee02157f1aad1ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992991, "uuid": "ca7e51c2-7d42-4e11-bffe-604c3dfe8f07", "comment": "Malware payload", "value": "c0b9fb5c366cf7edbe3b29aee23177aed010486779beb4afed7ac323b3b93342", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992991, "uuid": "5e9884b1-6748-4175-9f65-bf28ac4b5dba", "comment": "Malware payload", "value": "f4961e6ea760989ee639028a5b95020d0fa17b62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992991, "uuid": "378ea036-5783-4a43-9c35-90e43cb377af", "comment": "Malware payload", "value": "37a05e2c37cbbddeecd3104d6bd2bf6341574e1e67025c27ad7cd84e4b198651a31dcc84ac4f7643ced77d0c73d55aa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992991, "uuid": "5915f315-b9ce-4ad1-8bae-afcb54d72945", "value": "T10C933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992991, "uuid": "57dd2715-887e-4fe9-826a-b52f173df809", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvzUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBzUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680992991, "uuid": "d8b4ce2d-f03c-4491-a5fb-87fc101f4601", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680992991, "uuid": "a71a924f-52d6-4437-9a8c-b464f5dbc34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992991, "uuid": "3a8008be-fff2-4e94-8018-36f14cbd12ff", "value": "9022fd5b8377af711ee02157f1aad1ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7af9e59-d5a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680915210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915210, "uuid": "de0bdca9-f79f-4952-8702-7ca10e908f65", "comment": "Malware payload (Smoke Loader)", "value": "dd5930e08550c78dc4053699b6fc3dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915210, "uuid": "17025b2a-28b0-4688-9186-b72f5174372c", "comment": "Malware payload (Smoke Loader)", "value": "c1359d18b900a48e5fbdd72623aa1dd849c1c714e6f484a9bdc0be974f5531ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915210, "uuid": "31b081ad-6b73-4a73-b146-ff5af2e9d2e6", "comment": "Malware payload (Smoke Loader)", "value": "478437a29f449b222e73a772d42ff25ea7b6ff5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915210, "uuid": "a6ab1558-6b5e-4204-bb14-232900a122e1", "comment": "Malware payload (Smoke Loader)", "value": "82dbfd45d767efd241f971c1a68859ba5e752da3431343ccdca75e5ac5e660f093b0e8d5ee91e7696a35f7a9303d8661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915210, "uuid": "fd5a7d5d-3814-4f48-86ef-c54ed89b64b3", "value": "T11914CF10BAF2D472D45B48755030D6A46AFAFCE1AB98C68B33582BBF2D703C15BB6315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915210, "uuid": "da11a01f-774a-4dd9-b898-3a879b728caa", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915210, "uuid": "b271a4a3-27dd-4581-86e5-f59a932f9443", "value": "3072://14Y3s8+EgyvM00vGTAtYymx/3AEKllx/ghyCjqE/SYGoJmAGKhrP51lHa:XDXgGp2GTegx/3AE4HOSYGPWlHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915210, "uuid": "cdd33e7b-0dde-43c3-95fe-076515741619", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915210, "uuid": "f628a5a6-610c-49d1-b39d-5513e467bc65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915210, "uuid": "a86ac5ec-91bf-4b51-838f-19505fe7dee9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d95bce8-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994167, "uuid": "a17a2104-4fb8-47bb-bc59-e90dc12997d2", "comment": "Malware payload (Mirai)", "value": "21f8b378ba2d5ef3e8a231a811bec619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994167, "uuid": "0aa53e8d-1c90-4987-83b8-a5c420d21f1a", "comment": "Malware payload (Mirai)", "value": "c3dc82d6d449b8c4a8de8f995b164cca6f60e591aa1632cc7dd3db7e80612463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994167, "uuid": "5c5a8f10-9b5b-4839-9ddc-e99f008c05b0", "comment": "Malware payload (Mirai)", "value": "6903ddad08c9d2d933d0674aadbaed5d510cd2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994167, "uuid": "bbd3bb4b-4ac4-4a36-b496-11b5e0c506a7", "comment": "Malware payload (Mirai)", "value": "d0a439bb7c1d84b09840949efe7e7f4f8f6ece046c4ea83edca4348a35f28d5f5204a41073192515f0eef29bfe3952ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994167, "uuid": "2e2b8b16-9e54-4ac9-8306-a54e3a154666", "value": "T18DA30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994167, "uuid": "ae7b1ba5-9e77-4133-80a1-45e33492fc8c", "value": "3072:gjtwgA6UlYzZveohR9kIEtfdGZmmFVcqq0G27ZT:gjhzt3mIEtfAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994167, "uuid": "38fc017e-527f-4af1-9df2-ee5af8109d66", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994167, "uuid": "5d71cb94-5d8b-45a4-adc2-6b560648f7cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994167, "uuid": "8ac776e6-6146-4c8f-ab71-66500022a072", "value": "21f8b378ba2d5ef3e8a231a811bec619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be59a8b6-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1680976612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976612, "uuid": "e5839dff-04cf-455b-948d-bca3760fcb50", "comment": "Malware payload (WannaCry)", "value": "3d839f4a33dd380dd66479c7aad0cedf", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976612, "uuid": "ea259784-9ba6-4019-8091-6d328c10422c", "comment": "Malware payload (WannaCry)", "value": "c42f2e117af38e9fcf839ce4741b5a28fe623bd1d78442d0811ff8d60a630ddc", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976612, "uuid": "f84c9c15-01ec-43b1-82e2-cf5265bce384", "comment": "Malware payload (WannaCry)", "value": "0b2272c55f16288a9c5ef91f018bb81340b36bd7", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976612, "uuid": "387226b5-9eac-4326-ae95-aa96e8fe2d37", "comment": "Malware payload (WannaCry)", "value": "cf1c141fe83c05129706017b6b5d9db772d74522ace9e36855cd670ca7968690ab6616128a2c6a811360b30696f2566f", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976612, "uuid": "a2999e6d-36fb-4377-b402-cbdd0c44d424", "value": "T1A4E523B5B230777ED32B26753016806719A726F371DE6B1BCAD406829C08B24DFA56CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976612, "uuid": "91504e8b-c549-487d-8593-ea0cef62d892", "value": "68f013d7437aa653a8a98a05807afeb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976612, "uuid": "86bce700-2868-4d89-b292-990c8a4561c4", "value": "12288:nQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:nQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976612, "uuid": "e9a02072-9938-42d3-87ae-f1c957f3ee69", "value": 3145728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976612, "uuid": "ba4b89b6-39dc-4e0b-aa56-3f1d51a39a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976612, "uuid": "e9cfdeef-7f65-4b00-971c-f4c04a3fddb0", "value": "2023-04-06_3d839f4a33dd380dd66479c7aad0cedf_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c207f2d-d5a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680914976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914976, "uuid": "8daa6857-f2f3-487c-a5e8-1edfbe06bc4b", "comment": "Malware payload (Smoke Loader)", "value": "d0c9e5ba5ab2fd34cdf60bcc4077b5ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914976, "uuid": "e7c53d5d-9591-4edc-9f67-7425be2c24eb", "comment": "Malware payload (Smoke Loader)", "value": "c4791635509c8e7d41c9a1c0c2b1fab0b0493acec896d85943c9fbcf1fb4d46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914976, "uuid": "7f2c1581-48bf-4ee7-a834-294e07b6189f", "comment": "Malware payload (Smoke Loader)", "value": "a99d484ff6dd16e31a7b9d08c2f5604a93b0b94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914976, "uuid": "eaff9cab-6404-4e43-ab7b-6f5124e14604", "comment": "Malware payload (Smoke Loader)", "value": "17fb6c65ca4c46af9907af9a5e2901b02de72b9df7ce9463336620e16959079b04924ec930985dfd5c4a85623c1acae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914976, "uuid": "ed30a469-c487-4709-8ffa-4ed6750bf527", "value": "T19414D0213EE1D072D497C9354030CAF4693EBC529B53868B33582BBE2D713D26A3BB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914976, "uuid": "1309a7f6-d823-4a09-9ca9-8247c0af1a25", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914976, "uuid": "b10badca-68db-4643-8e5b-c74e3972a33b", "value": "3072:ZRkTo9nRb+LxPynp2mIL8mCROPW05D8N9Wj1ye+6LYTgAKu051dz/:TbgP8yL4RD05eWjQQE5+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914976, "uuid": "fbb3e98b-064c-47f7-902f-dbc5b7322ca2", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914976, "uuid": "7e17bc68-0de0-4031-96dc-fc1462ddc382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914976, "uuid": "304d900c-75df-4a99-8f11-273eef86d645", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4c45d9-d614-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680962030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962030, "uuid": "82ff9c03-babf-40da-9e91-0b6c4ba6eb8c", "comment": "Malware payload (Amadey)", "value": "0584afd1bd15a6aa373f18e2c76dad11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962030, "uuid": "be997f8d-21ea-438c-a955-c638a94dc780", "comment": "Malware payload (Amadey)", "value": "c4949a2ecd1142962ea1071013e97163e40ea61aa238809276ac598e3ba60c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962030, "uuid": "e3709035-9d3a-49e3-a255-c9556dcc1448", "comment": "Malware payload (Amadey)", "value": "4adb48b2008c43b92c17c9ddca9ba678b44fc090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680962030, "uuid": "412dddbd-30b2-4e53-8119-f82ea0aef257", "comment": "Malware payload (Amadey)", "value": "d7dd4f94e364df9c71964fb032a21690baabbe76ba75fdcaa80ffe179842fa525a86356315eda291023cd9a45f5c1caf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962030, "uuid": "4c41ea51-c75f-4bd9-984a-aa142a6345ed", "value": "T188152302A7D59463C8F61F7018FB57931F36BD926D74A75F2282A44E5C72AC0A93233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962030, "uuid": "50d9745f-9e70-4220-aa4f-e5fcab574339", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962030, "uuid": "9472d12a-ae3b-489a-bc26-af2460bef551", "value": "24576:EyQCKkHswbMppNoJmLAHuScZ2Wxt3G8ktifLwy+G:TRKkMtqyAOScZJt3G8yicV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680962030, "uuid": "80624ae1-ef2a-452c-8376-10d25c851017", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680962030, "uuid": "e6e04bb7-e7a9-4bd7-8074-1898aa57ef34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680962030, "uuid": "7f5fafa5-ee09-4636-ac75-ee539da2ee32", "value": "0584afd1bd15a6aa373f18e2c76dad11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c4720e-d5e7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1680942614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942614, "uuid": "83b7d112-a6e7-4e1c-bed3-79ce42fd0cb1", "comment": "Malware payload (RecordBreaker)", "value": "fe0d287fa73a493c1483d8d74df70cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942614, "uuid": "99c9bd6a-58c8-4a3a-a0df-e992ce8fd00d", "comment": "Malware payload (RecordBreaker)", "value": "c7aa6865d5c73f891382b9b4a59d051c28f4e3bc028655b1f7bdef6c4053825b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942614, "uuid": "3aefd410-0378-41d5-9a69-3830a943809c", "comment": "Malware payload (RecordBreaker)", "value": "b4ec4219c036579d36eb4c82f5d34eca2da6c153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680942614, "uuid": "83a495f1-8a9f-45a1-a8ab-d968f9ef8854", "comment": "Malware payload (RecordBreaker)", "value": "b77951b63ef4e4f1d2d3b40b860e043e9e7aad797dd97d838f87636d2bf0ffb30407020bf99bdb45b7af83bfada008fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942614, "uuid": "df785cb6-12c1-429e-bbe5-e524b24a6c6e", "value": "T1E014E020BEE2C073E89704704434E6A46A7EFC51979A954B33642B7F2E333C16A7735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942614, "uuid": "b886499e-c312-46f7-a2b3-84cc8dbca3af", "value": "7f2f76766a962f8a0db702cc8033dd98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942614, "uuid": "4c44076c-df1e-481d-b46b-b4d5b02f9b15", "value": "3072:OZ5kvCCxXJ+lM8x+l1Xg3ghDj++jftjlg3gfQGAUxBv74513:UGvfqDCAQDj++jftUzFUxBA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680942614, "uuid": "cef0ea43-45b5-4949-b40e-575e3e9f7230", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680942614, "uuid": "a90e2e52-0660-4b9a-9e82-d3c32f195dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680942614, "uuid": "2fabb7b3-2553-41eb-b339-c6f77baaefb6", "value": "fe0d287fa73a493c1483d8d74df70cb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2e77e7-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993577, "uuid": "3b9d008c-ea61-481a-bf20-92c516afb2b3", "comment": "Malware payload (Mirai)", "value": "aee84124391994177fbbb0478dff8fbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993577, "uuid": "341eb102-b50a-4502-aa77-c0b1ed085323", "comment": "Malware payload (Mirai)", "value": "cb1db8d408e0109c8cd3a932dbbf53370f78074023d871e119f4e4e1d6db301a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993577, "uuid": "862ccf67-a4c7-46ac-8633-2930c7211d34", "comment": "Malware payload (Mirai)", "value": "7e828f0163ddf0f898a13b16a6d9cb2a474fba8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993577, "uuid": "db465117-893b-48c8-ba9a-8f50cf3bcbb6", "comment": "Malware payload (Mirai)", "value": "379547c5927971af53c88bfd9effaaceb6937bc53c7f362cf2ff954cf91664d0ef1bd3bab9a31da10b7f4e4bacd4ff22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993577, "uuid": "dfde81ab-bbd5-463b-94ff-b98cd14a240c", "value": "T14DD2FA91B881D627C2E8237EAA5F458C332177E8C2CF7B17C8591B10B68663F4D63B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993577, "uuid": "81ed8972-f6ba-4475-b0a9-02f605b739b1", "value": "768:C45ioeJ90G5tVtpZBZKhB2FGOPg1RyP69H1X578HVos8o5L/N:C4SJ2G5ttZBWB2FORyPaH781Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993577, "uuid": "8962748f-a94d-4e58-a1c3-cda301360959", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993577, "uuid": "8186518a-9802-4a0e-8c9a-21a3644fbe36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993577, "uuid": "f0b30e88-1279-4021-8c07-61afb2430a3d", "value": "aee84124391994177fbbb0478dff8fbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d363fe9-d60e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1680959243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959243, "uuid": "acff0bf7-8049-485f-860a-f0f6f56ca4e5", "comment": "Malware payload (QuasarRAT)", "value": "3c9e0530acbea7add9848c904322ddc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959243, "uuid": "cc30c070-f15d-4397-a31b-d96ffd8f896f", "comment": "Malware payload (QuasarRAT)", "value": "cc40742a81f95bd9554c79dc243a2949258c11d7a0967ded831448addb0cbc49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959243, "uuid": "169ccb16-778e-4019-88c9-992ff85985c3", "comment": "Malware payload (QuasarRAT)", "value": "5a871044aaf38e73df97217f3091e05c88ca8454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959243, "uuid": "3540523f-5127-4685-a2b3-35f0d682f4d5", "comment": "Malware payload (QuasarRAT)", "value": "eb9a324af138e01f16eb692dd32a93ac45f469cd17e61c96bd51e027e39578d461c5d2c4e5953e535ee5cd07e4ab6de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959243, "uuid": "af84bdb8-39b4-4ff9-a9ee-13f7cf7ea270", "value": "T1E0747C2373F4E93BDABE173AF43206054BB4D647BA16E38B5A5855B82D133868D407B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959243, "uuid": "3e522431-cc63-4c3c-b674-982dc1f2d179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959243, "uuid": "2dd905e2-1dd5-4f62-8d72-f922be62a7c9", "value": "6144:R7qQ4i1FFiEK7GEAOp+V4JbMA2agUjJJmz95s32:tpli4SW49LgoJJmzY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959243, "uuid": "257da7cb-cc5d-46cc-83d1-38a025ef016e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959243, "uuid": "7ae427f9-3fec-47d2-bfa8-d23813b40126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959243, "uuid": "a743014f-d026-4602-9594-74f1bffd926e", "value": "bLw3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0ae923-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1680964720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964720, "uuid": "a64f05f3-af29-43e2-9079-dad646880386", "comment": "Malware payload (EternityStealer)", "value": "bc635c0f865ce0d70a81c35bb9c05a93", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964720, "uuid": "6e3dc490-ff5b-40c1-9b2e-f265e08c7a26", "comment": "Malware payload (EternityStealer)", "value": "cee47a59d39ea4da5facfeb62f67b0f1dce28b39863e66c22efee52eb6498647", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964720, "uuid": "2f543e35-aa70-4cca-be33-56c2e2b89b7b", "comment": "Malware payload (EternityStealer)", "value": "eb5a3366e60b642b4abd50dffe3be2afb44d7b39", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964720, "uuid": "8adb2c8a-60a9-4fdb-9da9-947e97f9d8b2", "comment": "Malware payload (EternityStealer)", "value": "53f1575cff5cd1f243f1b6e0732f771c00b306765c0ee0eb7e4f21a9ddc1b3ff24ead8fc6280c935d45bafd778348816", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964720, "uuid": "fb98fa51-a894-49ef-b216-9f0c13335f56", "value": "T1B5A5013D0E7856E2C2BDD7FE47944158FAA0E85F36D9D92C98C20D9427C3A9270C636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964720, "uuid": "482da99e-ee27-4a5b-9a6c-de0b39e19afe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964720, "uuid": "c0655898-f669-4093-b000-57599d296ebd", "value": "49152:ArScto7a+dk0Ek6ae78ywIDmVh5pdiFrbGo2XA9uq7FW:+BVw9KbGB+X7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964720, "uuid": "bf1651e8-0d16-4cc1-abe4-0bd51e04249d", "value": 2155008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964720, "uuid": "e9b97ca9-709a-41bd-bc78-448605d18279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964720, "uuid": "4760e410-4800-4695-8ed7-2b586349c221", "value": "bc635c0f865ce0d70a81c35bb9c05a93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2484080f-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993534, "uuid": "b8b68fed-f8c7-4907-afd9-11f453b49e4d", "comment": "Malware payload", "value": "5cba137991d645b216f79ec3dc9fb07b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993534, "uuid": "c2e09d04-78ce-4138-b326-1568730e0f42", "comment": "Malware payload", "value": "d104a99e11e550c73fc5922fb597d83130f86fd80f2a604a5de552ef68a6c24e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993534, "uuid": "f6c99e4c-4236-4e97-acf8-ab2b7d740362", "comment": "Malware payload", "value": "3c66c1bfaa5acc8f1550c7ff884c6dbaee86a437", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993534, "uuid": "21558b5c-c31b-4dbe-b37b-7ec2b81fd06f", "comment": "Malware payload", "value": "51793b1fb30bf1358e07b21061b52f8df15bc5df21e86c1d82b9635959793a791fb4f1589f9199baa7aff39095950250", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993534, "uuid": "71061fe0-8921-4b15-babe-c85abb67986d", "value": "T19A63C64A6E22CFFCF66C823047B74E21A79933D626E0D685D25CD6016F7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993534, "uuid": "f411f481-32a8-4dc7-8a17-1dfbc544a2fe", "value": "1536:6zYUXOfDWxEm/si/YJCqZFO2TJQePzmK1:6zB+fqlqhTJDX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993534, "uuid": "bac41542-a1ec-46ca-9645-5f31b0b133db", "value": 72324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993534, "uuid": "a7282538-2a73-44de-a776-95af34ccbe54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993534, "uuid": "7d9aedbe-ee02-4b50-9fc8-ef3bdd76bd0f", "value": "5cba137991d645b216f79ec3dc9fb07b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7064de4-d65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993001, "uuid": "28f6ed53-3f78-407f-9a93-c197d256dabb", "comment": "Malware payload (Mirai)", "value": "b2d8e23274bd841b1bd3c55b3c6dd6ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993001, "uuid": "71db68fc-89c5-40eb-bffe-82dda511494a", "comment": "Malware payload (Mirai)", "value": "d21666ad3f58e063e7d9edc9c644dcbcc43cf0ceff96c003ebde80529cfaba6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993001, "uuid": "e5e83e98-6a20-40e3-a9c4-4daf5d7e47a4", "comment": "Malware payload (Mirai)", "value": "f5ec44283a1a944795b85b8961600f261585153a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993001, "uuid": "3033a2c1-550a-4ce7-9b7c-c3046eb0a055", "comment": "Malware payload (Mirai)", "value": "f3d84301dd58c3d10a2f85ecadb8bfd4e4d5aac688eb55ae9e81efa02cab0ca92e82b9d56f3b71431572d8e837157df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993001, "uuid": "0c994109-4eaa-4ffc-9a5a-b88247af3975", "value": "T118D3F730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993001, "uuid": "b0ac9cf9-5716-4f9a-b1dd-8ab14b869790", "value": "3072:+DShVLkDZ6waCAdcl6bYJOmP46aQyfPluesNb:VhVeZ6zcl6boOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993001, "uuid": "516c6cf0-d54d-43bb-920b-27b2acabd5a1", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993001, "uuid": "8cbd4988-39ca-4e53-83df-ab8f8ad68f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993001, "uuid": "2d025586-750f-46db-a4cf-bf105d8aaabc", "value": "b2d8e23274bd841b1bd3c55b3c6dd6ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899ca82a-d5eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680944312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944312, "uuid": "1265135f-d181-4c51-afd2-024a2ae0ca1f", "comment": "Malware payload (Amadey)", "value": "4458e8114c5e302f791c868ef0e54cd0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944312, "uuid": "b9b18785-ae17-4532-9801-fd8e305aa920", "comment": "Malware payload (Amadey)", "value": "d21ad34cae7ed180a96b1c1ca3ee8e8c06a0e8cde698b82a596a9e319c91945f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944312, "uuid": "be0d3217-be09-48a1-ad79-d0a9e4581f39", "comment": "Malware payload (Amadey)", "value": "cabd1e08eda60312b16785b864a9a869d6024dad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944312, "uuid": "00be5e0c-4f0e-4599-b512-8fec5ad33df1", "comment": "Malware payload (Amadey)", "value": "3419376ccfac5283da0b46a652444721e30c63f693730e69c36d23cb59b02b7b98cf3d7dcbd3349609dbb1e6fc31cb85", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944312, "uuid": "918d6222-8499-47bd-a410-6c1597268c6d", "value": "T169357C1BA26601BCD4BB9178CA274A46E775744603309BEB17D05AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944312, "uuid": "b4e002a3-b4e1-440c-836f-c2601d44944a", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944312, "uuid": "7814122e-4424-4b4f-9284-967627783c03", "value": "24576:XMq/RX0hoa8wrC+azFbtZhUYFauTZyRMRo:Xioa8wrCHz3ZhUYRAao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680944312, "uuid": "6f96ffcd-50d9-46e8-bec8-8a9a809abc0c", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680944312, "uuid": "ab7969e4-300e-4261-8619-521998d9d879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944312, "uuid": "b350751c-948e-4855-aa10-c0d407f9147d", "value": "4458e8114c5e302f791c868ef0e54cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344bc252-d5ba-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680923123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680923123, "uuid": "661a32ec-4d37-49d7-846f-c01d8d0d9ba3", "comment": "Malware payload (AsyncRAT)", "value": "ba95d20dc27649be8d9b3c2cdb01312a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680923123, "uuid": "75dcf277-371c-458e-9a94-677246e185dd", "comment": "Malware payload (AsyncRAT)", "value": "d22fc98ffceca0d241a837a5dd2adeb8c481c89bf73f3a2de2e4435fbc774404", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680923123, "uuid": "3f08f7d5-2766-42a4-89ac-3eb07b0e850d", "comment": "Malware payload (AsyncRAT)", "value": "8fbba76c9fff48122e95ed16db437770955c7bd2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680923123, "uuid": "78f46387-b401-42c2-90cd-bb6e64433338", "comment": "Malware payload (AsyncRAT)", "value": "023aa3cb12f6b19ab5d9ec7f18b721b88b9f6c459862cf78a0e440983ccda0aa08079d565d1121793c8085ba4faf55c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680923123, "uuid": "71dc7e53-2727-476b-828c-9bce8405c4da", "value": "T1B006018BB01421DECD8D55B9A2D02D82A7287DB90F350B8EF017E6687D9FC92CFC6651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680923123, "uuid": "9a3cd373-a5c9-4329-9b08-48e8f3c907f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680923123, "uuid": "e0b592cf-5447-4c01-977f-cb3488fcbe34", "value": "98304:RxaEWDhIcxEszHFCT0azv8UGIwW/BTE0FY9PnM:aEWDOcxEszlCbj8UGIHp1W0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680923123, "uuid": "0861ca75-592a-4a27-af2a-aa88839c032c", "value": 3960832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680923123, "uuid": "bb8a9d30-55e6-4ddb-9e3a-95ebde8b351f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680923123, "uuid": "6371aec6-578a-4f8c-b36f-0fddd84fa1a6", "value": "ba95d20dc27649be8d9b3c2cdb01312a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed2eb5d-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993793, "uuid": "27aa0845-6431-42ba-b302-9165467112a6", "comment": "Malware payload (Mirai)", "value": "5e2aea38f073d3fdd8b95f16051105c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993793, "uuid": "6904e0b1-fbb5-4e7e-b5ea-403c2431cb7e", "comment": "Malware payload (Mirai)", "value": "d434426cef00e8349bdf89c9986fc9525b010a2016b85354e0b62e27bfa84d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993793, "uuid": "bce68d0c-2a9a-44c9-85de-f16eab557dbf", "comment": "Malware payload (Mirai)", "value": "e931608717a673271ac3c1edde35da000500f654", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993793, "uuid": "f36b7b38-6e49-4566-9b26-1602b88b8927", "comment": "Malware payload (Mirai)", "value": "724af2c6aeb437b4eca2021e2bb33fabf52386170d42b4343965f153929063ab5f2b62422c7833c255e2efa8d5746f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993793, "uuid": "7b8ecb34-25dc-4a0e-b872-5cdc722a06ac", "value": "T1F003F786F903CEB7D80315B012F6EF365E31F8FA1965D583E3A4EAA15892482B503E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993793, "uuid": "d900449e-dc6d-4709-bac4-86d0d4f9332c", "value": "768:XqBiY+cgYnUOXvxdU3GCy2QZUqeA9DsvKQLD9vZ:XqBiY+crUOfxq3G9pZU9A9o3LRvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993793, "uuid": "06ac7166-9efc-4127-b183-0a63a2d86d1d", "value": 39696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993793, "uuid": "7e1a6b05-eec6-4d53-bd74-3d67278074ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993793, "uuid": "fd4070b4-0c87-4d69-abff-fcf545a6e62a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c1f76d-d63a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680978044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978044, "uuid": "0cfe3146-ab8e-451c-b677-88e6341c7402", "comment": "Malware payload (Amadey)", "value": "166addc66c097d761e6e9c778ed4e2d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978044, "uuid": "4d4261da-4065-4e5e-894d-dd677dc70acd", "comment": "Malware payload (Amadey)", "value": "d661df8d82040cb1cd2ed73bd1b74e1c00aea3f5fdc46a297c1cef13c5c2848d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978044, "uuid": "0ef68766-5c5c-427d-ba2f-5c3f1b68bf8f", "comment": "Malware payload (Amadey)", "value": "40eabe7810291df9918bf48817fe734d0f6aba63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680978044, "uuid": "a68e9c2f-81db-4a03-a4e9-20a54e0ab45b", "comment": "Malware payload (Amadey)", "value": "87c5c067a4e8d57a513a0f53fe13dd1c987a6869fa977e1703722d4ae1243c935e83555038a07b1a2591784421c1530a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978044, "uuid": "e549d212-bd00-447d-862b-a052692c1993", "value": "T173152323A3D95973DDB127B05CFB07870B313D955D38470613E6AA2A1CB2A9974B03BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978044, "uuid": "724cd16e-7b96-48c3-9b59-aca753974740", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978044, "uuid": "bcb028ba-34ab-46d8-bd9e-03bc458eb175", "value": "24576:kyY6+O+uyvcrA/+brlh/lhui6SbQSnwbib:zF+uMn+5BQiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680978044, "uuid": "7c3a15ee-5b42-40ac-840f-620ec05dc310", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680978044, "uuid": "8fa2ec62-6b6d-4366-a383-9e9e846c4432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680978044, "uuid": "6dc8a2c3-0308-461d-b1c9-1fd8955de2df", "value": "166addc66c097d761e6e9c778ed4e2d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46de869e-d668-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680997887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997887, "uuid": "1a6b41a7-c4d6-4520-b378-e74714e36503", "comment": "Malware payload", "value": "30bd91cc3cb0cece466ecc3c979515e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997887, "uuid": "6d84380a-626d-4480-8d0b-7ab1dff31b37", "comment": "Malware payload", "value": "d717a5102d986d27aaf994ffcff7e91cf91e24f3a4f1751728a2670f047c3e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997887, "uuid": "45c919eb-3ee1-4f3a-b16d-bc846335418e", "comment": "Malware payload", "value": "3adb167b7f67f0624bcfd38cd758a5b52cf68831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997887, "uuid": "49687dfe-e09f-4952-bc7c-db22cddd941e", "comment": "Malware payload", "value": "e3b9c733b44b7824a7c0e3cba7b888c0f5fd2cdef2dcf0bc22b21004c081abcca676be87ba30cb02cf4b15e7f2469922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997887, "uuid": "7bc8269e-c9d4-4f3b-8419-4689f436aa91", "value": "T1A4930992F801DFB7F40AD67644D74B20B670FBA14E931A22732739A6AE361D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997887, "uuid": "2c5a7383-a8bb-4f87-bbf5-94bf2a0caddc", "value": "1536:t2QWt24l1bXWQ3DD8GA2lOKxvNyp3O1iP9Oef6FcUp1KY63mzVO0VPXjDTf6vX:Ql26sQz7lOKxvNyp3OYP9cp1EmE0VPXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997887, "uuid": "116494cc-dff6-43d1-9c70-b29b628959f8", "value": 91515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997887, "uuid": "808eeb72-566c-4b7a-b020-08fbbc8f3e76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997887, "uuid": "efcf66e4-ed79-491f-8ea9-3ae71c6f10c2", "value": "30bd91cc3cb0cece466ecc3c979515e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9d7ab6-d65c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993013, "uuid": "7b333662-5078-4b7c-8506-f1db7a7eee7a", "comment": "Malware payload (Mirai)", "value": "0674d1e4ca60a7a80fd5c0c36c865631", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993013, "uuid": "125bb8eb-0502-41a1-8c7b-76dad788bc3f", "comment": "Malware payload (Mirai)", "value": "d738e6314bd3e1e782e03bf3d98f5ad67e6d2b949e458412d3dffe7063b35aa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993013, "uuid": "2d2589c0-6dd4-4ee4-b747-50fa08ae0f18", "comment": "Malware payload (Mirai)", "value": "249a930bc8ae92731177b3019e2e24ddcd6a2585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993013, "uuid": "03b69f20-b765-4610-a5a9-b808cb5e3fea", "comment": "Malware payload (Mirai)", "value": "c92ddf166b92fd9b498c13b0019941787ea7c8abdb89fbea1ffaeabbf72a4ea26fcd613ae3edba7a6d5a9ca56ddd7594", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993013, "uuid": "409c58b9-98e7-4db9-8889-7d53fa480a19", "value": "T19AC3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993013, "uuid": "b1179dff-8e52-4772-9e07-6a320f424f6c", "value": "3072:FDcYVLWKlAQTv+mYObpl2m7/L7QsvmGugiNb:WYVxlAk9YObH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993013, "uuid": "845ca145-7319-4336-8656-ef57487edd58", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993013, "uuid": "0748268b-603b-4ac9-b110-e375ab91268a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993013, "uuid": "808fc22e-0174-45fe-a492-f2ab65c256dc", "value": "0674d1e4ca60a7a80fd5c0c36c865631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f89bed-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680993563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993563, "uuid": "7f7e87a1-3712-44e1-92c9-30a7aac58c98", "comment": "Malware payload (Gafgyt)", "value": "c683a9ba6e461d2a3d4974037b5b8b82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993563, "uuid": "34d69d0b-725e-4f71-a9e1-1cef7c76f26a", "comment": "Malware payload (Gafgyt)", "value": "d7ff295894cdcdfb326442911acfb797dcaea50ea2b110de03199eeae5c366a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993563, "uuid": "19c78328-9701-4d47-9a49-1eecebda300c", "comment": "Malware payload (Gafgyt)", "value": "d78072364f620dbbac5dfc0b7099f81fe8d7bb7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993563, "uuid": "7fc65d9f-b255-4b06-ac13-14f3f33ea734", "comment": "Malware payload (Gafgyt)", "value": "c0bbccd1e1a723235a249fee0f81dc40a55a4da12e324d5a52ee48053bf06e8ff70902197ce2fd083c136dd4fbbdf138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993563, "uuid": "2b1d166f-41cc-4681-aa02-6ff1a18e1b64", "value": "T146633B42AA42CAB3C8930AB506EB9A260631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993563, "uuid": "ccea984c-a7f5-4951-a3b2-7d10241eaed4", "value": "1536:e98b4EmDIdV5LTepgWncXy/olDmF+l2OZ/fufYEZ:zb4EmDI1LeNcSYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993563, "uuid": "8ab3d830-6af5-47c1-9c62-7d2c42a00ede", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993563, "uuid": "9ca9a560-6843-4734-91b0-29ee57354095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993563, "uuid": "ff6071b5-b3f4-43af-b73a-94e569c6e509", "value": "c683a9ba6e461d2a3d4974037b5b8b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54af15c0-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945511, "uuid": "ae906381-c898-4985-aae5-361162d8eef9", "comment": "Malware payload (AgentTesla)", "value": "c23c2cd92111c6a258f9c00ee9df9529", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945511, "uuid": "bde71bb0-6d1b-43e3-b52f-e29588a03fa2", "comment": "Malware payload (AgentTesla)", "value": "d953acad644b17743f437931ca3ea7cf956380dd2b6549eacbd73c879f3d8f30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945511, "uuid": "98a04184-ac5a-43a2-b457-41c7aa861827", "comment": "Malware payload (AgentTesla)", "value": "5c2f8704d3e22b2f6920760ba355ad7a168e4d98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945511, "uuid": "5f2b2ac9-6f23-45ae-9f7c-7dd300d0eddb", "comment": "Malware payload (AgentTesla)", "value": "cab38ee4abe66f85a99ad62f6be5bcfbee54136cfbf63fdade4d8fca6cac1af6d74cf4b64b743b21e7b5d35932f85a2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945511, "uuid": "a497784e-35a6-4450-b350-fdb618dc0541", "value": "T1DFB423F20E47D81A7F2A3A7792E5C2243D048F08E9F1C37AA6D315709F681D754B395A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945511, "uuid": "b5c7fae1-73dc-42c8-9dd9-ac82893933c1", "value": "12288:GjVnwMGSK+JdJsM1kW5z7dSMEGaj0upY6UDX0U:GNwZStEM1H5zJSrXVa66z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945511, "uuid": "41f8560e-4bcb-44ca-a6e2-7e33fc4a5ac9", "value": 493846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945511, "uuid": "bddc012d-f388-4e89-8dcb-122dd2d8ade7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945511, "uuid": "170e4823-0bc7-4753-aaa4-84528a6745af", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb8387f-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976932, "uuid": "1039cedc-3cb0-4bd0-8278-5cbca2a1174e", "comment": "Malware payload", "value": "575a7c5a20069c8e7cfb8b2bdc4001c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976932, "uuid": "c82b015c-eac9-4a4c-b738-b44b726feaf0", "comment": "Malware payload", "value": "d99cc4525965f739e9abf3f182ccbf592c4d4126d20a7227c714edfdfa93ca86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976932, "uuid": "b4278675-2a26-4eae-95c7-8f4573a80caa", "comment": "Malware payload", "value": "423cc277a9377a1a96c5da6451f6fa4d469ea1aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976932, "uuid": "41acd388-bbf7-4259-ab54-b689298f3e0a", "comment": "Malware payload", "value": "9d2c78f8b71b397bd42b58537aa2edac0628c77a4919d7271b452e9d8a0858cf88b9149f49dd9a98072c664347f3ea00", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976932, "uuid": "4ce25f7b-4164-4c5b-b8b9-ba4059828827", "value": "T1EDC55C64E610D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976932, "uuid": "2354b430-86dd-41d5-8eeb-a313cfd5d3c3", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976932, "uuid": "fe56d213-2506-4f77-bcdf-39ff942e7d17", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCl:eEtl9mRda12sX7hKB8NIyXbacAfuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976932, "uuid": "f5a14612-7040-41f5-9fcd-7974b27e68a1", "value": 2562759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976932, "uuid": "8a022fa9-746b-4655-a319-6c4235e7634b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976932, "uuid": "d630cd66-351e-460a-9e73-2c5c16c3be3d", "value": "2023-04-07_575a7c5a20069c8e7cfb8b2bdc4001c3_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64afba05-d5a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1680914185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914185, "uuid": "dff2800a-2742-4ca4-8e1e-f494561601b7", "comment": "Malware payload (CoinMiner)", "value": "e6c2821039dbfe56f25abccec7e641cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914185, "uuid": "992a81b9-61b0-46c7-8c55-b6640fece585", "comment": "Malware payload (CoinMiner)", "value": "da86848a1b9e5661d664e26d6544d58ad0f73344da3e9ab104fb772c1d851e21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914185, "uuid": "9593a56d-1c7b-4450-96c7-9794a4146137", "comment": "Malware payload (CoinMiner)", "value": "8a121e25b310dbb6cdb1fcd067a53a2c1a572102", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914185, "uuid": "c278d493-ed37-4072-9190-81b3ca0249fa", "comment": "Malware payload (CoinMiner)", "value": "f4a68da1338eab2cd5b66f5bdbeb2bf6217e210d237148f3fa70804eb25e553ac3236926cd506e25da66a4e2d8a97e2d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914185, "uuid": "a061325f-d7b3-42e3-91c4-e520ceff6529", "value": "T133B5D05953FE6945F3F63B70AE794EE80E3ABC52EC78C20E3140624E4975E41AC6076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914185, "uuid": "dd5ec4c6-a69f-4888-b88d-b8911aa500fd", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914185, "uuid": "09af6339-8ad3-4138-b2af-3b597bfe1860", "value": "49152:FzsnmS+NgzMr3Ff0j0gZWyknY9MsWeVbZcHBuvMTHkrBPWa9+NY:FzsmLNCO1Ctd2sWeVW7bkrBPWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914185, "uuid": "aacc1f78-06ee-41ab-aa8e-44b997e88fba", "value": 2387968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914185, "uuid": "d418689f-6c43-4170-a89b-08645f6edb4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914185, "uuid": "3bd4029b-9e40-4d06-a6ed-7ae45905395d", "value": "mnr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c51a666-d61b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DanaBot)", "timestamp": 1680964771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964771, "uuid": "908232bf-685c-4581-9142-5b6e179d903d", "comment": "Malware payload (DanaBot)", "value": "16b67de79530a182c3e49ae82bb5f337", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964771, "uuid": "9f8b241b-2470-4873-ba08-8b7be48a1bc4", "comment": "Malware payload (DanaBot)", "value": "db086d3a605b003097b60b57556386d8e7044578dcbe734ed1bc188d4f95ff1e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964771, "uuid": "01475969-ee4e-4aee-a6e8-bfb191fbfb9f", "comment": "Malware payload (DanaBot)", "value": "eee43890558d207f8232364d42c84af09ba08e80", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964771, "uuid": "c78a1cfe-d90a-419a-80cc-6451f8f71e4b", "comment": "Malware payload (DanaBot)", "value": "8f7b40e9ab2e68e000b3e198d16ff33b47dcd01d82d0df84caefde3862cd60bb195d22130b309b6afda9dbd15a64df0b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964771, "uuid": "d401b9dc-a1cf-4fe0-9708-2ccd9f503c3b", "value": "T13C154DAB61905426C727F53C633463C2FBA721A4B360626B05AD59B17CC7D3853A2B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964771, "uuid": "266917b8-6d53-4f31-a404-eee35a8e4ffc", "value": "0621e8c019dc6be57d313b9281743d20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964771, "uuid": "111b935a-00bb-4990-8b9e-08d055d281bb", "value": "24576:c5HAZujXKrsacTGwNG8mKYQoaZx1Plx96:c5HH7Krs3Tr1DZZx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964771, "uuid": "39438a18-3826-4252-8bcb-e78b47501520", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964771, "uuid": "4eb81929-5506-451e-b1d6-918fb192344f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964771, "uuid": "e1c667c5-64a4-4d5d-8c1c-14d2e1a68bf6", "value": "16b67de79530a182c3e49ae82bb5f337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153fe26-d5df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680939251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680939251, "uuid": "8bf1544a-acf4-4146-bf89-5dfb5a7d494c", "comment": "Malware payload", "value": "5ba2879757e7acc7366683d565be8536", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680939251, "uuid": "bab87acb-9484-432b-a218-afb1572341c9", "comment": "Malware payload", "value": "db4eba8a2e4d5cc9ab88152560f875810114414b390055e57089c4fbed512702", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680939251, "uuid": "8545e13d-3017-4d0f-8be0-fd12c00f9871", "comment": "Malware payload", "value": "91e7e9466d2b0d188c43f9f8a43108f851fb9b9f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680939251, "uuid": "cc430137-62e9-4592-bf87-aaf91a7a6198", "comment": "Malware payload", "value": "d39852fe355c2e9af03d4f7c9d4c0ea2f8c3450a5ee3bb0327bd4ce927a2ebe67909cb251cd815006ad2a571224f004e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680939251, "uuid": "1f84c960-d34b-4577-808d-b18e746f297f", "value": "T1A02733D84F70118CA21AF67E55D1B319DFD673FCE368ED058E64C5303ED29E9AA060A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680939251, "uuid": "ac6df6eb-09b6-42ba-a6ac-3a61379a6ddd", "value": "393216:E7JdEdv78y3Cd9ju1mriCc4DyulFOHuuPO/m8F6tSJCs:E7JdEdv78y3Cd9je0Bc4DNlFOHuuPO/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680939251, "uuid": "6164904c-0ed4-4c66-8dee-f182f1f31d32", "value": 21884341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680939251, "uuid": "4c014fda-b5d9-4f0c-b6c6-1411b75f21be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680939251, "uuid": "e9b72afe-68cb-4575-aa90-472251ee3657", "value": "Album_Pretty_Lonely_Girl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2d1e29-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994215, "uuid": "44b7524d-2815-4a88-b06c-05ad7544d8b4", "comment": "Malware payload", "value": "6c11c152f7ae7b2722334bd687479e4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994215, "uuid": "c6b38270-7878-4750-9a30-6fb82178a43c", "comment": "Malware payload", "value": "dcf8fb285d2a23dd5fcae6669ab41f3566e07c15b83eba88a0c1a55ce5ec994e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994215, "uuid": "06711c15-1b85-4a2e-adf8-0a0e2ae4d9d3", "comment": "Malware payload", "value": "4e4e48086761c89f3470ccb81f58d29b125a46eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994215, "uuid": "d405b523-147f-44da-b359-80b6d364ff55", "comment": "Malware payload", "value": "4858d17900f65362f652d93143409fcfbb6d5a4d9c5b29155d002fdbb65164717780d3dc9a316a219e7126bdb9bf0313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994215, "uuid": "806644e9-e4b1-49d5-aef3-3dd1b10a4833", "value": "T1CAA3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994215, "uuid": "8bb5164f-a88c-4d7d-a676-753e3a1c1f22", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggpR2ymOimW+zWBSirHzai:0oc/pOZM1p7NggL2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994215, "uuid": "64780a1b-5028-4f1c-a55c-86ae869bfe86", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994215, "uuid": "05195eec-22ce-4dca-9486-88454fef984a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994215, "uuid": "51b0bd46-d7a3-4097-96de-c4340e4f044d", "value": "6c11c152f7ae7b2722334bd687479e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b643d50-d637-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976930, "uuid": "a3c04a64-2873-47ab-88d7-1489e3f8bdba", "comment": "Malware payload", "value": "7b48e4de38875d7cb7aabb71f0310927", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976930, "uuid": "07db8581-8614-4b21-b8ff-176f65392aff", "comment": "Malware payload", "value": "dd7646ea6266aac7d14d6d9f4e6de2d65f98a423b1b9a39e889b051db9249051", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976930, "uuid": "d1f4234e-11ff-4c5d-8d35-3e592f70432f", "comment": "Malware payload", "value": "1608d7ce26424fb729001c60446b6d4628537f2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976930, "uuid": "901ab6ea-d7b3-454f-a839-792a3bbb9145", "comment": "Malware payload", "value": "c66d0d1c6195bcd86a77d1127e8b3eac7d919f938883f5378930847aefd94e190bbd15fb7f2c3ddce7d66b77337b4225", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976930, "uuid": "6ab1f624-0d52-4da0-baf4-14cab00683a2", "value": "T116C55C64E610D8BAF3D6E978540E7F290CE57D120BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976930, "uuid": "dce482fd-8e13-4e0a-848f-ccbd36c409f9", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976930, "uuid": "1b034ecf-aff0-4058-9bce-84ebd2fde673", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCg:eEtl9mRda12sX7hKB8NIyXbacAfuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976930, "uuid": "136f6dd7-b6a2-44c3-a364-483876793a5e", "value": 2577064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976930, "uuid": "a181d502-9b58-4dc6-91b1-71c6ab374c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976930, "uuid": "f67c66f3-ea84-41ac-9a07-d9c06a6bc8c4", "value": "2023-04-07_7b48e4de38875d7cb7aabb71f0310927_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88713c1e-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997138, "uuid": "777062de-b505-4631-9fb3-44d7f8637cc2", "comment": "Malware payload (Mirai)", "value": "5575feb779eb2dc9b92f69e6de2d8c5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997138, "uuid": "212f5378-099e-44de-9777-222ee9223879", "comment": "Malware payload (Mirai)", "value": "dde05ec7b14ca6a96a2070193d55ff78325670faeebe4ec055b1e5b399f634c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997138, "uuid": "86f6efed-ed86-4d26-ac11-387945bd1626", "comment": "Malware payload (Mirai)", "value": "e2c2c3e7de0d63432160687b9cbe0660761ada4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997138, "uuid": "5a5faf31-70b7-42f6-a7d2-9573b21e32bc", "comment": "Malware payload (Mirai)", "value": "f5360958ceb1fddff33a3a0b5c63dce0812bf3016d79cfd7adc6ad7d45837a334f3c0b8c62124bb7cd9c9d9f29aae36a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997138, "uuid": "9b34f210-e721-4c40-a2c0-a4b88ec7fd14", "value": "T1D4032966F91A9F52C00310F461E58E341F12FDEAAE932EF662B29FE044435D5B909FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997138, "uuid": "421b844e-a6ea-4a1a-af7f-4dfa050a90b8", "value": "768:4azlGxeyxt9Cewh4bs4jCcoyZLwTICiNwbZ010U5Mo:4aQxFnW4YKAyGTICimb+10mMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997138, "uuid": "6927f02e-f3e3-46da-b78e-6ba52583cc20", "value": 40372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997138, "uuid": "09100b14-b31d-461e-906c-22248c6417f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997138, "uuid": "ada9aef1-df93-47d9-a332-915bb80a1996", "value": "5575feb779eb2dc9b92f69e6de2d8c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e6c06d-d65c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993021, "uuid": "577d1543-79ae-473b-b16d-632197f86de7", "comment": "Malware payload", "value": "bc71688f2064ddfc83e65e0a60f8a189", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993021, "uuid": "fc128a81-b0ed-401f-a45e-01eb1009e73f", "comment": "Malware payload", "value": "e055a92e7c030a8d39b00bc73eab865805b9233933d20ddeadb9929b1985062c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993021, "uuid": "8233eb08-1720-4090-b992-5a3a297242ae", "comment": "Malware payload", "value": "adedf2b929818d7d628bcd0e285e91fba99251a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993021, "uuid": "62cefcc7-ca93-4a70-9af0-d6c5c09e6ed9", "comment": "Malware payload", "value": "e1db3f696149aca14d158ce110b33a5a05423996e7543b444eb5cce00df516bb872a0fdba0f4a97fee23791abca10766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993021, "uuid": "bf21f984-ed03-4568-9821-bed3e84de029", "value": "T193734B03771D0B93C59BAEF02DF727F187AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993021, "uuid": "77d03ac4-214f-49eb-8b50-0580913b03ee", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaWpZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2QoZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993021, "uuid": "f587f68c-6575-405f-b3b9-8650455f01be", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993021, "uuid": "1d3f81f4-6473-4556-ace0-a6e93c1f1581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993021, "uuid": "6dcb7cbd-f844-4628-9009-c350f26044de", "value": "bc71688f2064ddfc83e65e0a60f8a189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebcdb6a-d607-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680956131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956131, "uuid": "00515ad4-1739-44a1-b2f1-7f5fe0458373", "comment": "Malware payload (Amadey)", "value": "30d71b16ec30c43dfa888273c259b07e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956131, "uuid": "ba91929f-1bf6-4667-9822-16dd3f6e571b", "comment": "Malware payload (Amadey)", "value": "e101ad45e1f2ffb7409c1db6b46a2ab3374e26c43f2abb708d1ddb9be3365a4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956131, "uuid": "69a83665-b337-4d01-9723-4aa0b05d7c3f", "comment": "Malware payload (Amadey)", "value": "22088dc65d73f91822ede615cec5e5eaa5a8175e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680956131, "uuid": "4501a1c2-3801-47ed-bb54-d4452286d4f3", "comment": "Malware payload (Amadey)", "value": "0cb28f79449c57c374ddda69696d581ee1f1faff2c7f87e111de29d24eb69d57edc0c07b9bdb7d13209c7b8ac6946263", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956131, "uuid": "417230e9-2631-4d9d-837d-441f33431950", "value": "T158352313ABE44167E8B127B008F72B971F36BCA19A68C75B7B81580B4C73590797237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956131, "uuid": "be647fc5-18c7-4364-bdd7-2d14d1baaf29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956131, "uuid": "c378bfb7-223d-4367-aa4c-5c3d346f32c6", "value": "24576:syIqyn6IacND3UN50VonJjn250xO7RbcsNyJreBFfx8:bIxnha+D3gVnaCOlbcss6BFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680956131, "uuid": "6abaa454-9abe-49a1-9545-4ea7bc91bc36", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680956131, "uuid": "39aba085-9e5b-41ee-b162-9c53c6b1909a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680956131, "uuid": "3d3c9ef6-da49-4389-b848-1de3730979a4", "value": "30d71b16ec30c43dfa888273c259b07e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6d3a21-d621-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1680967642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967642, "uuid": "06e1b615-31bc-4e1f-bc9f-c3addb374040", "comment": "Malware payload (PrivateLoader)", "value": "51efb943607029e784b16250cb30c04d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967642, "uuid": "0bfef27a-a901-4fed-9146-1a875b4cd6dd", "comment": "Malware payload (PrivateLoader)", "value": "e41b931c344ee6753862b74f9e9fba1632646d6730f27e92a21a693cfb3f9ef9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967642, "uuid": "8bfd8c5c-028c-44bc-ab44-654f9c684ccc", "comment": "Malware payload (PrivateLoader)", "value": "68dcc2e8b215c21fc72b95469723df28aa0e8414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680967642, "uuid": "5f8f2c19-5995-4a54-a682-877c3bcdf07a", "comment": "Malware payload (PrivateLoader)", "value": "6724fd5ac8b7b3bf5b3260b2bfe26c9e585df16238afaa30415d7e0341f3ef5485d098cbd8a6b7d8c161b19746814638", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967642, "uuid": "e7be0b83-22f3-495c-8206-20aba78687c1", "value": "T13C845B34E600F027E4F314359C5ED3BAA428AB30675548EFB7D89EAA57B56C1E230B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967642, "uuid": "c491118c-2999-4967-b2bf-9c3df3291363", "value": "8eaeaee9e4e4c899dd50ffac2cff753f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967642, "uuid": "6e8f3ff1-3f05-42b9-9ba6-f8ebc88e7fbc", "value": "6144:y6Dc1/3iNyv1i/hS9ltiO22dM0vp04S0pA0Jd0R0ola+15Uieq0sAEIDxYsPUqnq:y9MyvSylF2xLlaoMYIDFpngMMFnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680967642, "uuid": "5903ce93-c6ca-4e63-9c84-05c9ee002438", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680967642, "uuid": "c2f094d1-28b2-4637-8124-ff88aab7bb07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680967642, "uuid": "1ad03cce-b726-4cbc-aa2f-d94c126a5047", "value": "51efb943607029e784b16250cb30c04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696fd02e-d664-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680996227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996227, "uuid": "04aacd5a-5f24-4a43-b235-214b22dbd8e8", "comment": "Malware payload (Mirai)", "value": "be55e447fa7845fff2ea223a8076f134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996227, "uuid": "f14aac26-4516-4992-a8ae-6e74c72fa4a4", "comment": "Malware payload (Mirai)", "value": "e4502bcf8ea6f624c36fb7dea0ad530b940842fb76c049e7a3f65294da1a5ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996227, "uuid": "5989e8a1-494b-4795-9202-6a92f7fa69fb", "comment": "Malware payload (Mirai)", "value": "9204f20b7fadd5a8a62cacc39f1eda3ae7ddbf38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680996227, "uuid": "eaea8c82-4647-4548-9ef8-2cf4c6ccf5f5", "comment": "Malware payload (Mirai)", "value": "e545d3ba46093e4a44df8530c107da31404a9c0b6e9b3115b041855dd0bb17242bd7c084b3a89d01ee38dfdfa40d2234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996227, "uuid": "9372f519-b8c2-45c2-9619-3f563fa56c0a", "value": "T1E9433B56B5428F12C0C312B5BAAE494D3B127FF9E3DF72129D206FA037864E70D6AD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996227, "uuid": "ba4199a9-443a-4f92-8a99-5196fa84d49c", "value": "1536:7tnWDX6mOUw6g+nlnQoRwzaxI4ifnkHd6+b+10mM3W:iXZOUwZOlFInkHd6+ecW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680996227, "uuid": "6248ce5c-6335-4f61-b631-8b9faf8644a7", "value": 57040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680996227, "uuid": "c1df744f-97cc-4193-9167-cdf29842fa66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680996227, "uuid": "edb9bc31-efe6-4491-a5e5-216583ab25dd", "value": "be55e447fa7845fff2ea223a8076f134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf3fe1f-d5ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680944718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944718, "uuid": "1a18cbf3-d06b-4f95-870e-35109c1551c9", "comment": "Malware payload (RedLineStealer)", "value": "8f67bbe50fe17267595b3dddcfa081ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944718, "uuid": "7d7d19b4-339d-48b8-bba2-81ad2cf73746", "comment": "Malware payload (RedLineStealer)", "value": "e4cfaf2310c8aa89c4ccbc38a70aaa1cd3a61f41313f220800068c91c7dbacfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944718, "uuid": "06f15f4f-e2fa-4794-abfa-0266dad2cf3f", "comment": "Malware payload (RedLineStealer)", "value": "b7bf9d3c5809020f105bbf6de4cb184ffae0b87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944718, "uuid": "d13a45b1-1b08-413a-b774-830626d7ed0f", "comment": "Malware payload (RedLineStealer)", "value": "3f7cc7a0ba4b415dceb5e7bf4201f2ada2ab5caaf0edbc5bf014a446722818f58565d5106787f84f87ce4085ffd4dbcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944718, "uuid": "b2c70299-3afb-44b6-bfd7-2b376704352d", "value": "T1C616330B7684D3DEC16918364077E7790A589C0565820A46B3FD7FEFFB31F86A832989", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944718, "uuid": "f7d94cab-5fe1-4e49-b271-9f1a0685b14e", "value": "5720bd0cee3ab34ad6694631cdea7f20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944718, "uuid": "6d035b73-12f0-495a-96c0-44feb755decf", "value": "98304:y75+158l6ArVUA20XeYd+WTgCdrnbhqL46xmOcBWlonMkzlML:y1+1G0w2QdMC1nbhx6A3oonMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680944718, "uuid": "f4028945-67ae-4b9e-a8e2-3b2a5a373fa2", "value": 4264960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680944718, "uuid": "5a89ccc0-46e9-49c1-892e-27c03f667a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944718, "uuid": "273306a6-7b7e-4c81-ae31-e39793723f05", "value": "E4CFAF2310C8AA89C4CCBC38A70AAA1CD3A61F41313F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e471d0f6-d5a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680915258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915258, "uuid": "23656769-4868-42e5-ba88-2e88a17c316f", "comment": "Malware payload (Smoke Loader)", "value": "db88ce5fbe6404779fd21d65ad002d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915258, "uuid": "5894be5c-c6d2-46a3-bd59-32a9295f10e8", "comment": "Malware payload (Smoke Loader)", "value": "e4d323a004c36763dd9c918547c9416fab779746badbe3f47763e472237d791a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915258, "uuid": "700063ad-d38e-4d35-b570-18eaf87975d3", "comment": "Malware payload (Smoke Loader)", "value": "f2e3d7c92c2465a3bf7baf079a32bf5886c73fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680915258, "uuid": "1421c5e5-930b-4ccc-86e6-9b0e6261d8cf", "comment": "Malware payload (Smoke Loader)", "value": "e0578001ecd8c214f9a78d61576809b773c5080e577da8792f9bf6c9e53b0fd98aa715123bbf4773ecd8ae46c6daabc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915258, "uuid": "91002a13-1671-4c1b-84fa-43a5c4aba963", "value": "T12914DF117EE2C4B2E4A744344424CAE4F96EBC61D765468B3398FBBE2E313D0577631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915258, "uuid": "fd619d16-223b-466e-b9f0-c6d3dbaaf447", "value": "5e4546fa5395b85c7643c0108a581bd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915258, "uuid": "1953cbcb-018b-4ab9-89ab-ea59fd6d08a4", "value": "3072:mfjSpXss+idsq8vChiQ9cLPB6MQQ2dxVbJqBP51Vs+3PNI:+mtdEKhiWZMQxNoVVz31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680915258, "uuid": "dbb79458-9285-4b5b-b794-a85aafdf68dd", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680915258, "uuid": "f7947373-6ba4-45fb-87bb-9b6aaa335a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680915258, "uuid": "67f726bb-62ac-4737-a7dc-f9c06ebe5cd9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9462eb9-d625-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680969329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969329, "uuid": "0e3a0c0b-f811-4552-a152-00396ece2ea1", "comment": "Malware payload", "value": "bfc8608a9dcb9d327d2a9090d13d75e0", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969329, "uuid": "4c90aafc-fb44-4f2f-a594-a93f9370701d", "comment": "Malware payload", "value": "e4d61ecb7486c4eea32d2656e9bbf517f909c201331b640763078a3f7597dbfd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969329, "uuid": "2529d8de-65fe-4f88-9b93-20406fe27204", "comment": "Malware payload", "value": "9ac1085083e577e7d6f26cec750431d55735e0e6", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680969329, "uuid": "cf1161c4-5b2b-4612-b2d2-36a7e28884c2", "comment": "Malware payload", "value": "230ba41a05034aefc4d929cf21efc275cfb77a62c8ebf8fa7e6875dee72493142475a699cdd160a29c952763ef07a6cf", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969329, "uuid": "c9756efa-2213-4b8d-8607-c8bf381659ca", "value": "T10446338A0D56909CECF67C30D8ADF0807ED8494CE9279177DD6EB3415AB891A3E1B6CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969329, "uuid": "2f6c754d-1f0f-4ffb-9ae6-30e8b7cd5553", "value": "98304:vhTlMmyFJE0zDp1jLQOjC1q8dHT41KIBG52eYhqbl6b2oVy/:v9lvyFJEu91YO+1q8d4E8b2oU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680969329, "uuid": "2f642d3b-c501-4dd8-9058-2339741374f4", "value": 5766539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680969329, "uuid": "8bde9cf0-62fb-4c26-89c6-3621c5325638", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680969329, "uuid": "2471c648-a29c-4fee-a00a-fd34d3084b42", "value": "New_Soft.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6100a74-d666-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680997187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997187, "uuid": "39a76f96-b716-4abc-a08f-f7444f116aee", "comment": "Malware payload (Mirai)", "value": "f6f06e16f5d6b15456bd8b9a80674b2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997187, "uuid": "f60324b7-4dd7-4e23-af4a-0966d0b3a52f", "comment": "Malware payload (Mirai)", "value": "e4fec6a6fa7760cbc0a03882474220f617e4e904b132480bb453ab28b4262b2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997187, "uuid": "6e9fccc4-be1c-4797-b83c-ab0ee16c9a46", "comment": "Malware payload (Mirai)", "value": "8c0a68a8b3f16149166f0df0c0708ccb7ba41205", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680997187, "uuid": "41595078-f134-4964-80db-032559b8d787", "comment": "Malware payload (Mirai)", "value": "1c55074f5a22f9eeed821ee8142c8def0aee59ea4346f08b00c7aa7735e0ec8ac4ec5b7017665f0bcc87a130e36354d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997187, "uuid": "c5e6c644-a0f3-4951-a768-486a40425db0", "value": "T1BE131B52BD818F13C4C212B6B6AE4A4D3F25BBE992DB3203AD317F9137464EB1D16E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997187, "uuid": "a1d6f4c8-fae6-4626-95b1-f00f7ecc7d0b", "value": "768:QmAGzrykWe4kSIdwekb/Rk/2fEgspM7mZe4xA/N+5iZjlwtLgwbZ010U5MPq:yGHWeGTki5spWKKMiZ4Vb+10mMPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680997187, "uuid": "d33d7cd4-d1ff-4b11-a3a4-6fcda949107d", "value": 44284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680997187, "uuid": "d43f5c24-848a-4e83-b945-0367cb734f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680997187, "uuid": "74d05ffc-35e7-476e-a531-440c8ef7371c", "value": "f6f06e16f5d6b15456bd8b9a80674b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff87d11-d65b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1680992560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992560, "uuid": "eff61a81-32a1-4d5b-9e51-3ca787b989a7", "comment": "Malware payload (Gafgyt)", "value": "0c4483b716e4bf29177e4f2e92d4f5e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992560, "uuid": "24a40a4b-2c19-478e-b097-41b25a2c5f59", "comment": "Malware payload (Gafgyt)", "value": "e6f2badcd9109542e392b7401edcd6f8cc6b6d1f9ad9117446c7396038f89a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992560, "uuid": "bda4d259-8fbb-41b8-b5dd-9a7b63821809", "comment": "Malware payload (Gafgyt)", "value": "ecd60102fdbc9726fa2ddb79ad07a16d8331aedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680992560, "uuid": "2e270884-60fa-4e63-9187-829ff557f029", "comment": "Malware payload (Gafgyt)", "value": "4bb3fc641acb24cd85fdf813b34168c6ba29a7df681894a0c5b44893803aec9d93f310520dc98a9cff0fc9192dd23c6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992560, "uuid": "87c2bad7-a9e2-4998-bc93-a4eac81ce5a8", "value": "T1EF732B42FA43C6B3C8830AB5029B5F2A0D31FEAA5B269F45F32C7DF49B164C47116B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992560, "uuid": "6f67d022-cbce-40f8-8eb9-51e75ac4b352", "value": "1536:+lTcJGPwnVjAWnFXpLk4S3um7qasEGWqejaEILigbmP+lVrCjmxfZp1:kcJGPwnVjAWnFZHS3um7hPzOEumWlVrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680992560, "uuid": "d9c21046-a540-4699-b521-9e4256765c67", "value": 73794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680992560, "uuid": "578b3ea1-e8c8-4a17-97d4-f6555947ae72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680992560, "uuid": "3d5b27fe-191b-4dc0-9aeb-fab219b9939a", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf3ab59-d627-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680970169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970169, "uuid": "bacc083f-67f4-42e6-8dc5-b5d0b6c67b9a", "comment": "Malware payload (Amadey)", "value": "9c26f1906f654ce6d944034faf130cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970169, "uuid": "2b757334-49f4-4796-9c5c-54c61b8c6a5a", "comment": "Malware payload (Amadey)", "value": "e764e32c75d2e764cf3f669ea31186db89a02b6f9f0faa77d0849f0cc771306b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970169, "uuid": "68ec8ebc-438b-4d76-8c88-485313bc272c", "comment": "Malware payload (Amadey)", "value": "00a7fc6dbd91af4c7124e13a4ee69a92b7fffa3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680970169, "uuid": "849239d0-4448-4b65-809e-ae893f5eb0bf", "comment": "Malware payload (Amadey)", "value": "ccb5d2d3b4ca3d164d9a916ef9967e5ecce176053cfce41e427cb1f0c7426df2644d7a473ad2f0bca4166c6490cb8782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970169, "uuid": "533ea5b9-a987-4d17-a144-705151820b0e", "value": "T182552312FBE88522ED762734E5F203C70F29BC524D60425B179AA6592CB3394BE7137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970169, "uuid": "dea9b44e-e465-47da-8918-b7612642cbe5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970169, "uuid": "3cb2894a-87ec-4863-9201-db9d3bbbeb4f", "value": "24576:3ynOqGUCf1YyrrUOIVSYKqxtll1AM4lzwa42lN:CnOqofhrr1IVSYKotl0MS+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680970169, "uuid": "66981855-a2c2-4a07-a87b-8568e083df1c", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680970169, "uuid": "4bdca6a8-c6d4-47b1-83e2-8e4563578376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680970169, "uuid": "9abda9a1-e3c5-4f55-851e-f56ab03b16a7", "value": "9c26f1906f654ce6d944034faf130cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda33d11-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994247, "uuid": "835c188e-d097-4a5b-a39f-330146155668", "comment": "Malware payload (Mirai)", "value": "08dbafe75dcf1e427cc9523303e03d52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994247, "uuid": "502e4557-3089-46b1-a083-bab474dcb5b8", "comment": "Malware payload (Mirai)", "value": "e7f5b4dc4a77a26e52e648df5928857122e444e90b67857a742ec1e2a93adf35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994247, "uuid": "98376067-02c6-4a42-88db-259cc697c977", "comment": "Malware payload (Mirai)", "value": "b5f6d6f2facf2ecd2d9d50d5ad8215ddb71baaa0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994247, "uuid": "8f4adef6-d6fb-4b84-933c-29b792b5bccd", "comment": "Malware payload (Mirai)", "value": "6a881b89486ef98b6d200ac2fad80f2d159fa9cf049e4a60977aa3bf11f4e588ee4e0c8374ba7b4abe81cdc25670febe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994247, "uuid": "1f41e0f5-e8dc-45a0-82f3-a5d1d44ca8d5", "value": "T10DA3F972E642CA72C4430AF102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994247, "uuid": "1db1055a-baee-447b-8158-0c10c816c331", "value": "3072:SOGAEtZoGZKWl6u4YTnbHibimmFVcqq0G27ZT:SqEtZ755nbHibimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994247, "uuid": "44523d89-7c21-44f3-8f2d-0391f3203d76", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994247, "uuid": "1eb9d2bd-341f-4099-bb37-e86aad588f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994247, "uuid": "8c541338-e168-451a-8052-93348523752e", "value": "08dbafe75dcf1e427cc9523303e03d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbb99b5-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976611, "uuid": "23ea34cd-c76e-4576-b0d6-e9bb2fc8a0a5", "comment": "Malware payload", "value": "eaf7f47dfede99de5afc3dbf2e112a5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976611, "uuid": "938c9f56-04be-45b4-bba1-a74902a2bd46", "comment": "Malware payload", "value": "e8d369b69131464f2a3c7ff817894a71c1d7ed9d998d463edd464776325d417c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976611, "uuid": "0e1cdb06-2c59-4b53-908c-84917d33f535", "comment": "Malware payload", "value": "ef4a696034f4c672bdea178fb3d9dd04ac811622", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976611, "uuid": "b67fe353-4c25-417f-8849-c2456f28875b", "comment": "Malware payload", "value": "fb31e0b692e0c057acbe4e567b78348bcc148bf2e4aec22aa168c6e844d00a9f07872c7832b7d96a2b212af24be926fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976611, "uuid": "664b2090-1473-4eb9-9990-addd27fc3199", "value": "T1D7C55C64E610D8BAF3D5E978640E7F290CE17D160BC22D4DA49DAB241FF0EF4E5B2294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976611, "uuid": "59830680-b79f-4bf9-8779-24822a5cc136", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976611, "uuid": "8ae075fe-d1f4-42a4-9f1f-0c29fe5bea98", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCw:eEtl9mRda12sX7hKB8NIyXbacAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976611, "uuid": "7637b860-8b9e-47a6-bcbc-0070bde4a6c4", "value": 2562232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976611, "uuid": "26a3bb98-52b0-4ed1-bfb3-be70d6287fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976611, "uuid": "0ce9eaca-174a-4e39-a468-a1bab775f50c", "value": "2023-04-06_eaf7f47dfede99de5afc3dbf2e112a5c_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3560f00-d5ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680944811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944811, "uuid": "9b47a775-5483-49b2-8158-562a4ca4c88d", "comment": "Malware payload (Amadey)", "value": "0042dbdb889c3050475ea9b18c6f60f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944811, "uuid": "04760df3-88ae-4e15-81cb-eb6fd52702b0", "comment": "Malware payload (Amadey)", "value": "e969872d46b951ab7e60ea3e59e8d397828520a22ab2e6dd1df2d801850a484b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944811, "uuid": "7b1eeefe-63dd-441e-b2f3-4fe564f1cf30", "comment": "Malware payload (Amadey)", "value": "b092ed2139494e882d31e1d8e7f0a8ed10e624dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680944811, "uuid": "eb0257c0-5fba-4905-bcd8-5fb4683a3514", "comment": "Malware payload (Amadey)", "value": "d1ba13602ffa02869c1a9fc72a8ab06c3a52180b723c244e9b24af120f668ac173efd4e5c9e1d40cfc80f608ab3e570e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944811, "uuid": "62cc12b9-0c56-4f00-9932-c2d4844b7016", "value": "T1D4151217B7D86032CEA11BF069F603A30634BC719D7497AB7751EC6A0D72244A23A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944811, "uuid": "cd31bea9-a3ca-47d1-9872-35f368c010ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944811, "uuid": "c6dc86f9-f293-4f4a-8b4c-bccb8da8ed95", "value": "24576:KyWK8UxZ7+AR+VfdSeKCbs3uczLiFt8g0:RW3ayARufdSrJLmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680944811, "uuid": "10f21833-d892-426d-931c-cfbc215321ac", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680944811, "uuid": "48bf6e4e-1ab3-41df-86ab-8289b9257ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680944811, "uuid": "3da58cf7-5da2-4a1f-adcc-e08bd501f4b2", "value": "0042dbdb889c3050475ea9b18c6f60f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5498b71-d62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1680971443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971443, "uuid": "b908a996-19ad-4555-9cf4-d6b76aa53918", "comment": "Malware payload (AsyncRAT)", "value": "f66940a7ab4f7db4534b0da7a155741d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971443, "uuid": "402ac8d4-30d1-4a88-8492-7f7dd0d9ee30", "comment": "Malware payload (AsyncRAT)", "value": "e9862583e03d49e791f0aaabb974ba4054cea75a57fec9660b59dd3342cd65de", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971443, "uuid": "908d2d93-785a-4128-93c5-1ce613e75840", "comment": "Malware payload (AsyncRAT)", "value": "3b0ec707455c8c0b2a465a386b68634b41afe4e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971443, "uuid": "57dfaf90-3876-43eb-b458-956859835128", "comment": "Malware payload (AsyncRAT)", "value": "cc66dbd998a3239fff99dcdd65447e7f7fd981683e3c328a934d4212a05c25a53b91ee31af135049b6ab12f7b83554f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971443, "uuid": "5fc35f29-42a7-4d46-9332-8a417aaad031", "value": "T1FE236C403B988136F2FD4BB4E9F69245C279D6672903C65E6DC810EA1B03FC59A136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971443, "uuid": "cc8f7a3e-42ab-4248-b9cd-0b65f3c2f221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971443, "uuid": "2a7a2947-43e5-406c-acd7-97246110e78a", "value": "768:2duRtILkWAA+jiYH/lDB2Oaig8Yblge1+A8aLfRvEgK/JYBVc6KN:2duNoYH/l92OSzbifoJnkJYBVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971443, "uuid": "6819ae47-24d8-4e16-8cf9-619c8be943eb", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971443, "uuid": "7febed4c-a92a-4784-b50a-16b00384c792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971443, "uuid": "8b82a0ba-4621-48f1-ba3a-87bd092044d9", "value": "thasupreme2(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c731f851-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680994237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994237, "uuid": "facd834b-a3e4-4419-a34a-5d385a14e894", "comment": "Malware payload", "value": "75bb092ab09bbd3525be0621a7041073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994237, "uuid": "78c25556-6f1f-445e-8746-1eefdb6414bd", "comment": "Malware payload", "value": "ea6f5b120b7a1062fa6cf95837b74077c6769a73d344ee3cbb127ca03c813324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994237, "uuid": "329c2c35-c04f-41de-913a-1dcbf06aa749", "comment": "Malware payload", "value": "9ab20fc78b982c38aab16bbdcb9450c9d7f016a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994237, "uuid": "1326ea57-0649-4944-bba2-151f50d942ba", "comment": "Malware payload", "value": "0916db63be08d065d922f8420cac3b7ceae8c936070a208ec16a70040b78b59761c9e5e4bfed9d9a4308835984b8c5ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994237, "uuid": "b8f7f456-bc5f-457e-9008-0efc557f1323", "value": "T1EEA3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994237, "uuid": "4adcafd5-3274-4640-a3c2-c798968db055", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3neE2bS1jxlrimW+zWBSirHzai:VR/fymd2D392bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994237, "uuid": "ad04f3cf-136e-4281-bd8e-37b3bb2b1d74", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994237, "uuid": "b0338271-775b-4670-96a4-77d6a20f7096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994237, "uuid": "8cf4191c-8658-4551-bb68-7623f84e4728", "value": "75bb092ab09bbd3525be0621a7041073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd83cf7-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959697, "uuid": "47440ef1-f3d7-4eea-8214-abaa6a9a4dc4", "comment": "Malware payload (SnakeKeylogger)", "value": "03dbc693ee63d6b402f4cf58e42475a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959697, "uuid": "7784a23d-e11c-4a96-9b26-9179d63194ac", "comment": "Malware payload (SnakeKeylogger)", "value": "ec794c2c6e1500128470f52a2c27062417b08630af23db55410e61155934fcfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959697, "uuid": "2e5360fb-df8c-45b7-9c99-d57a8e9ad39b", "comment": "Malware payload (SnakeKeylogger)", "value": "7726cff8166eae73b254eb02d7f5101855ab7555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959697, "uuid": "92920a30-6df3-4304-b358-5c25fd6d6eff", "comment": "Malware payload (SnakeKeylogger)", "value": "a34992de5fb2ec27c9509814ed442635e8de62eeb9851d8646b6b0ab86d737b0ff23792a37989e180cc5b4c83a1a7f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959697, "uuid": "beed0de7-de00-43a9-8bae-3522ec90ad1d", "value": "T166E47CD46AD68BC0C037B170F049C6F2C3D2152AE099DBE138AB5989E1D2E555CFA8FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959697, "uuid": "752d410a-9bab-4579-8caf-0550163acf45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959697, "uuid": "a365bd4b-dd31-47fe-be78-812a278be82b", "value": "12288:fZ2iN7E2KXy8kaeimuryjg/ORLc9FtSKS7ZegYjZ3CyVgh2eV:x1JSgaKurj2RLEAIgYjZ3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959697, "uuid": "a6c5ad7c-6c78-49d3-9e16-214127580167", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959697, "uuid": "45113a2e-bd1c-4be4-9081-1a62df512d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959697, "uuid": "79ecc752-1a89-48d6-807c-d2f16f97e369", "value": "Order No 023012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d71ac9-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680993556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993556, "uuid": "08f4348f-8a7c-4c76-b5d4-52d3ef6ea24c", "comment": "Malware payload (Mirai)", "value": "f544e44d0d372ceeeea355fcadcafe8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993556, "uuid": "ae6e6b62-4c06-49ff-9544-c156c32cdec4", "comment": "Malware payload (Mirai)", "value": "ee877238aa777148dd4241bfffd177181463a0aab11cce4e2dea97ab47271f18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993556, "uuid": "ccf8ddc2-6190-48f7-8a69-62717f874d1a", "comment": "Malware payload (Mirai)", "value": "e7f12ccc4037b3c0455b7bda749e138604266dd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993556, "uuid": "1bb2605e-cc4a-490a-93f0-9bfbad770013", "comment": "Malware payload (Mirai)", "value": "7c6c21e4f56d3b6a1559fb2e355731e9c7c1e85b3b7ef13ff0d36d01c5ca31aed5628d07a486f2a949151eb2c2008c4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993556, "uuid": "c4905fe7-b9a7-4bd8-82dc-7bcac555907b", "value": "T1E5B31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993556, "uuid": "d839b01e-6a53-4dc4-9d9c-0393239c4b19", "value": "3072:OwNUWqpCgYXlrSyWUfMNgMmH1cuEgv26uN/:OwNjqpC/G8fMNgMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993556, "uuid": "c782e07f-436d-4f35-b345-c581c98c4138", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993556, "uuid": "2f4a6093-0c61-4644-8b16-8b45c4a3e9e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993556, "uuid": "7b0af5f8-123e-44d6-af52-cf10cb604199", "value": "f544e44d0d372ceeeea355fcadcafe8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712f76f8-d62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680973476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973476, "uuid": "ab4862be-8d03-41d4-b340-2793a770816c", "comment": "Malware payload (RedLineStealer)", "value": "3bd1d0888dc2edcc9900d7cfceeeceeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973476, "uuid": "6471931b-ac90-4f02-a0cf-7c3a55eec5b3", "comment": "Malware payload (RedLineStealer)", "value": "f1ef8260faf74c9df510f2aec9f4323e09c26a495faffde4babc963e7dc331c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973476, "uuid": "bc998135-efd4-494e-8f9c-40dfafc3b4ad", "comment": "Malware payload (RedLineStealer)", "value": "5f71619955d4889ba57a3be1eac8e5100c4ec7c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973476, "uuid": "79c97370-3d55-42a8-91fe-18a19d5835f6", "comment": "Malware payload (RedLineStealer)", "value": "f48574d422b7c7f62de47743b9bf3aa43dbf728128d3829aad459e6abf046b2575b93f42916890fc9a15b999fa7324d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973476, "uuid": "f224bfd9-7394-416b-a102-b2af8d75f728", "value": "T15864F2027AD8C073C95708745464CAE0B57FBCA3969D828763582FAF3D707E1A76B722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973476, "uuid": "78449ad8-7cf9-4c51-a224-ca0129279a21", "value": "b57501f26cbd338c9d36004199e16398", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973476, "uuid": "9c0bdbac-a6c7-454d-a36b-5d4905956f26", "value": "6144:yXqfdZUYFEVYvMTeVNEgkuRUfgdef+yvP3TY1AN:yXqFZgNTeVLRU4deGIDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680973476, "uuid": "53e16beb-17e3-47f1-a529-d1adf12de14e", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680973476, "uuid": "25974130-37f4-48d4-b085-8c92da014ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973476, "uuid": "6e81aa59-8ea1-4700-bb52-2c3799b50931", "value": "3bd1d0888dc2edcc9900d7cfceeeceeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5864e269-d60f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1680959691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959691, "uuid": "537a7506-e615-4f35-80f0-fc15cced229c", "comment": "Malware payload (SnakeKeylogger)", "value": "082112f35070fe49ef3062251da1b1cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959691, "uuid": "588f7105-a1d0-481f-8597-6dc723f9b99d", "comment": "Malware payload (SnakeKeylogger)", "value": "f224c025b292a36b97d7fbb8de9d868d1e70db6c13e28025557afcb66c1e081b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959691, "uuid": "8e218e0a-ea0e-46d6-b531-ed337c947e81", "comment": "Malware payload (SnakeKeylogger)", "value": "ab74defa51f507f0b42df5ea5df5c7217f8e7d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680959691, "uuid": "c415088a-2c88-42ac-a2ff-11f9ae6b4cd4", "comment": "Malware payload (SnakeKeylogger)", "value": "cd0bedfded111857e1e835616dce10b2d1cf6a8aed90fab6953be71d98c6bad015d4c1351ea465d20323f1fc6d930c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959691, "uuid": "c0d8ad95-5988-4583-85c7-0ad97ca4c4d5", "value": "T18215021537995F02C6BD97F914E2908013BA7F3A2626EF4D2ED230DB1977B5CCA50A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959691, "uuid": "66daac76-bf5a-4fd6-8f50-3c3fde0823b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959691, "uuid": "9dd41a56-77e0-44ba-aebb-57545351b50f", "value": "24576:rll06MFf1U4cB2RsKWopwAXe8zETalx/SPwFl/:ZlL8fSiSopxbzET/wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680959691, "uuid": "4ef2249d-146b-41c2-b28e-fc47999315fb", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680959691, "uuid": "64238eb0-6aec-4f94-9072-31ea704ca597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680959691, "uuid": "610b9b95-3b79-4f28-84dd-0877bb45620f", "value": "082112f35070fe49ef3062251da1b1cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdbe4ab-d65f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1680994197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994197, "uuid": "4158a5a6-2e29-4fad-bd10-0f5666e32dd9", "comment": "Malware payload (Mirai)", "value": "12a28ab138a9e54815f6814209b81d96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994197, "uuid": "23ed8e4f-48e2-498f-bcbf-0ee6875c6519", "comment": "Malware payload (Mirai)", "value": "f422e602bcbdad597a1cd8c0cb353f9eab6d7542f75ab08673f96f2ee1d04e14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994197, "uuid": "79090469-24cc-44bf-ab8a-e9e8e5b1d04c", "comment": "Malware payload (Mirai)", "value": "dd6e9c6b6d9b353b35cf40cb39d6b8b67853fede", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680994197, "uuid": "664bc705-445c-467d-be53-c8b089b4ae31", "comment": "Malware payload (Mirai)", "value": "b2183206916b62a1df06e83107b4d79233579488f4e6516287155d3de3ced9fc2b581b6b4d84f0d6b2655fd6f09b775c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994197, "uuid": "2f7b72c3-4a76-496e-8d54-1845b640f591", "value": "T144D3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994197, "uuid": "1eedad6d-bc80-4ebe-94c6-25d00faf9bba", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pCAOhmm/QMurB12CGNb:RrUlkCXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680994197, "uuid": "f70f1037-55d2-49df-8599-99a9e91c40cd", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680994197, "uuid": "1595dc16-5f59-460b-b0bd-acd39a5a91d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680994197, "uuid": "4700fd3b-5515-4ec4-a7cf-88820a7a004f", "value": "12a28ab138a9e54815f6814209b81d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74528714-d62f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1680973482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973482, "uuid": "1cb4fd29-b8a4-40be-9856-466f24e2b0be", "comment": "Malware payload (Amadey)", "value": "e2168fe862fee2ae52a2ace884ec0e16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973482, "uuid": "461ae546-f54d-4eb9-bc1e-6d88d862bb63", "comment": "Malware payload (Amadey)", "value": "f5993e37f845fc2f815ae5619b6be60af7f5befb058abaebbf3529006575982c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973482, "uuid": "608b04f3-8cba-49b8-ba11-faf136a05733", "comment": "Malware payload (Amadey)", "value": "a1ab88ffc2cb2df1a2d4dc031182e96d0ea9575f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680973482, "uuid": "897f7921-ca86-4fb9-9100-a9c06d4eeea3", "comment": "Malware payload (Amadey)", "value": "818b6734b22fc5fb219dd31e4e4e91224d4fba0de1dd6803285f7897e1ae03591d5b0506f72ddd3012197b641710b3e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973482, "uuid": "8f0e142e-e9fa-4dd6-bd20-1f9c11fba5b9", "value": "T1C4652307BAFC9877EDB917746CB703530B3A7DA1AD7456172B69409B0C32E8058B43AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973482, "uuid": "da282d8d-61be-4bfb-ac71-89ef7ef20376", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973482, "uuid": "87923adb-66dd-4515-b2e7-03b72fbb5cfa", "value": "24576:DykEfIgfYRWztP7/qF+92C7+XntVZ11Sv/+bJcr/lV7jFwN3Fiqx8Z:WkgIIzYk0C7+zf1g+s1izin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680973482, "uuid": "62f121f9-e814-4a43-a6ff-98f3939a0fc1", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680973482, "uuid": "5a269413-5cf6-4186-802e-80025447acc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680973482, "uuid": "2df13ac1-b0e4-41d2-a4f5-b3d081f375bd", "value": "e2168fe862fee2ae52a2ace884ec0e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e068e1c-d5a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1680914898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914898, "uuid": "a453fd37-c8e3-418d-98e4-d9eedb0453fc", "comment": "Malware payload (Smoke Loader)", "value": "f7f79e6c5aa394bd3699dde4c62ca680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914898, "uuid": "ebb8d352-5f4b-48ed-a69f-6f77f1b2d892", "comment": "Malware payload (Smoke Loader)", "value": "f60629876a80e4c9431e8650826f5e7c36bd6eb115dee4f8bc7bccaed7a4ce59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914898, "uuid": "7de3a084-5c14-4582-9461-5aa5ddfb9507", "comment": "Malware payload (Smoke Loader)", "value": "726a4f5520d7daaa16b4ab28ed5231100d56ce76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680914898, "uuid": "0c269d2c-bbf5-45a4-a1f4-972cbebb99f9", "comment": "Malware payload (Smoke Loader)", "value": "4814bcd959dcfde1b6fab112d452902b40ed5f6167d785ed6da88088ba020fa6fe014326753b212f7007323505e6e174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914898, "uuid": "1e20f341-54dd-46e8-aa1d-8c49b8833461", "value": "T1A014D0E17AD1C8B3E59389708020DAE46A7EBC615795928B33487B7F2D307805FAB353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914898, "uuid": "aa4bcf6f-324c-4329-b818-f614de4eac9f", "value": "5d89d480ca50e80ba5a0de339176474b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914898, "uuid": "dd81a61d-7e9a-4258-b89f-1344b74cb6c2", "value": "3072:2Iz0uOAPb+UxRQ3JsfqokOkHy/DFMWU6OlY9MR1051d+C:R9BRAJsSoCiDCWU6kIMRCdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680914898, "uuid": "dbcdde2d-1520-4695-99c3-1bb4b4fad55b", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680914898, "uuid": "5f2534a0-6aab-4a39-bed3-d40f60de34ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680914898, "uuid": "137694b1-81ce-4350-ab42-9411e569071c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7a0d36-d65e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680993599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993599, "uuid": "9bc791df-ece1-4da9-a2c7-c56aadb884ab", "comment": "Malware payload", "value": "2c659581f2d4a5c93370070ba0add399", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993599, "uuid": "ab86cb9b-b3fc-43be-a144-22cd8747f4fe", "comment": "Malware payload", "value": "f6c444b892736cdd3f198e535de9fea534737dab3da1cf1183ff7a6d3b4450df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993599, "uuid": "5c2175e2-f991-4ed1-82d0-8d913316ab5e", "comment": "Malware payload", "value": "35bf3fd57efc984a6d20b6b5a2d1cc9a19b02ff8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680993599, "uuid": "39000008-dc1d-432d-b939-d20c7ae659c9", "comment": "Malware payload", "value": "893a501b6625c448e464a639c3d3a122fe3d1baa60bb6e6e854c111a1bc93a12d152fb474b6c6e25b117fc660457a212", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993599, "uuid": "c2873efb-fa79-4330-af9c-b2d9696a04f3", "value": "T13653299AF800DD7DF81AD77F4467440AB231AB9542830F3A7357BD67BC721A80926F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993599, "uuid": "5a4e8829-7d06-46e8-bd49-bd17e4ebdad4", "value": "1536:kp2q3Oud+QEV4SoZ80At/Odj1IElg7r3DkBdq8C1h:tw+JV4SohVXIKgnfLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680993599, "uuid": "c7057135-3717-4049-9f7d-1b944ec58e07", "value": 62336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680993599, "uuid": "3882bb5c-c83b-4d13-9dce-2e2aa2ccc94c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680993599, "uuid": "298be7c4-9864-4eb8-92fb-e5922c9f0009", "value": "2c659581f2d4a5c93370070ba0add399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73369d77-d61a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1680964460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964460, "uuid": "a2d7bebf-b6c8-4903-bb66-e2e8ef938c7d", "comment": "Malware payload (njrat)", "value": "e9b791f2d662aaa9df8e911a5b9c8227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964460, "uuid": "a9e12431-5dca-4f1c-9a9e-b8227f2b459e", "comment": "Malware payload (njrat)", "value": "f6ce0fb9b04d3ed91220f3144df5fe76d51eb52977a847a98e39b7c844f228f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964460, "uuid": "54880864-57c5-45db-bdf3-20fbbb12b480", "comment": "Malware payload (njrat)", "value": "16cbd4f9b47af2bbc9e30a1a9d0952d172cfa6d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680964460, "uuid": "a1ed461f-bb1f-4d4a-8478-ff8de3031828", "comment": "Malware payload (njrat)", "value": "0290f75830dc5a89c3ab0d6e9262ad14a168ead02dd0a95d5314065788d198b6954983b6d26c740f189776e61d878203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964460, "uuid": "d1bfaa3d-5097-4165-890d-bdb7d5e63244", "value": "T124B22A0E3FA98866D47C17748AA59A5003B091470423EF2FCDD550CBAFB76D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964460, "uuid": "4d96e945-d67f-4db3-8538-d3df13b4fe33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964460, "uuid": "dd39f7fd-76b1-4d95-9160-4c318b3732b1", "value": "384:kYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZ5h:TwWkti/aeRpcnu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680964460, "uuid": "c1b7d863-a357-4551-ae5a-49e0d8ad062c", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680964460, "uuid": "c00c5443-d627-4e2b-9cdd-2f304ea60555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680964460, "uuid": "ee5abea8-2a3f-457d-8248-6988a822f1eb", "value": "xfZG4qcs0mTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca775ee-d60d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1680958839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958839, "uuid": "234ea83b-aafc-4305-b0f3-06d24dc094e9", "comment": "Malware payload (Loki)", "value": "19d6a5e166f706ab879e412c5c2c78ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958839, "uuid": "0afcdf60-e921-4afb-82e5-688744878315", "comment": "Malware payload (Loki)", "value": "f8720dadce94fff054b2542f91abbdd5c117ecf935af0b7d5f5ac903c40d39ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958839, "uuid": "6b4f816a-b2c9-43e8-84ab-1935b68fc1c6", "comment": "Malware payload (Loki)", "value": "b2b40bba969e4ec9bc714f459dc327b3c374444d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680958839, "uuid": "a0691d56-720d-44fb-8e40-6c99801e40a8", "comment": "Malware payload (Loki)", "value": "17bc45cd8715364f03078ebd753387864774162452a31e5be3902cfe08e51fb2627f7571bf38dc531ed0e90a3d4ece44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958839, "uuid": "c213472c-02bf-4b79-a656-8b97abb7ccc8", "value": "T1E2B32A42B2E5C030F7B74DB2BB63A5B7857E7C332D22C44E9352859A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958839, "uuid": "142b0433-6423-41c5-bdc6-5e8e4372a921", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958839, "uuid": "0cef078f-4d0d-4faa-9127-c694093d40f5", "value": "1536:kzvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd90l:/SHIG6mQwGmfOQd8YhY0/EqUGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680958839, "uuid": "544193f4-2575-4bbd-b13d-5f2221859928", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680958839, "uuid": "de066f13-e6ca-4d53-b7ff-25bec7d06bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680958839, "uuid": "cd17006e-a254-4fb1-97fc-0024d927118e", "value": "19d6a5e166f706ab879e412c5c2c78ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06f2631-d62a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1680971489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971489, "uuid": "d638d23b-a614-4b83-97e1-a740992d4464", "comment": "Malware payload (RedLineStealer)", "value": "0fba70fd96dd1e3cb765010c3ceba90a", "object_relation": "md5", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971489, "uuid": "1581345b-8eac-4e9e-91d1-4eafdda229bc", "comment": "Malware payload (RedLineStealer)", "value": "fbeeb6a35eb0525ad3f6ee6559833b6dc2bd314032f26e006e597c4fce614718", "object_relation": "sha256", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971489, "uuid": "1f71b77a-3bba-4003-aaef-6599afeeb868", "comment": "Malware payload (RedLineStealer)", "value": "a08f50f70acb207d2b9d18674574734b415ef39a", "object_relation": "sha1", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680971489, "uuid": "8dff90cd-46bb-4639-a1d8-452ff4626374", "comment": "Malware payload (RedLineStealer)", "value": "845295d7a354840c70a1b1423bf0af9ccbe04445df460537eceaf708066868203b203b0e510b0f9ffa0b85052af15426", "object_relation": "sha3-384", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971489, "uuid": "d1fa29ad-a7e6-4c47-8772-104701bf9021", "value": "T115E512B9763032DEF863F4719DB81D6DEE143466971B8747A72301A9AA1C98FDF100B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971489, "uuid": "c8d207e1-0f92-49e4-ad84-22f6e96d5526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971489, "uuid": "70342376-12f0-4c1e-8d1e-121ecdad429c", "value": "49152:JMMPEh+rBiCHWkoFJq58Ul1kbB9qQRIvZ9zFNNad3WKuNC2Dmhmhxok90RvbsUfp:aMPEaB9h+Jq57rk6QRIrzFCdmKu4Kxpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680971489, "uuid": "3fdd8f56-6a29-46e9-8ed0-eb5a0b38ab64", "value": 3043328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680971489, "uuid": "225f5b87-44b8-4cd8-8d4e-03453bce43e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680971489, "uuid": "9fa88155-4265-42e7-96ab-149603e0eee8", "value": "SpacePearl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb93a1-d636-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1680976608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976608, "uuid": "f9aba36a-1462-467e-bab1-9b15789db770", "comment": "Malware payload", "value": "e94e0b4318067b41625a8d2c56eafa90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976608, "uuid": "f9c93218-23f4-4cff-990d-a1e9bd66faf7", "comment": "Malware payload", "value": "fcb6d679d7bed0089266301a0be8b0a410a0aa4f52e22c801c7db4e25fc5256c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976608, "uuid": "c8ca0be7-3314-455b-ba54-7d8dfd222b82", "comment": "Malware payload", "value": "40d382cd7347368865e5a93d6c5437ce8e014d00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680976608, "uuid": "5d15f3b8-abd8-4d60-a4e6-10afc569de92", "comment": "Malware payload", "value": "3d0c4eb09120af9186dce593c611adc194e5e0aae3bc254b5067064826822cb60cdc538fe384bc8ae4f148b4e0b924c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976608, "uuid": "66344a3d-09db-466e-8f98-106170635756", "value": "T1DDC55D64E650D8BAF3D6E978640E7F290CE57D110BC22D4DA49DAB241FF0EF4E5B2290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976608, "uuid": "1040037b-5603-4a84-a363-d96f8cacdb19", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976608, "uuid": "42db37c7-f70c-4243-92df-545c02e017e0", "value": "12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCz:eEtl9mRda12sX7hKB8NIyXbacAfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680976608, "uuid": "8606df73-7c7a-4ef4-b0c0-ae387c22961b", "value": 2579966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680976608, "uuid": "fd2f0de1-41ee-4502-926e-849186c8af60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680976608, "uuid": "477658a8-5e1c-4d72-bb29-40045f215b08", "value": "2023-04-06_e94e0b4318067b41625a8d2c56eafa90_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768e5cb0-d5ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1680945568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945568, "uuid": "860028df-7a48-4f5a-a3c5-0c3b7b139f4e", "comment": "Malware payload (AgentTesla)", "value": "6d8d437321c937ccb182176701435b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945568, "uuid": "c5c35edd-1768-4a70-8329-4aa6d59867da", "comment": "Malware payload (AgentTesla)", "value": "fd572dd908a0b05cc027e110ba8fbb9e74d4d058a46c9f0bc7b4a5bae3d59dbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945568, "uuid": "109e8be5-fe9b-474e-9f0c-ec9e6e9632b7", "comment": "Malware payload (AgentTesla)", "value": "72c6a02b9ad319f766947d921df0ab20f8ebab8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1680945568, "uuid": "540f87c7-c8f3-46f6-8910-2c57e77550e4", "comment": "Malware payload (AgentTesla)", "value": "85c04b358c71d227a4da3e831d6c527fa3803e2c00aed1fbe9bf381ce6045c125e944981ae1bcb2d394f5fa45c4393fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945568, "uuid": "af9099a9-5ba2-488a-8612-ef1ecc9afc58", "value": "T127A423B382D105AE325F4C29549CBE7DBF40720FB8E58B59D23825A0B86F1632D3E795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945568, "uuid": "b2d83825-b56d-463b-ad27-a13d63a056fa", "value": "6144:9gCOQ77uKA+oZAGyu2Y4XW1mfK2mQaeeoCKVIQGhKJVhZZLTBiw161ovVGW/O42:bOQnZoZOJNm1amQaLPK9PrhZZXnz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1680945568, "uuid": "100423c9-98a5-4ca2-88d9-8dd70283a94f", "value": 477520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1680945568, "uuid": "45a6848a-9330-4004-8e92-e8c95d24df53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1680945568, "uuid": "b0859735-8f81-43dd-a5ab-5f1530ed9eca", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }