{ "Event": { "published": true, "date": "2023-06-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-30", "timestamp": 1688169782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "68fb5102-af02-426d-b4a8-c0d2e9a833a6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beba485a-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111413, "uuid": "cd875642-2358-48e4-a8a0-49c6923cddd7", "comment": "Malware payload (Mirai)", "value": "0cbe4561db429c3d0ac3c48932077ee2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111413, "uuid": "8fa02c18-0167-4c00-b59d-16b4d9929b4e", "comment": "Malware payload (Mirai)", "value": "00a104aef2ead69ce77eb3170c8bb8e272d8637f7ee3e7014df64b104c8536c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111413, "uuid": "2ad7c9c1-e37e-4a8a-9cd2-23df92c6efeb", "comment": "Malware payload (Mirai)", "value": "a56ef4831f0336f1b0b1378e40be8a7f2c511814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111413, "uuid": "030e178f-b434-425c-a036-615cb9b8d8c2", "comment": "Malware payload (Mirai)", "value": "caf5ab0aa0282f9b92c1208299d7025d90e5dcd3151ec35589f560180da03d1f82e7d30280cbfdc32bcd44ae4d5a2fee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111413, "uuid": "c01b26cd-cc73-4266-b84b-efed25121612", "value": "T111230271890E9DF125303C76EAD9D793B6E126B2C6373013D62D0A382F756131D5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111413, "uuid": "a7f77eb4-fbdc-4883-a206-9500e185286b", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b339q3UELbUXfi6nVMQHI4vcGpvS:gECFd+A6YHAxGLRQZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111413, "uuid": "e4c44ff8-0f04-4c35-b1f4-ec30a663ad1f", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111413, "uuid": "1a6ff098-f824-4a25-a7a1-700aa90e6497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111413, "uuid": "4e797fa3-79bd-422e-af0e-ab5c1c6f2c76", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a9796f-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688101038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101038, "uuid": "9f858a6a-414f-4a30-831a-88ccaa477d09", "comment": "Malware payload (AgentTesla)", "value": "cf32f3762a1d04e82d111fa81aeca038", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101038, "uuid": "ffd086ef-3ffb-478a-aa59-a87ca315f01e", "comment": "Malware payload (AgentTesla)", "value": "019c57e34c7c90f5c3e02d3ffb68fee20b4ffe36e318f532e877c09d55aac959", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101038, "uuid": "44c1798c-644c-4415-934f-85c9821d97e5", "comment": "Malware payload (AgentTesla)", "value": "6269964e02648baac95f26a8deb6d44b829e799f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101038, "uuid": "ce8db747-2653-4340-b191-c14d287400ba", "comment": "Malware payload (AgentTesla)", "value": "e761145525dbc4c8a3c6210f8cccab03870a9760491caea70e86645b27559d5c13628ce4434b17517d5ee80c954f4ef6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101038, "uuid": "8e212c65-c6bb-4586-a175-8491decb4c78", "value": "T1D135337EB46CB8F3F7C2872E01F675B0815CB39331A95E0596A9BD95A21E208474DBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101038, "uuid": "05ce9b1a-64f6-42cd-9727-4b672c9ba14d", "value": "24576:Lw6w3duXTTrTH7+shDC4DgPzdMD2yjyncecaV1plNZBJ0z3:Lz2ATTrz7+YlE+j8ceca/NZBJ07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101038, "uuid": "49766793-cd82-4c40-8cbe-c722dfccb463", "value": 1107494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101038, "uuid": "1a5d1353-ed0b-4c70-b176-c31132f6cdb1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101038, "uuid": "08bfb0d9-bfd5-4d5d-9f30-5ca5217f24b7", "value": "Proforma Invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30e48ef-174b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132546, "uuid": "a2269634-34b6-43fe-b844-1d5c10c658ba", "comment": "Malware payload (Mirai)", "value": "f30925f89babebca93caf911aa68a9cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132546, "uuid": "7599b56e-e70a-4349-a23a-485e70a52e1c", "comment": "Malware payload (Mirai)", "value": "02ed0f7a175c52bab29911f46ee048fa916f28fc462015db58f8779683e671a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132546, "uuid": "95d94fab-a4c8-4c52-b9b5-670622f33378", "comment": "Malware payload (Mirai)", "value": "6501b52ffcd46daea52904e0d0b45ed0a95b823b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132546, "uuid": "e55d8a2d-f13a-4971-b548-2d651cacd328", "comment": "Malware payload (Mirai)", "value": "e585f83bdf38733a92b1c80eec24a855e9ec4a52ba89ba2a6f9bc7802227c9a587aab5f64f71037de3ac803b8255f4b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132546, "uuid": "50e6f486-c94e-444d-b15e-6293aa2d77a5", "value": "T1996338D8B543EDF5CC1A06712072EF3F9EB6F0B5122DE943E3A49A637C81B41D80A598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132546, "uuid": "68f5e984-213d-4872-bbe8-67d1b5fd2ee0", "value": "1536:JgjInSqy3Hzoyz5GiOn3Cumo3TLh27dPDYT0qc7RAsDNc1C32Bg6/Y:Eqy3Uyz5GiOnSumo3TLh27tDDDNcE3OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132546, "uuid": "48881995-9fdb-4197-9794-0572b1820b29", "value": 67280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132546, "uuid": "8b5d65ed-f1ad-4900-badc-92a9b54baba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132546, "uuid": "7f8ea7ae-a5dd-4ae4-9b33-3d8ccbe4a9d5", "value": "f30925f89babebca93caf911aa68a9cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c07c4e-1701-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688100608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100608, "uuid": "535c19b1-a260-4079-b02d-fd974de473b0", "comment": "Malware payload (Mirai)", "value": "b50588d096d98f60954bc25556c6fd44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100608, "uuid": "56a7abb3-f072-43e3-a022-14be05e28cf8", "comment": "Malware payload (Mirai)", "value": "030816bae9fbbd36560205d732ea56e5274b0e420eb9c7720dce017cc930b3db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100608, "uuid": "413ac4fb-def6-4c40-8aa7-c137ae3ae413", "comment": "Malware payload (Mirai)", "value": "1f85d69ba91ed0ccd965d37d9213b365ce049589", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100608, "uuid": "b5898f18-18e5-4cd1-ba6a-0dd3748487ff", "comment": "Malware payload (Mirai)", "value": "f6f7055884d25d79451504d6b2b2e3c036a8a908feb8cf75f1c4dfdc29ca51eaaffc32414d792f61e6b717f87bf194a3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100608, "uuid": "44abf16a-6425-486b-be9c-ce9a59406863", "value": "T1F8731755B8D18A17C5E423BBFA6E519D372523E8E2DB3207DC216F5033CA82F0DA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100608, "uuid": "9ddaf355-df36-4c94-b712-53d8007b63cd", "value": "1536:ZiqPHL3+rJruwElPc6bDXNPxPGLI0hxoLSopoY8LFt5Yy4d:Zi8HD+eqxsJ1gFbYy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688100608, "uuid": "d637dbda-1e60-4be7-bcaa-0685a6cd02d3", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688100608, "uuid": "5acf8250-cb27-420f-9a43-40f5fbf1e7af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100608, "uuid": "2f7aaa24-2daa-466d-8945-ef65de88ba42", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef803866-1751-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688135117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135117, "uuid": "6c219349-1144-439f-9b54-1d7b0e1aa2f6", "comment": "Malware payload (njrat)", "value": "ba36c9b8fec0735647e7984eb772aab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135117, "uuid": "8b58e941-fe98-4668-ae46-26087b35e771", "comment": "Malware payload (njrat)", "value": "035c9d1fee3d2358a7fac27279dffdda55d3508e1503d91cb2fb4babf5319d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135117, "uuid": "a6b92a92-5035-46ea-8b2c-366c5fbc2037", "comment": "Malware payload (njrat)", "value": "91a2d15a954439e122daa782078e1e6c573de2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135117, "uuid": "6b36f9fc-8d1c-45b8-b90c-4ab1579e3e2f", "comment": "Malware payload (njrat)", "value": "e09ad50c96b265d3a348995afa2578856981a2a7173399e8d4ee3e3cf0001c748bd093451e34d1a47df6ccb60c92d625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135117, "uuid": "95e0c3db-70ab-45ca-ad6a-1299aa020711", "value": "T100B3094DB7D83050D0BE25B399A2B1004E75B45B2607E34D4AE359BE2E376F48E84DEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135117, "uuid": "5be83077-d8d3-448a-92ab-d493e4600bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135117, "uuid": "38946b78-e66a-4e77-8846-b1b68b317002", "value": "1536:e1+4dMS6ZueRX9mHUxOM1GeYjP1aed/y4Y3Gv:e10S6ZmUcvbjAed/nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135117, "uuid": "7c64eeef-f06f-4022-833a-ecf7e8276f02", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135117, "uuid": "82d5449c-7c68-4e4f-8ced-2d1ac230ef88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135117, "uuid": "a0b5dc31-aad6-4159-a433-15e4678f7836", "value": "ba36c9b8fec0735647e7984eb772aab3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75162da3-1712-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688107853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107853, "uuid": "8e895e55-0c9b-4590-b263-767c222bec0b", "comment": "Malware payload (AgentTesla)", "value": "e172a8a100742f432e76f8e1c0d71ef0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107853, "uuid": "19882acb-6dd4-43f0-bfed-076ea3c7e3c2", "comment": "Malware payload (AgentTesla)", "value": "0375bf87521d9ea082df077582916def08dd985a24398b564724d31d0a6e40f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107853, "uuid": "474d6df5-4ebd-4a0d-902c-47845e5abe19", "comment": "Malware payload (AgentTesla)", "value": "7035ebcf3da91c35567be41dd4733dacb52f26e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107853, "uuid": "3189c188-11d8-40f6-8cac-fb62a979e154", "comment": "Malware payload (AgentTesla)", "value": "a5a72a4fe4549ca5a3eaecc119b5fae0614930464d418070896779c6e7b8d5dc5a282593e3276a7c24c91d6e948cc9c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107853, "uuid": "f1000088-b969-495e-aba5-5f18d4630a2d", "value": "T1CF158C3D2ABC5323C034D7B5CFD18323B220A92B3161DA766DC397964796E422AC757E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107853, "uuid": "8116bf30-8096-4a33-8d61-5cb2cbe8a845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107853, "uuid": "7adb1b95-7bc3-48b9-95b3-b069eb3d011c", "value": "12288:aFswItaHBlUHEAtmdnC7olOqZ5CIxrmZE1WsMUOuZsItfQ/a5AzDcZQ:UswItMaDmdnCkoeRmZYNFtRW8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688107853, "uuid": "f14eda42-11d4-466a-bcd4-1d0aca446c05", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688107853, "uuid": "400c2e94-a3d2-40d8-9495-b7b825f662c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107853, "uuid": "676ece75-3b93-401c-83c4-62518efe5e7d", "value": "Purchase Order for SK336.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093f9fdd-174d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1688133013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133013, "uuid": "37c00bfd-b655-4ce3-86ab-82528109057e", "comment": "Malware payload (RecordBreaker)", "value": "972abf3179291dfac99397b5ae996365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133013, "uuid": "d1366454-67be-41b9-94c4-481e5e1e463c", "comment": "Malware payload (RecordBreaker)", "value": "03e96c022c76316f6b1db47895edb89666072c1b7104b863a9d229ea74b2ef0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133013, "uuid": "eeee0458-b62a-48c0-852d-ad18238a4b24", "comment": "Malware payload (RecordBreaker)", "value": "8272904cb904a2c2103106023c039ee8515721e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133013, "uuid": "da11ea1c-e329-47d3-8bc8-1bd9ef935aef", "comment": "Malware payload (RecordBreaker)", "value": "a7d37a46bec9110f80a1e23fef160ae1ebe543b3b69327d1e8355e498c6b28ac3eb32c303a4953004c6f65a2aa3d79d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133013, "uuid": "f5111da8-3476-440f-9b51-d3c42e993e56", "value": "T17B056C6079C48177EDF230BA06ECB570056DB8F007156AC366CA0BFED7646C1BE3669A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133013, "uuid": "b5016e55-629a-4edc-aa58-906c66b6d2e6", "value": "0c2767651579865fc388772609a1d6d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133013, "uuid": "8dfa3d62-cb63-4386-ac5c-6d3249d9db0b", "value": "12288:I8v8SqEnVG0PmTh+kAUsdKI7iuNpH7K/:cfh+kfG7Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133013, "uuid": "a9306f28-8f83-4897-899b-047b0d8492db", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133013, "uuid": "93f224b4-c120-49d0-81b5-aaecd6322e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133013, "uuid": "8ff7c8a9-cffe-4e2f-8f4c-60e472a998f4", "value": "972abf3179291dfac99397b5ae996365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ed03f1-1717-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110128, "uuid": "9aeac730-f44d-4967-a013-7a358133b779", "comment": "Malware payload", "value": "2b526d611c1667c87b693474bb021af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110128, "uuid": "b6b6b5e2-56d2-4f78-ad03-4bbf84dfc42b", "comment": "Malware payload", "value": "05878b23337882b11bc1d0142f3e9b6608ed9ae5c7b6c336c5b1c4921171904d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110128, "uuid": "0f367785-6347-430d-92fd-0e4575e2f23a", "comment": "Malware payload", "value": "7b3f792573182a4fea65f73d707eaa8447c6cf95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110128, "uuid": "585481eb-1944-445d-86d0-4e81aa898dd8", "comment": "Malware payload", "value": "9d133097163350a2a4a75b231a2a00561fbebd5fd18e68d06e5c4c0ad035b71e717bf64005dfdde20bfe665b3723dcb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110128, "uuid": "980f9043-18d9-4f27-a5f0-472692567ea0", "value": "T1159412223591C033C06B6A742570D1616FB9B8B05B79E6CBBF94113D6FB21C09B793AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110128, "uuid": "ead34ece-6100-429c-9ae7-e4ec9226748d", "value": "7df7cd62d521a0373722870d17467bbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110128, "uuid": "fb31dba7-085f-4d0d-a7c4-325a5ada61d8", "value": "6144:5sSgwzcc7NRJ3dXsJSjQjZBwzM3pZA2isV+vb8L/UFfiNfh/Dlxa/V+EwzUhdX:Pgwzcal3WsjIZBh3pz+QAFfAZ/hxIwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110128, "uuid": "c4a72639-ded0-45c3-aabd-d8c3e9ccf50f", "value": 411985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110128, "uuid": "2a95883c-1ebf-4c1e-951b-2d4acc2fe606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110128, "uuid": "cc18fd04-b8bc-47dc-a86e-282c6ddf39b1", "value": "2b526d611c1667c87b693474bb021af4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fdd42d-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154369, "uuid": "e87256fa-54a7-4fe2-85fb-bd2d0ddde49b", "comment": "Malware payload", "value": "107e19edf19eeab1bcf4278e4c2e6046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154369, "uuid": "de63ac4f-b305-4f74-8255-ff3c9b4393af", "comment": "Malware payload", "value": "05999a0d0e1c377026f3b4226305de14445658c1d67a9aea5b893548352fb89e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154369, "uuid": "b79722b5-2db6-4976-9a36-ab706efa42dc", "comment": "Malware payload", "value": "5a0d934e40701f68942cffaca49d4af14f45943a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154369, "uuid": "2820c859-83b1-4c2d-91e8-b7f090096ab7", "comment": "Malware payload", "value": "901c0f40103d1edcc4a3df2414a9d61bc1684e06a0af00d05820cdf1e9a62a10be4f4d4b6ad622751b843a77e6c1318a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154369, "uuid": "5aef2fdb-0d71-465a-ab01-e7f52ec42452", "value": "T1947633BA0DC069E7C4589C76B221428FC8F4AEBB7A15E5571E1170F29E3270A3D5F8E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154369, "uuid": "77aa54e3-2b4b-4b00-9a92-0c83ea1bea83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154369, "uuid": "e57ff249-a938-4439-9302-54dbb95a63f7", "value": "196608:G0Ndo0wZsyG7tN166wmvNx/A3PLBfTDeLU4o4e:G/nG7tz69Wxo/LJTydo4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154369, "uuid": "e7bf44e1-ad90-4336-ac84-7eea6c581727", "value": 7590400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154369, "uuid": "7e418bc2-2688-482a-a582-beb92c332cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154369, "uuid": "9d3285ac-f1fb-409f-973b-bae5218c1b3c", "value": "SecuriteInfo.com.Win32.RATX-gen.18446.14076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1144f51-16fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688098478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098478, "uuid": "abee94f7-1852-40d7-a28b-eb31810f2804", "comment": "Malware payload (AgentTesla)", "value": "7c52031c4ed1a6922317bf2c668a3308", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098478, "uuid": "0eb24097-f46c-4501-888e-a8bbcf4d95e7", "comment": "Malware payload (AgentTesla)", "value": "05b00d0b9ac332ba8792e402dc7e5bd9dbb436166fa34a9e81d4a46316ea700d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098478, "uuid": "863bf3ba-75c2-4e8a-a812-f8ed61ad185f", "comment": "Malware payload (AgentTesla)", "value": "f9176f150925781a4410aa186f3876e77e927062", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098478, "uuid": "967e4d6b-4cce-4a77-85ea-209eb8fc75c6", "comment": "Malware payload (AgentTesla)", "value": "95c9d183f13b1eb51b2efef2973d2fcbe74f00642ab1c9ee80b0ce2f8cd7e5c4fabad1d6de0bf76047df511461d592a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098478, "uuid": "f49a8923-9914-42a1-aed0-5d2a182dbaf2", "value": "T13F4412A1B7F4C073D0560A362D7516A27BB7C82A04B5430F3710A755B95B182EA2FB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098478, "uuid": "8b3caf9b-b7d2-4948-8d61-12ccc7987086", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098478, "uuid": "e3077694-8388-43c6-a52a-bf157c8d4165", "value": "6144:vYa6lzmacpkwAMi9MrYraYWCTmi07wus57e+sWwxiVnRppz:vYfzmacWXMTiWCSLUwxUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688098478, "uuid": "f238df77-0817-42fd-b644-589fd3491300", "value": 274561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688098478, "uuid": "a5b76ce6-4f5d-456a-99b4-2e109defd55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098478, "uuid": "dbfbf9f3-e7d3-4df4-8d0e-e17445f4055d", "value": "7c52031c4ed1a6922317bf2c668a3308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd5ab2-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144848, "uuid": "0f06efc5-3145-42da-ae01-40a4539bd80f", "comment": "Malware payload", "value": "558a2088d2a628ce2501a895a6e25b77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144848, "uuid": "f0646813-ae54-4463-927e-7fbd0bff3714", "comment": "Malware payload", "value": "05b1e2966a6f675b964cac9df88d12da6f132da58e329b0985e2b1a510cb699a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144848, "uuid": "a5a8e865-c930-47db-8c5f-0d3644b5992f", "comment": "Malware payload", "value": "c4a858fd07d14550f0c03f3f1b29a7e383f18853", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144848, "uuid": "a0ed4725-2c4b-47a0-8118-930d1ed713c2", "comment": "Malware payload", "value": "b1e704d51201b9c8ff51b82fab1614b8d81424166ad4447c9854cd84282b3c8cb1fa68f7ea804591fcd67a433ef58584", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144848, "uuid": "adf34167-2fcd-4ee5-a93a-9037b7ba7daa", "value": "T1F1646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144848, "uuid": "ffd3c6d4-2595-422e-ac34-0088278cd364", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144848, "uuid": "da21c626-d3a1-438f-a86f-0f355d7c6572", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144848, "uuid": "2fcf5d67-bddb-4154-aee5-b59ae3ff9520", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144848, "uuid": "b58f9863-659b-4a06-89fc-77f2592c3752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144848, "uuid": "9a1dc1af-9b85-4f33-b075-be551ab3ac2d", "value": "75loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8fda14-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163081, "uuid": "30b2e13f-adec-4ca8-8002-64c502085617", "comment": "Malware payload (Mirai)", "value": "fcf40f49fd5b4f44e07a132fca308696", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163081, "uuid": "02581d14-24a7-4b30-9aef-f3a857a1f85b", "comment": "Malware payload (Mirai)", "value": "05fc50d10b58e4e73a046754561ea873ef4425391d7b4782c87729d3be56a280", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163081, "uuid": "0ecd1c84-4bcb-42f7-adad-5c60bcba534c", "comment": "Malware payload (Mirai)", "value": "7c4d6de40c3ca878a244133fe6a70c27d5b1bea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163081, "uuid": "1189ce57-8043-4631-8df2-63e69c5153d1", "comment": "Malware payload (Mirai)", "value": "9c3167802359a3371480965c99f4061e2da9285cc2e439d220bd5d732d48500274235387fb253569aac27e1504f99924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163081, "uuid": "597915ba-c595-48e4-b79d-279ed62de9c8", "value": "T19CD2E18976D3A2F68CCAC9BE720F5036309E74A9B2F29363B305C8434766140F682D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163081, "uuid": "eae88330-a4e6-485b-8310-70928114ffac", "value": "384:MSd/PxEDLd2TwM4zb6lowYcEaqsU9lcC450LQixBfE4jdlz0lewZ95okpduaNyV:llxKd294CxEnsU96IHE4RlY995okpcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163081, "uuid": "0ea88505-814f-4880-9f53-50f16886819f", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163081, "uuid": "391e4d35-cbcb-4705-85e3-68a212c41625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163081, "uuid": "2d35f43b-4b81-4103-88fe-a27f2b15ad88", "value": "fcf40f49fd5b4f44e07a132fca308696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440b1299-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140842, "uuid": "e9555263-5370-44ed-87bc-fe74122d97a9", "comment": "Malware payload (Mirai)", "value": "4185159c7ac49213dd5fa4223a657642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140842, "uuid": "cc926931-ab61-4eeb-b060-eb6ef72cd5e0", "comment": "Malware payload (Mirai)", "value": "0679e8f474044f16c9f30551780d03729884e13ce3bdf83ea357f3cd4ad6bf37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140842, "uuid": "8b464410-0abb-434e-9b76-99ed496efd52", "comment": "Malware payload (Mirai)", "value": "4bb8bf494d968e0c856b8349d26cb3c9aad7beb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140842, "uuid": "6a2fe681-b1a9-4c8e-a7fb-14b803c69085", "comment": "Malware payload (Mirai)", "value": "413aa8a4ddf06bb4c04e6c99cfdf33c5372a9647f0e375b39078affefbc8c2d28c8f31d6824624330e438b3edd6720c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140842, "uuid": "2b98c31a-95dc-4ec2-9bfb-7c5c15bff9d2", "value": "T151D2F0AC7985B5FBCCC98B79B61F507A304EB4AD72F28322B346C9435A5B140D922D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140842, "uuid": "2e22373e-2391-4b16-a230-c113b51e32e9", "value": "384:Mxd/PxEDLd2TwcMzP6lowYcEaqsY9WC4t0LomNw2XYyXhUErWTwde4WNy5:WlxKd2NMWxEnsY9OQNwqrr3335", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140842, "uuid": "068547f5-4903-47dd-815a-4a1a193763ab", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140842, "uuid": "e9e8d2bf-067c-4e61-899c-2284ad7b6e3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140842, "uuid": "08bf3a4d-500e-4e66-a3c3-7b67f1823701", "value": "4185159c7ac49213dd5fa4223a657642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc45bed-1748-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131171, "uuid": "8702ec7a-1d82-4b49-969c-ae03c0551a7a", "comment": "Malware payload (AgentTesla)", "value": "c4fa29679b755d26af1c0c5e98053206", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131171, "uuid": "98385f80-3651-42a3-b11d-f677c7350c00", "comment": "Malware payload (AgentTesla)", "value": "0725b0bb5b536502fd3a4593864bbf3b25dcacc3b3259162080909284c1348de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131171, "uuid": "38a53e62-0aa8-4954-adf9-7d14bc15ab48", "comment": "Malware payload (AgentTesla)", "value": "a742fede80f6db637a54ef39d801fbfd6dc93d31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131171, "uuid": "5c5f47d0-62b1-428a-9c3c-697923da116c", "comment": "Malware payload (AgentTesla)", "value": "d4a1940c6d6feca1cce4f6ee6536632c63789da76ca3c8523ddd8e91434426eca567231a358962290ecd3fee1ed87dee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131171, "uuid": "bbe0e036-48a6-45c8-bf12-4abf8560119b", "value": "T1DD25C724997E0912C074C3BDD6C1E32FAA9D4C9724219B321CC27FCE9F7A906159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131171, "uuid": "a4fa4c34-6ad4-410d-b0e2-5ab633f11ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131171, "uuid": "3dd06cc6-096a-4966-bb7c-f0993a4d213a", "value": "12288:ByBk76R4PyLSE6d0EMJa4y6s9HiGUrBcwk:ByulPypEMEWdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131171, "uuid": "4b952cac-5744-4f32-9efb-2912d310fd38", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131171, "uuid": "3d3f42ee-491b-490c-a7cd-babe1d5d5e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131171, "uuid": "24d744f7-d58d-4704-8cb9-d328effea2c4", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c8af55-1762-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688142021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142021, "uuid": "1465aae7-be5d-4735-97ce-274be16cd0be", "comment": "Malware payload (RedLineStealer)", "value": "71f45273e91f293ed6b1f97665b13bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142021, "uuid": "a23e82e9-e94b-4baa-af4b-10d4508a24a2", "comment": "Malware payload (RedLineStealer)", "value": "074269c39cb4bdaf98e922f4581808ea49eb164822afd6fed695b1dd240648e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142021, "uuid": "0fbc8d04-cdb7-4837-add7-ebd1d94a37f1", "comment": "Malware payload (RedLineStealer)", "value": "90b41cbf092afe08206a88c46cbbd9559b3f8890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142021, "uuid": "04d4a2af-9756-43c1-b118-9267582c86fe", "comment": "Malware payload (RedLineStealer)", "value": "ff9e4c34d200db6c6fd9568b6613d4018983dee0aceeffdd551ab7ef74c9202a79238c7e5fdc260f2b2c38cb94a1b718", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142021, "uuid": "c2975cee-d777-4227-b5bd-f5139c1d783e", "value": "T1E7C4E05176C104A2C7622E32A5A485A39D79FCE05FA446533F3857264EF22D0BEF0DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142021, "uuid": "d790b7c3-745d-41e2-bc03-bebb6c29dcab", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142021, "uuid": "4eba5f48-84db-4a66-a4c6-de06af758bad", "value": "12288:uo7Uku5hJ6UaS5MYBgAcF0VpT1fg0ebtFa5c70X5WAgQdQZ:uo7UZvdN5VGr0VpSTLa5c5Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142021, "uuid": "b971c6df-ac47-48d9-b49a-2c5b5ee08cf7", "value": 554816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142021, "uuid": "80bdb20b-e831-4644-8e55-1aaf6ca72088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142021, "uuid": "c56178e5-64fd-4ba2-8b77-1c8fb8fef4ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a78a815-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112560, "uuid": "caafcc00-75ef-4886-ae9f-129c051d05cf", "comment": "Malware payload (Mirai)", "value": "d62fdde4d180f4b71a27b59af440cde2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112560, "uuid": "ade3a270-76e2-4739-b208-5df921f78823", "comment": "Malware payload (Mirai)", "value": "081b0533c7ca49fe78ea865ed0cda72c6b40143e2641ec7e91d70fe1e428b8c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112560, "uuid": "76b52cff-4c48-4cd1-89a9-6621f75db7ae", "comment": "Malware payload (Mirai)", "value": "51cfe3e751419ba13d878978ef4eb28d505497bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112560, "uuid": "1ec64269-62f0-4d0d-99f1-cdc94e9e7caf", "comment": "Malware payload (Mirai)", "value": "d0b0df2cdc49a9d91cfd4f228cfac3a0158800222fdbcd2dcaec3b64152bfc86d2471508d2149833323b12884d76423f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112560, "uuid": "97485677-3feb-486b-8fb6-17746d6cce09", "value": "T11AB2D0CC61943084C98D7C7C678D4B664F6CA0D0BAEE9B26E350CD98B3BEA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112560, "uuid": "c2f2df20-eea1-48a5-ad28-93b49ce1d930", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpDjZqSWv0:4QlS07FUXqIYSXQKquD1qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112560, "uuid": "fafb5684-ea65-46c3-b27d-bcfb6c4acd52", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112560, "uuid": "8f5a0b5b-b49a-4916-b024-94ae458fd495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112560, "uuid": "7efab1bf-9b2c-443a-918a-f23726a0caac", "value": "d62fdde4d180f4b71a27b59af440cde2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e4a3b6-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144927, "uuid": "f1d8d3b1-3df9-426b-a17b-9115c98358a1", "comment": "Malware payload", "value": "46d7c1f57b383c1db534f5c1196d682e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144927, "uuid": "1b3c3cc7-12dc-438b-994b-f6ad8f059931", "comment": "Malware payload", "value": "08e362bf1810b2e4a97771b2890295d3c7dca17a112e0c82020e501d8fc6711d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144927, "uuid": "c5ffc07a-5b82-4c93-a61a-6c838d181958", "comment": "Malware payload", "value": "3bb95da83501824273efebb34b479ffe5fbbffbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144927, "uuid": "4a7b0273-f0d5-4a34-89cd-6f67e6eace02", "comment": "Malware payload", "value": "825569b107c1425ba7006b9e279e074bbc7b12bb74d37324dff5e63861edcd023deb5a2956be34dccfc2b45f974e7c19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144927, "uuid": "b400043d-3f82-47c3-94c6-39f328002df1", "value": "T114646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144927, "uuid": "a4828e60-ccb4-4d6e-8a6b-46d005b3edff", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144927, "uuid": "d035ce83-a911-415e-95b6-b193ea3faea4", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144927, "uuid": "caf0a273-c9b3-4ef4-b203-3b659485baee", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144927, "uuid": "143e98da-9b27-4082-83c3-c1d6d17cc0f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144927, "uuid": "60866dec-0fad-4a0f-aae7-8dd99213947e", "value": "88loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b0b52-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163103, "uuid": "8d6331bf-bcea-4916-80e5-2426014ff0ea", "comment": "Malware payload (Mirai)", "value": "4547fbb19b3dca28acedfeaa7bd47320", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163103, "uuid": "67e660ba-833f-4865-a552-a07f9e012eec", "comment": "Malware payload (Mirai)", "value": "095b345316a7582febe1f8fd610768a31f80e6528eef7f2239e34ec5d1a7200a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163103, "uuid": "1f415afb-eac2-4441-b4c5-e9457bdf0715", "comment": "Malware payload (Mirai)", "value": "561ce8ff463974bd12bf17551d074dfa3ca3955a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163103, "uuid": "1a341657-c0f2-40ee-9aec-5fba2326527b", "comment": "Malware payload (Mirai)", "value": "acd7f592e66bdc2ec629a6ad38bd0628057f95629e66caa40fbd128dd0543f7e7f5218990c5c7b69e3335884c411ff17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163103, "uuid": "d6c4b874-882a-42a6-b97c-69229c13802c", "value": "T1FE23F278D679E994C9F01172FB5D0C41AFE407FCE6AE2133323277546E3609225F9A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163103, "uuid": "1efc7395-be70-4253-90be-924d34c2ed18", "value": "768:6Ggv4mwTUDncmJQtx+6Qkqn07UBUilH5Joa+Q8R9q3UEL/dcaSfhLClovaIIJcqf:674m0g7c+kUQUC4CLcLlcnaBZI7Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163103, "uuid": "4034e147-86ff-464b-b736-1800771c8e98", "value": 48776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163103, "uuid": "0d4fe7e5-49f5-450e-907e-a2226fce16ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163103, "uuid": "30db8012-4da6-4d2a-bcd0-7ded7e159785", "value": "4547fbb19b3dca28acedfeaa7bd47320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1305d16e-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688108118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108118, "uuid": "336762fe-f60d-49bd-ae67-7539bd1b92ed", "comment": "Malware payload (DCRat)", "value": "73aa7bec86d93efd9b485944a2edebdc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108118, "uuid": "3db08b27-7703-4a0a-80cd-fc5cc4c09607", "comment": "Malware payload (DCRat)", "value": "0b187246743429e8b9e67b2041bccbd24875a9c39f903e6533db5e7a176c9417", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108118, "uuid": "3b90bca4-6171-40e7-bc49-11ce02219189", "comment": "Malware payload (DCRat)", "value": "b5020e1430528afac0ec9fffce91575e964decc7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108118, "uuid": "e13e8671-1a4f-4fc6-8e4b-fc74d1cb637c", "comment": "Malware payload (DCRat)", "value": "ce662ab104704b9fd049c5c0cb11b5463cfb7183309bf6982fc124c2b643644753fc2b9740c795f1d9fccd460db72762", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108118, "uuid": "93a21a52-45d4-4345-8906-b8d88d9aeee2", "value": "T13484E078579FDFC0E1B9E039F0EA9A2C07B144BB51469B762AA0B1F17DD6385462038F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108118, "uuid": "a8db8f2b-ff0d-4094-9f04-fc7124b510fb", "value": "6144:ov+lyqb7+w1xUTuWveoPSXYwCBCp2elDr5gt5Wo5RwUGX/eWwbX:ov+7b7+w1xUuWmoPYDCjA2t5WKzGX2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108118, "uuid": "ab2cac58-d678-4396-bb13-a97d09d20e67", "value": 371216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108118, "uuid": "3189dd5c-f203-40b2-92f0-3be464734402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108118, "uuid": "c07e57f1-7547-4fa6-a8b6-42e40c52677b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3acaf0-174d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688133314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133314, "uuid": "56621fe3-3b6b-43bf-a3aa-0bb24c4d06ff", "comment": "Malware payload (RedLineStealer)", "value": "2e8d304019c52d789a04dcd2116bb8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133314, "uuid": "bee9528c-5e75-4336-88ab-d4c6be9421b5", "comment": "Malware payload (RedLineStealer)", "value": "0b5f7c1ef438e6e7166c64a1ce4d750357427e7b5224f129d51402d8054d4578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133314, "uuid": "bbd4ef10-588e-4b9e-be74-c564a2ab1052", "comment": "Malware payload (RedLineStealer)", "value": "e4657ba14c62d3a1e20239090cab0e887f9778ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133314, "uuid": "b53fb96f-13bd-44e7-9b27-fa579310846d", "comment": "Malware payload (RedLineStealer)", "value": "70bc05fe33839807f4511618d97fff41903ba72dca8b9fec1b3cafc856007fc911dd2fd189e18be25b3cbe8d45f10626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133314, "uuid": "5959050c-aea2-449b-9bb6-8167f9ff7a13", "value": "T1AFF4F182B6D144A2D7212D32A9A08963ADB9FCE14F6185973F7C53350EB12D0BEF0D9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133314, "uuid": "e93b3bc3-9e43-4ab4-bdcb-aba23411db2b", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133314, "uuid": "f13e6135-5580-4d60-8276-12941a153cb0", "value": "12288:Fyj0dbhk6UaS5MYBgAcxVQWiasbJkJCO0wRE9vqqxQhv/YNv+Tja/vuqvVhUvGLL:FyjgSdN5VGyWfsbJYCOJRE9CqxQV/KvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133314, "uuid": "9d92ace8-4997-4e4a-aea4-662e4ac2e269", "value": 753984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133314, "uuid": "1e045a99-84db-4161-bfc8-05947c051f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133314, "uuid": "341b465b-5da9-41b0-a5a3-f853a95fffd7", "value": "2e8d304019c52d789a04dcd2116bb8f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe25d53-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111408, "uuid": "8b9c84e9-729a-49bb-80eb-b44aa340aa2b", "comment": "Malware payload (Mirai)", "value": "6605f06ba0529588c0ee5018a3f50998", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111408, "uuid": "d5200ecb-59c0-4b2a-bc68-c995339d8ae6", "comment": "Malware payload (Mirai)", "value": "0b7025b431a348a3d060f757aa8ec6e11bfe0bbf05fe046979d49575310764ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111408, "uuid": "0cc3610c-a9f7-497f-8778-6d32268187e1", "comment": "Malware payload (Mirai)", "value": "f4f2741187f52254d8f6379adbc62e2461cfef1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111408, "uuid": "89e6581d-991c-4fc8-9da8-14d502cc7feb", "comment": "Malware payload (Mirai)", "value": "3522fd855da542e9870002ddd513ac0c9ad52f238b5dbf105170ac7d5325f31be8f78d62729abc92604da2586eb8772c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111408, "uuid": "353e3829-547d-4e6e-a8c6-d754f97d48f4", "value": "T141A2E0257F2DE98FCC37B238C6E5E4C693D07C24D3DCC9866681C11BABA37846824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111408, "uuid": "827f57d3-9208-4ddc-9545-71b69ce8d636", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtVHSyp:O98o08kxofBE+ZkXaT47C2EpitVNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111408, "uuid": "d0fd7f2e-1b63-4ea4-8f6d-3d9c7cb29387", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111408, "uuid": "814098de-1af8-4f90-aedf-1b29ae8d070d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111408, "uuid": "7f46610c-2642-4bc9-9fa3-abb975eaac3d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11637833-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144193, "uuid": "22e04025-18be-4a46-a5d3-d2153c5236f7", "comment": "Malware payload", "value": "4f4a1c0582e76ea7836e15df07391bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144193, "uuid": "bd097cf8-c9f5-4bc7-b444-c60233d39fb8", "comment": "Malware payload", "value": "0bc099a8c737ad30b82d97b9dccab910e00c26da556b2f1d22e9a9c1e21e5bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144193, "uuid": "43e93448-a744-45bb-93c1-0b02ea0dfc0c", "comment": "Malware payload", "value": "a3ea920d005cc97c30b8ad85a4d73e3fae22a260", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144193, "uuid": "7bc6425e-54f2-47fa-ae21-57b02f19beb6", "comment": "Malware payload", "value": "5be4a1211d1ec63666fa847c1c014bba646c723785ff062390b38ac9b67505b539633076a8fde37902cface5d5c41d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144193, "uuid": "860e6a74-18af-4687-9f6b-da300ade249c", "value": "T199D6230C77588B1BED8F07BE93B2445487BDD205A08AA78F164DF6E5B8427D0D84CDAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144193, "uuid": "ce83e176-369c-43ae-94dc-6c769ab0b5c5", "value": "393216:fPo92wDILbfWhXpdOL7N7hX6IHTVdBxdQp:f+2wphXOLB7hqIznBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144193, "uuid": "8159970f-5b3c-4aa2-9152-726050edd42e", "value": 13729280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144193, "uuid": "f359d5c9-76d9-46e5-8d44-55cce994224e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144193, "uuid": "f4ed1739-1325-4c1d-93ce-024a8bb503ce", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.1578.6717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9d4db1-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1688110335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110335, "uuid": "b066b46a-cec8-4577-b9bd-6b813fea4675", "comment": "Malware payload (RustyStealer)", "value": "be8abeeb33e2c2ccc9d1f519a6adb2e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110335, "uuid": "609f1360-d464-4fc3-9db2-37b26e4027cf", "comment": "Malware payload (RustyStealer)", "value": "0bd18b1dd1786554fee71ab886a348c40e8f951e715613fd64198957e9b474c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110335, "uuid": "02cd1e0f-30a6-457a-b3b5-54fd8a2f13db", "comment": "Malware payload (RustyStealer)", "value": "159993c329b0d8c6da3dd1d99db236c280dd6392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110335, "uuid": "c7b48c00-cae9-4fe7-a6dd-6a7dcd0bb41f", "comment": "Malware payload (RustyStealer)", "value": "09e55e773226aca9cde6aaca1693e38e4d6a50c41e5cdfc4b5de12070a9da789fbb4c974dd1291e6713cbc62954626be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110335, "uuid": "4c87fa09-9ed4-48b6-8233-06742b1559e6", "value": "T1D8754912F69199EAC029C1B48257A232F6357C4D0725BBEB1BD4AB313E567C06F3D398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110335, "uuid": "573d12f7-8d45-4f4f-9cfc-52e3960ccf38", "value": "557d953bf697ff1355a8bba8036a3c6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110335, "uuid": "ba0f8454-8f2a-4d95-b2ce-561cc8cf2983", "value": "24576:Vd1inuNYw8vytGiR8FEHyuRz4DuCQ/FeDoQn652EOJprV:7AuNYw8vY5R8MzRCrSFeDfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110335, "uuid": "50a6fb21-b408-4c24-ae3b-7555dd3b93c5", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110335, "uuid": "e6a1e1ab-51da-4e71-8453-56d3532b8c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110335, "uuid": "6d4756a7-94ed-47f8-9710-045826767568", "value": "0bd18b1dd1786554fee71ab886a348c40e8f951e715613fd64198957e9b474c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b900c6-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688109567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109567, "uuid": "42e27cc6-f8b1-44b5-9a60-e0804357dac8", "comment": "Malware payload (Fabookie)", "value": "f74d45d99e85b18a48cd73cd714e5fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109567, "uuid": "4122daad-6d05-4c9b-8dca-63a7887cba33", "comment": "Malware payload (Fabookie)", "value": "0cc2b3468a498dd06a14fdad487821b7df44a37ff6d05a95e1b09e9afd1a3698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109567, "uuid": "c3ed1e88-01c2-475e-b960-8d6b13cac301", "comment": "Malware payload (Fabookie)", "value": "d11fef291a2d5341303043eaed1a71b11c75ddf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109567, "uuid": "7232dade-c7f3-4989-8e43-acee36ce9e13", "comment": "Malware payload (Fabookie)", "value": "1e2c82072730b691809bbcd0829ef34470eb72b87fbb44620c0040c332abf737265cffafd1f0845cf621acdc064fec6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109567, "uuid": "9a9ccaf4-b8e9-4170-b4d1-f9c4071cda57", "value": "T1C5544C0262AC7F61E5E14B3E9E3EF6EC761DB9504F19376E12385A2F15B11E3C262B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109567, "uuid": "13da797a-b8c5-4bc5-ab05-aa7fa516df42", "value": "0bd2f32677a0e93201a9419699247165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109567, "uuid": "9a6fe953-c57b-41c8-a082-605127c03029", "value": "3072:JAGiMY+pvNQSvFAVG9QOLM9GOeHT3vukGhcImXy9n5bGOIRKjb5JAJf1:W1SvFAVG9IBezfzGh3m0nJGOyCbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109567, "uuid": "a455a314-36b9-4519-a4eb-89b881a6d31a", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109567, "uuid": "a54f2cd8-3bde-490e-92d6-c4c698a0478d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109567, "uuid": "cacda817-ce65-4abe-a730-3e0473d5d8ba", "value": "f74d45d99e85b18a48cd73cd714e5fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5733d7c5-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112527, "uuid": "1271e07e-8daf-433d-a34b-a31614b76f97", "comment": "Malware payload (Mirai)", "value": "4db07c98b25bde0d35ccea45caf88adb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112527, "uuid": "ebb2e9d7-b302-4828-ab83-e6791ec8a322", "comment": "Malware payload (Mirai)", "value": "0d06a848063f7a9af47d703620470ba7dd9806a74c8fb458cd8abde39427ad5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112527, "uuid": "bef3534f-4165-4178-b4bf-5b41ea2aa25a", "comment": "Malware payload (Mirai)", "value": "e96c608543fd85190b32c77a9fb53fe3e814e71e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112527, "uuid": "5247a782-3e53-43c5-9496-af2ab9a6ac14", "comment": "Malware payload (Mirai)", "value": "8822711df884f87810a5df8da4b45ccb3afe359d2f1473c6bbd1bae7eede2930c8a503a7ae53d3fed52976ed6e3ec99f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112527, "uuid": "74fce7af-c068-405e-984a-c42d8f6ca16d", "value": "T1F903F132A75BE030E77628369C7D40467D191DBC33FC242322062B06D1A6ACAEE7D559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112527, "uuid": "cec906bb-4d20-462f-8377-dc0dfc78e479", "value": "768:Hc6XdZPy1Gi0Wv/YraMzk+eXT1qZCNdNZDcKRA81T9mEtDV1de9q3UEL/c:HcsfP6/dnYuM/eMCNFp95FDV1hLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112527, "uuid": "38eb5d17-7b01-463a-9ed3-5eb090b0c2b9", "value": 38860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112527, "uuid": "ed91c5f9-3bf8-4284-85a5-42efe171e309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112527, "uuid": "9053b43a-5798-4546-9b4e-c9f59be35169", "value": "4db07c98b25bde0d35ccea45caf88adb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892243b1-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135804, "uuid": "0c658077-1aa7-4c66-9905-a6c12d2f1bc0", "comment": "Malware payload", "value": "d21539ac1020cabaeacdb16f7fafa54d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135804, "uuid": "f964236b-5bd0-4870-87af-6159f95ee666", "comment": "Malware payload", "value": "0d451dba3ecef56eddff063728cc65d2eb4ed304356de133f7a0d6be56456737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135804, "uuid": "a29fdb52-2326-4878-83aa-a6e73473fe34", "comment": "Malware payload", "value": "86b93da51985a48ada9fe6349b526fd96c70670e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135804, "uuid": "8d3d5b23-49c1-410b-a751-bb6428181a95", "comment": "Malware payload", "value": "498ee97fb2bb563cea0e2ffd23af96f61c8f38d8eb860197b5713784439272aa30d087f5a7f53df98219f2b237778d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135804, "uuid": "d3c02acf-42e5-4183-a6ab-86a9c21baa95", "value": "T148A50846E7BA40E5E6BAD0388512712AFCB138558734A7DB97409B0B5F32BE4DE7E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135804, "uuid": "67e8d28b-87d9-4deb-b710-577548975ff7", "value": "391ad8d3fec551a581dd175fde5ff8d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135804, "uuid": "d69d6297-9d0b-49b2-93a1-351898741e85", "value": "24576:qu0gaEnNshV0mqJShHP+R7xdH2fcpSa/rhcb87jkQVkIQcY9ZEyzhyzO:qJCyhGHSB+hxdWfCSatcg7uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135804, "uuid": "31dc833b-c2a4-4c3c-9531-7ea5ab97e463", "value": 2252464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135804, "uuid": "c63b15e3-ce81-49b0-a864-b939320570f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135804, "uuid": "df09f6fe-d294-44c2-ae24-391ee634c23e", "value": "2023.06.30#h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae98c21-179a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688166167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166167, "uuid": "2ea1ff31-48a3-4fe6-a8ac-64d61ef2e0fe", "comment": "Malware payload (RedLineStealer)", "value": "3de3c62bf07b3cc5179139b99378ce6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166167, "uuid": "440f3475-0249-429c-b9b8-ae407c66da91", "comment": "Malware payload (RedLineStealer)", "value": "0d54588e48365697954a0fac19f92008e11d001917bfda7eb93e5984322cd60a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166167, "uuid": "11d33dd7-08df-4bf4-82e9-3107f7968a0b", "comment": "Malware payload (RedLineStealer)", "value": "4e50f0ff525c1f302767136f4b83a019e34cc37a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166167, "uuid": "695d15db-21d6-4036-9dd3-013337ddb535", "comment": "Malware payload (RedLineStealer)", "value": "45693ed9f7143d87a925977906f3421f610df5f6eab18db65a7689846622167819907293eb11680771f009ac71e5d064", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166167, "uuid": "30b1919b-53b7-41e5-a409-cb45f6efa88a", "value": "T141A35D2067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC164E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166167, "uuid": "ccdd0547-07d9-4ff3-9456-f34711c4a1e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166167, "uuid": "a101b5cf-54dc-4d0c-b44e-5364a070f31a", "value": "1536:tqsMrq9oOlbG6jejoigIn43Ywzi0Zb78ivombfexv0ujXyyed2PteulgS6p5:b2CoGYn+zi0ZbYe1g0ujyzdz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688166167, "uuid": "5d1c3ab0-e687-4f97-b073-a12c15b57107", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688166167, "uuid": "762138f0-434a-4c07-95ba-d8e93c536012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166167, "uuid": "39195dd6-8c24-41dd-b598-bc921ef82846", "value": "3de3c62bf07b3cc5179139b99378ce6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6470b1a2-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1688135742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135742, "uuid": "79c22999-79d9-4812-bd20-a65e98740e6b", "comment": "Malware payload (Gh0stRAT)", "value": "71d7069f62819cdfb7c5e9f22fa4881a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135742, "uuid": "c1ce4052-9106-4caa-b219-3f9ef32a69dd", "comment": "Malware payload (Gh0stRAT)", "value": "0d58fbd6dca8e4428ffcd163c68f32dffb2e614ce0c45c9a0eb30dda43a0643e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135742, "uuid": "30df07e7-d4ad-4a02-9bae-b7fa51780347", "comment": "Malware payload (Gh0stRAT)", "value": "984f3237d69e9ed410a90a14a8689235f91ed6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135742, "uuid": "9291d1a7-b1a7-418d-8fb6-77160b7dbc6a", "comment": "Malware payload (Gh0stRAT)", "value": "03a2015a197947b2bc31357a32a632a8b613a48d7d2659dd85c44a4d989bc9339dc1237af7c1317cbcfdca0e494ce954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135742, "uuid": "26753408-0a57-4d24-9f0f-592681820da1", "value": "T1DBB57D2239418077D2626F32DE5D63FDA5ADAD200F3972C756903E392EB05C2953DE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135742, "uuid": "5e64bc36-3af7-4016-baa1-6db3a9da1308", "value": "d375f1b273822630c9aa8e9acb1e749a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135742, "uuid": "a0a5aba0-e04d-4dce-8ba0-888137636815", "value": "49152:K0n+AoM2lG9PiYTe1glkos4vGg/x1FnlcjhBUsK2bH50bcrrqnNlO5TPyv:K63P9PZTe1glkcP/x1FnlcjhKsK4ckr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135742, "uuid": "593f69ef-577c-4abf-af7f-77017a4ee2de", "value": 2342400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135742, "uuid": "53c47438-2b8c-4b99-9cac-2a6e5a511b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135742, "uuid": "b0992fb7-f465-43b1-bc85-7068ba9413cb", "value": "\u7b2c\u4e09\u5929\u804a\u5929\u5185\u5bb9x2.2t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba68053-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144157, "uuid": "3cd1920a-ebd0-4f2f-a17f-e2cb853967ce", "comment": "Malware payload", "value": "0ddb686798e1232b6066a00db2b25e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144157, "uuid": "8b9a9775-38c9-4265-b5ce-4d313d691e0e", "comment": "Malware payload", "value": "0d5a17d3f0689e944a37bf9424e19493280b77c4014cbd3d1c491977fffdf869", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144157, "uuid": "6886b3ec-f9aa-43b1-abcf-397acca4a268", "comment": "Malware payload", "value": "1ec1042497fb368cf25b3be5da4ceb36c5adf4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144157, "uuid": "21d66388-24ad-49e9-98b6-2e875a0c1be6", "comment": "Malware payload", "value": "2f85126d0b7bf57fae7169d0f6b9c42f06dc74adde2b0d18a919e9c34acdf4cb12a76dcccfd2391301319e16045e5df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144157, "uuid": "2998b799-a13a-43b0-bdc7-e46650554186", "value": "T132E6237B678CDAB5ED9FA6BBE012525287A2C00BA37FB3CD2E48D6F156C6750C804153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144157, "uuid": "d74129cd-1fb1-4012-b47a-9c4a2b9f27bf", "value": "393216:4HD/VQHnuC0KPxcGTjAAc3+xMO9anZ6SzU4wtfMRKpBt:4j/VGTjcuwZ6OufMRgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144157, "uuid": "ac37f6aa-d3d4-4c5f-a3c4-4a861ecb1327", "value": 15065088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144157, "uuid": "5ad5d145-459d-42f9-a2a7-f22985c04972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144157, "uuid": "45727aad-c935-4c0e-932f-620f247b41a5", "value": "SecuriteInfo.com.Trojan-Spy.FormBook.26491.8044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4d08b8-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1688108399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108399, "uuid": "8c1db2d9-d223-453c-bb5f-8b2a45057122", "comment": "Malware payload (StrelaStealer)", "value": "f395b6c26df46b7e685f66cc5a747491", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108399, "uuid": "df5c9a67-145f-4a23-8590-ee2161cfaf8c", "comment": "Malware payload (StrelaStealer)", "value": "0de7ed8beadf12802371836c4d1de99dcdc6708058e2668c3604ff583dce9413", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108399, "uuid": "ee4c3fd0-4922-480b-825a-a737b7540710", "comment": "Malware payload (StrelaStealer)", "value": "de18f42a780c5778bc1c8e063c8018ebac34ea0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108399, "uuid": "d3138d1c-c56f-432f-b8e1-4c993b39439d", "comment": "Malware payload (StrelaStealer)", "value": "af2ff4b4185d3d32a4e1edeb4c3fc8d8cf1365ef58b683333a599815a807d359b3fc3ba07ca2dd8d703a474583e89764", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108399, "uuid": "c696ea01-03ee-4a71-b715-9b005d8b8805", "value": "T13825FF4954A8130EC2323BEEAB6D34D2C3749A1776F4CAE3859DB7A2DD5DC368B70424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108399, "uuid": "a6828b3a-31ea-4240-a170-ac29823be73f", "value": "12288:ItO2t/vLNeB4omX/hRqX/u9ZyHA/KCYydB:ONVA/u9jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108399, "uuid": "64a82eaa-7533-4968-99f6-0fbbf77df4e7", "value": 991845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108399, "uuid": "c2f250cb-8b96-4882-b5bb-049f9abd2df8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108399, "uuid": "2aee905e-d922-4035-9910-c83c817e7849", "value": "bs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1e0b2f-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144127, "uuid": "7f1a86c2-ebc8-4240-935a-bf284187ab9c", "comment": "Malware payload", "value": "aa17b659e26004551b88fedc2610d998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144127, "uuid": "42f81fcb-d55a-4520-9352-7543e92efd87", "comment": "Malware payload", "value": "0de84d2c3df71303041cb06398e407086407f18d91ec12969c68d7a324146c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144127, "uuid": "4967a348-08c9-4423-ae09-0f94e7aca730", "comment": "Malware payload", "value": "046f87d0d7a8f5cfde3309cb8716d113510af245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144127, "uuid": "c7b9dc83-0383-4cc9-a2fd-dabca11dfe5c", "comment": "Malware payload", "value": "40436b039f6f76db750a09888ebff390f9d14000da36fb9610cd6b6504178c4088efe2c80e8f50917c5e027647b591bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144127, "uuid": "3ff12914-75c6-462d-b8d5-fbbeb10abc00", "value": "T1A0A633B2B86EE44FC0C87A3E90E4A812DE5B4E3ADC57CCC6454CCC1D5846964E6AE3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144127, "uuid": "1d155a65-529d-486a-aa93-1e15b0231a7d", "value": "196608:NtQPIYspqUmec+PHEyIUXd1KIXGoAPqVYyOMCjllsx1HBWIkrVfVhG:DaIYEdzTHc01KLPuqMgbu1HBRuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144127, "uuid": "6e521817-b8c6-4de6-9abe-b48bfdb97390", "value": 9590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144127, "uuid": "b4170426-28e6-4e71-8184-66973b46d05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144127, "uuid": "95497967-3ee7-422d-a602-a59f8bea328b", "value": "SecuriteInfo.com.Win64.DropperX-gen.12647.32571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20145bf9-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688108999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108999, "uuid": "c1a124c9-33c4-4eef-b7f4-3d47517ba227", "comment": "Malware payload (SnakeKeylogger)", "value": "a30114eb3c4ab0a71af0e9f9d0cbf9a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108999, "uuid": "d79e09a2-9a78-4a11-bdf9-8220456be5ac", "comment": "Malware payload (SnakeKeylogger)", "value": "0dfed6a80612475d64b34d2c0264f41ee06da61747fd3086786bcbc61212daf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108999, "uuid": "403a37d7-7e40-4662-bdfd-336fa9c2bff4", "comment": "Malware payload (SnakeKeylogger)", "value": "43745b5b2ce6e2d3267ab9e59c3428585119f94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108999, "uuid": "311ea883-1c77-4ebb-bcbd-bf893354b3ff", "comment": "Malware payload (SnakeKeylogger)", "value": "925159e8e29cd77e0a0c86a47366a7cf168b0a7aee7843e3ff2da1eab43be737e97b02747dcadf7920bf5cf91171ce18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108999, "uuid": "8a887172-a277-43ad-b155-965f58dc9770", "value": "T18AC4583D1CBE2A37C175EAB98FE48463F454843F39225936A0D787618716EA365C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108999, "uuid": "9fedfcf8-eab7-42f7-a4e8-60cc62ac969a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108999, "uuid": "ac2a8044-156e-41d8-ae06-7ff4e493571a", "value": "12288:ht2iNm4d6s/z40mYCW25W3H9oVlvZ9htVqECEMB:ht1cUk01Cf5W32rVqEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108999, "uuid": "fe176091-0ee6-492d-aeab-d5efa360e80e", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108999, "uuid": "b0cbc7f4-379c-4ff0-a65f-62f9df6be6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108999, "uuid": "4d6aa609-d42a-4b92-9b82-74a9014e4088", "value": "a30114eb3c4ab0a71af0e9f9d0cbf9a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf77e7aa-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688111011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111011, "uuid": "ace55aec-c7bb-45a1-a7b2-d1bcc95cb406", "comment": "Malware payload (Fabookie)", "value": "93f51844050a75caba282635624d9cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111011, "uuid": "5a8fa20a-3dcc-4661-a5de-b1cd42d2b682", "comment": "Malware payload (Fabookie)", "value": "0f01971fcbe3a469d0bc8b09743a765696ebe8a6a8fa0166c39cef761105be92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111011, "uuid": "965e26fe-0e35-4bc8-a3df-c37e0397ace3", "comment": "Malware payload (Fabookie)", "value": "8149aeab53a7344c0c27bf66f56440701e279048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111011, "uuid": "d82b3518-0f7e-4e15-ba80-13dfb61faa1b", "comment": "Malware payload (Fabookie)", "value": "edd7c7fdec487c33094bef44d9dce9b2942d587f443a1f7b3630f7b4be59606a58e6ffd4dfd0c71c7f4328f6c643057a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111011, "uuid": "4def3b71-e7a1-43d6-a697-d1becc6c0583", "value": "T171647C56F36440B7E1528035C593EBB2F6B27C562B20134F1790FB7A2F336626E29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111011, "uuid": "fed61d58-2d6a-452b-a4ee-212575b2e76b", "value": "02a84429b024f8e8b499d5d5730c3f0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111011, "uuid": "ed563f7a-7681-4d7a-970f-8e553a8ac36b", "value": "6144:S/ji2HtZcrWFoWdN46Vd6VWxtoloBj5rbx:CNZcyNdN9VsVJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111011, "uuid": "23771ce1-c6c8-418b-84c1-5b24857bdd1a", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111011, "uuid": "6cc5283d-62f9-43fb-95c2-2602c677b428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111011, "uuid": "624866a9-c932-4d1a-ba51-c89c112451e7", "value": "93f51844050a75caba282635624d9cb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccc7f8d-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144132, "uuid": "1d760788-6cbe-42e9-9f3e-6d00c1513fb9", "comment": "Malware payload", "value": "b27f35e19c233389e2d5cf24c233f856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144132, "uuid": "3db67222-e295-48d1-bd18-1cf926f9633c", "comment": "Malware payload", "value": "0f0760eb43d1a3ed16b4842b25674e4d6d1239766243bac1d4c19341bb37d5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144132, "uuid": "802f1c67-61d4-4c96-9f0d-0c45745bedad", "comment": "Malware payload", "value": "9086bb7ec3b45aa859471b8d6313c11fb76e56e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144132, "uuid": "202455e9-f6ff-4540-ba58-abde711e9763", "comment": "Malware payload", "value": "ac199714395d67a616690210593a3777ba15a9f2afe4e95d97b0ea6ba5823d0efa0c8337edf76fa0502a88cf5217b157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144132, "uuid": "6b2def3a-4586-4be5-a030-5ad7e13692aa", "value": "T165D62208B3549A27E68F47BEE3B2405883FDD546A08ABB8E074CA5E65983350DD4DCF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144132, "uuid": "2dd553d0-6ae9-4b63-a575-6fa7b1553750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144132, "uuid": "983a73a5-4238-4571-82df-9172adf6d54a", "value": "393216:YtuiXkhs+y0gOWD46hgJb/HLRNh0QmmdPP4N:YtSsO0hgJb1N6mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144132, "uuid": "1d93563b-46d9-48d3-8e1e-60d89fae5607", "value": 12775424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144132, "uuid": "6c008398-f1f0-4a17-b69d-f3a2d05f3b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144132, "uuid": "c6933fb1-4c0c-4cac-8763-769c6af808d8", "value": "SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.29501.13447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad62c246-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159487, "uuid": "eed44ba8-29d4-4818-90c6-edd7e1e57047", "comment": "Malware payload (Mirai)", "value": "4801b6734753ed289cf897a0ebfd569d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159487, "uuid": "85a7ef13-d79b-4c67-a585-23552561161f", "comment": "Malware payload (Mirai)", "value": "0f09c671891f388fc524a3e2c3ea32ac451e6a55bce691259f8a9ea2380f642b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159487, "uuid": "1a02b42b-6ab2-463a-b7ec-9e10e3ce89fe", "comment": "Malware payload (Mirai)", "value": "7a3aabbac05acf59399a79c9cae767558a4da11d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159487, "uuid": "06290bae-61a4-4d71-8cf9-675021fd7be1", "comment": "Malware payload (Mirai)", "value": "3a93ced6bbe1eb712f9e5be77963624131bb25316c6dd4421ec7e8bdd704c53f75a226fb4f121285302176c78ecb03ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159487, "uuid": "82295d5c-3bea-46eb-ba35-5ad7e71de0b8", "value": "T1A2333ADAB902AD7DF99FE6BE80124E0AB23023541053073777ABFCD37E321549956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159487, "uuid": "bd30a220-f71f-4819-9806-06cf1fe6161d", "value": "768:BZe8Gf/lkgIqAGTm3ftQ6pJBgFHep/uPWef/pKWgJTYLauH80K+:fQfGg1JTFep2PpJKWgJcLas80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159487, "uuid": "f3e85a9c-628c-4fdd-ad27-935bac313c88", "value": 53116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159487, "uuid": "a3bb13ab-7210-4a58-b588-346aae14991b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159487, "uuid": "bad7244e-b542-4eb5-b902-4b5fd6a10767", "value": "4801b6734753ed289cf897a0ebfd569d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a442e05-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688108318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108318, "uuid": "30d9d4a2-e839-48c0-84b9-853f433dfff0", "comment": "Malware payload (RedLineStealer)", "value": "5d2deeedeeaf80b37e59c4e36cb578df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108318, "uuid": "85df310e-1abe-47f4-87db-024ec7ef4cb4", "comment": "Malware payload (RedLineStealer)", "value": "0f56b599e1d6542ca624e7128e743c9d06c5e455ad7ffff8ad97e0ff8cc9ddd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108318, "uuid": "7e171c62-efdb-4c7f-a52b-0e02b733572b", "comment": "Malware payload (RedLineStealer)", "value": "97b963df961982be8641928ddd4083c5391cc3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108318, "uuid": "19cc62e0-ba02-47f9-b991-2565796ea9a5", "comment": "Malware payload (RedLineStealer)", "value": "d1c24e8392b7c87180dec850c80f73d2ba4e628f557d2139802262ee0a297ed50cf171b0af1de3a123f0825d2a8c0dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108318, "uuid": "d24f4f8f-34a8-4bbb-a51a-1647b281b14d", "value": "T143544A213E1ED7DAE8E6D9B2CABEBBB6F05A0DD161B0F387178541EDC904192813D2C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108318, "uuid": "eecfc959-58f1-49af-970c-cea092ae301f", "value": "bb1d8bfc6c51ca02a6f390c720552f6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108318, "uuid": "c4870e42-ce66-44eb-90ec-feaeda968cf4", "value": "6144:HogMLD2PFZM3bsmci25sndkzOYFwKBbvoEo+ciVh+d76u578C1A1EofDdxpHSqSi:HCD2PFZwLiVhc6uuEABLdb+jWrtJw7E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108318, "uuid": "9e6cdf92-f961-4139-bfa6-29a950c3a3c5", "value": 281224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108318, "uuid": "b422dfbb-2549-48f4-abb1-79b49299ebd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108318, "uuid": "4f1eb8eb-561d-4343-8043-b0120832d52f", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4db247f-1799-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688165915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165915, "uuid": "6ecb31e3-cc05-4d76-a760-4253fdfd478c", "comment": "Malware payload (RedLineStealer)", "value": "89ebbc1da20269159e8eedc03642fdfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165915, "uuid": "93c27a27-f14a-4ec7-a5da-8dd356711178", "comment": "Malware payload (RedLineStealer)", "value": "105b4d12c4e131b71a04802d0874f8095f90c7ca76eac54d47e4061da6cbabd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165915, "uuid": "a0cff225-6afa-4745-9c5c-bc569d870a08", "comment": "Malware payload (RedLineStealer)", "value": "514e3364773ac6bd3a534b4074e0fe72c62eb781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165915, "uuid": "6c4eba6b-0a03-4a5d-b040-e695b8fa9263", "comment": "Malware payload (RedLineStealer)", "value": "6ee889dbfe4e03347bee156d0ca6dcd5327f06ce504cfc33a3a8f00d79991a73fb0a9bbc21227c93293ad3f93e69750e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165915, "uuid": "ea824cb6-6eee-4f89-a6ce-86fc5360285e", "value": "T18A849E4392E17EF4D92A4B36EF1FCAE8B60DF5544E487B2622189E1F00B9072D673319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165915, "uuid": "78520cc8-e9ab-4080-bb32-fcc1856dc49c", "value": "e01beb805c20903e324ef65e741d0209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165915, "uuid": "46e44e7b-5b6b-4210-9f1c-a43b364d28d8", "value": "6144:JSBC8yNeIL1AYhXFMyw3oajYINc0Qm34naWzyT:JS88Ja1AbHjYIa0Qm3QaWzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688165915, "uuid": "5b5caf3c-af8d-4afd-8b06-8704d57bfd4e", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688165915, "uuid": "50a21f35-d087-4633-be62-8b061379c1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165915, "uuid": "e5f956f6-fb4d-4fc7-a9d6-f87189e8d119", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea2360-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Phonk)", "timestamp": 1688110289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110289, "uuid": "5f61c686-63d2-4f24-8623-f5c39f984abf", "comment": "Malware payload (Phonk)", "value": "183831e9803b295f0e35d0ab8bb187e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110289, "uuid": "04ddd928-42d8-41ae-877c-8af51ba2ac0e", "comment": "Malware payload (Phonk)", "value": "106dbb50c553bbf2fc3e5e31443cb8d78b97f1e1a7ba07dc1e0bc1b29beb7f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110289, "uuid": "12b8cc7b-2b82-4bde-b426-b3973ea66949", "comment": "Malware payload (Phonk)", "value": "72b67ff075c715d1511294a9394b67b3f56b2ce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110289, "uuid": "fc88f5a5-577b-4cad-a615-03ccabd2a394", "comment": "Malware payload (Phonk)", "value": "8a0b6794eb285d5d2c55380ea521a6cc1d258c20b89f2bc09063a339d84aeeee2fe139563f654061817a769c5a276022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110289, "uuid": "8f233976-5f50-4b76-99ae-2a0809d56101", "value": "T10E65275839421866CE5E13F2DA770A081F90855B4F45E9AC3AD3A7CF972C2E3E9CD18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110289, "uuid": "e1f2c17b-4bfe-4886-82f9-b71d7aedd566", "value": "24576:t73hjGhqJQIqKFtAfmtqPUrPocW6gMz/i:tVvpqPUEogMz/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110289, "uuid": "c12bb506-09ab-4500-a1e6-f2605c4c35a7", "value": 1418008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110289, "uuid": "6d7947c4-621a-4cd9-8049-d5267ccdfcf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110289, "uuid": "95f12f8a-b67c-4025-892f-a0fbc6d5b8f6", "value": "183831e9803b295f0e35d0ab8bb187e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a1778c-16db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1688084051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688084051, "uuid": "269b68f4-3640-4585-ba65-58ebbd0ccd89", "comment": "Malware payload (SystemBC)", "value": "0168ca4a89a13c8b48f97edcd8c32165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688084051, "uuid": "b3066aa5-b6dc-4498-95d8-356be62a2918", "comment": "Malware payload (SystemBC)", "value": "10f2b39f63da35827e667f29e2b69524079e06e454160dee4c28636fffcce199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688084051, "uuid": "73a4c212-758a-47f1-b7cc-f7be80af2185", "comment": "Malware payload (SystemBC)", "value": "8f7c8396abe6dc8cf3d96dcefdcb208bebdc2852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688084051, "uuid": "d4440c89-391d-475b-920a-ad109335197e", "comment": "Malware payload (SystemBC)", "value": "c4ade74a2ea54e68bf1c4e548e4c260d0e1cae7a6644cf9ae1ef6a884d30924b7c8172b8d453ba64c3c03eda9c0d093d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688084051, "uuid": "018a13e6-87bd-4adb-a90b-f6e949ae8aa6", "value": "T123064AEB28E9217ED399C4F7C0E0B82F4B4FB2779615E48392E52175C9138A03E56F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688084051, "uuid": "7332e05b-2c95-4d2a-b9ec-74883704970e", "value": "7e60c38086d25d57354ecdf04c4b17ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688084051, "uuid": "629af674-fb98-4143-a6a1-c62e2d59958b", "value": "49152:jjjH4ZOXhVNeJBCDRTJ+j6ErUCBOU9EUSqVLsGC8egyQVTlFvqCBfZKQO9NPe5Ie:l8BcNYjnJLnC8egyQVPNZwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688084051, "uuid": "3aad69bd-b172-41e9-99de-f12d819f3d11", "value": 3908496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688084051, "uuid": "00dbaf1f-16ef-4422-a089-732807058198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688084051, "uuid": "8d7e4caa-7ed1-460d-9ee3-9cd5b192f693", "value": "SecuriteInfo.com.Win64.Evo-gen.13120.810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9376db-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140861, "uuid": "aa860e6d-f8f4-4d4d-9b4d-dcef8f1b31db", "comment": "Malware payload (Mirai)", "value": "c8a0c511ddf6f04d73f7095bf619bd40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140861, "uuid": "81a90a11-3c40-471f-a69d-db1a8e28cafa", "comment": "Malware payload (Mirai)", "value": "12b069d2ee1aa480f2fe9c9983dafb3633f6d99ea7c1971498a7acd18e9ca5f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140861, "uuid": "b01257c1-978b-4261-9c7c-09a0e457a809", "comment": "Malware payload (Mirai)", "value": "4c7eac77db7cd3d6cc87736d9399c45d6bdc2390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140861, "uuid": "28c55c3c-3461-4c73-a03b-26ab01e80e94", "comment": "Malware payload (Mirai)", "value": "815906b17d600357c646968cb1294faf16b41478046af367dcd304efea49f2dcef17f1310b66df3fa41588f214597263", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140861, "uuid": "97c4ec63-b30c-4992-8cee-4e1d8a6c4a54", "value": "T17DC2D0E6F55D5E46C7FF94B32E91CFA073D52F08B634C8EA6405F722162D921AA02EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140861, "uuid": "13b20e52-ebdf-43df-adf7-196e0ebc0f77", "value": "768:1qMkNa3MeiQoOX1UO5sHLSS14uVcqgw09o:agMetbX1UO2H+q4u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140861, "uuid": "a937a27e-370b-4343-97f1-f93a2c0b15e6", "value": 27056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140861, "uuid": "92007faf-75b5-448e-95c9-ba40f46e9d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140861, "uuid": "6a36b017-b77f-479a-be71-1226b7b48f5b", "value": "c8a0c511ddf6f04d73f7095bf619bd40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc605682-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688137205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137205, "uuid": "88fda23f-0ee0-4f12-92ae-51cb0123c036", "comment": "Malware payload (Mirai)", "value": "5ec56e92c2987a6250cc3fed32c49f9a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137205, "uuid": "c1d4028c-d7bc-4dc2-90c3-c5e10543c6e3", "comment": "Malware payload (Mirai)", "value": "12badb4d37a6e699f137c40ec1609b093d29e88d289f3b7b34416454c1018d3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137205, "uuid": "a04ca56d-833e-438b-94cd-5df7365e9dea", "comment": "Malware payload (Mirai)", "value": "1e8e18ca1224d88a529a0d5d5da938e31d497686", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137205, "uuid": "c3bbe6a5-f56c-495f-b6c5-31435bfc89ea", "comment": "Malware payload (Mirai)", "value": "0fdc10f26d817348a64d6701d701186d4767fa52850130a82e5216c2ab0203763d97477d9d27853ac686ff0c970384b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137205, "uuid": "1d9a0b2a-406d-44be-ac19-fde9bfe0ea4f", "value": "T18AD35C46EA418E03C4C61775BAAF418D3322A755F3DB73068E186FB43F86B6E4E67106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137205, "uuid": "95dd7d79-af85-4145-9582-fd679e276d31", "value": "3072:7q6kTgG9C2rrF95hGfAF2rcJuIzl+aN3HM/9J6mC:WdgGVrF9ufAF2rcQIMaNXM/9J6mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137205, "uuid": "41693788-4bdf-4ae7-a4ee-827331df94d2", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137205, "uuid": "1294fd21-0be0-42a4-b8d0-2ba276f92159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137205, "uuid": "52452659-5c40-42d1-bd16-e8f2516fb316", "value": "0xh0roxxnavebusyoo.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbf70ac-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108243, "uuid": "ccdce82f-7fdb-4abd-8d1e-1b8d157c4c16", "comment": "Malware payload", "value": "cc68052951bfbc46bd464bfca9d6fca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108243, "uuid": "995e27c5-8b58-44cc-81d3-2092eafbd09e", "comment": "Malware payload", "value": "130681e5049559f1b5053150331a1e3cba7c4293fb6db8e53747d1115a7c454e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108243, "uuid": "5e377ad3-eb9b-40e9-9a17-2c76cf4b8831", "comment": "Malware payload", "value": "e3412ebd3e4148c3e7577d4de06ae1619e374e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108243, "uuid": "6c9c717e-b65f-41f0-abdd-d9f06f92e613", "comment": "Malware payload", "value": "0529f7d8b500dc748276344fabed7030ded4c34074d676e282e3d5138257d75acbd682e5e28c6bfce52882971cd71f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108243, "uuid": "8b418b24-e0ef-4a2c-a4f7-b3d4effc2c48", "value": "T1C07629E17509B6CFD49F5779EA57CE82A85D07F842240813EC6DB4BE7E63C8521CAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108243, "uuid": "8d7cde50-7b27-4843-b4c1-80fa2e3c64a3", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108243, "uuid": "8125ea9e-8548-45dc-b992-cc2d18506c92", "value": "98304:HlLudZox5Lxv5/+cwZLEBPcV+8/7NahLd8IPVYbL78SaNoAJYh/Ew6qmppX/:XJs+Z0aNoAJ1RqKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108243, "uuid": "bef05b7a-c06c-4298-aa1f-d9aa621417a5", "value": 7729165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108243, "uuid": "93205e3a-0143-4136-aae2-9c55832dba38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108243, "uuid": "7b66fc6e-ad46-4f5d-ad72-9f66daee4f85", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac837028-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688101074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101074, "uuid": "2e973d1d-dcb2-44ea-a75d-c0ce4b8eb420", "comment": "Malware payload (AgentTesla)", "value": "85bb7da47acdf73b55f8a0db551b3649", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101074, "uuid": "7b4dc112-60cd-46ba-ad70-dca9ebac9c9b", "comment": "Malware payload (AgentTesla)", "value": "1322b378847915a400c693083d14e4d84b469bc39a6c6676c3c421f1677ae750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101074, "uuid": "d66043f8-7639-4266-bd7f-68d1a05e598a", "comment": "Malware payload (AgentTesla)", "value": "11638b3d06b8fa5eceeac5ca9f7d78d552969311", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101074, "uuid": "87f372ff-59ac-4b84-9c45-2b4093d509ac", "comment": "Malware payload (AgentTesla)", "value": "d81a5c88e892b3d187af69757bd6c017b41ed80e5a16225308d5912e7fbca50d020472786ab1ff6eab7715a485557cff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101074, "uuid": "9dcf1f6c-0ef9-4fcd-9fdc-990df630f9ca", "value": "T1C4D4239A18F7F4D27B37BF70F5406B494897947489E48B5ACFCA87106D32DC0266E06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101074, "uuid": "fac3003b-a5d2-486a-a834-32f1fe88775f", "value": "12288:TbxyvEYppP4J70sN7HcSDkuVbLjF/i8M10QmNdPhgribxy9Dp0DF:TbTWCosN7HbDkuVnjy0QEHxq0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101074, "uuid": "fb0e1873-134a-41ba-9618-648cc4df562f", "value": 647044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101074, "uuid": "083a1711-fb54-4a8b-b775-21a4d6cf1d8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101074, "uuid": "a63a999a-8abc-49d1-ab08-72c666a48da9", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e52573-174c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132795, "uuid": "92bb9135-a14f-45e0-8eb9-29e65fd06ec4", "comment": "Malware payload (Mirai)", "value": "f130e469da48edb46252e82d06c8fefc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132795, "uuid": "e00957de-5564-458f-bee9-410de7cae538", "comment": "Malware payload (Mirai)", "value": "13be2734c52f1f2b4b5d52824a16d44298e8aded6e62419c153cce3b08002a32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132795, "uuid": "1263eae1-fd3e-407f-a6ab-8c3aa28cd76f", "comment": "Malware payload (Mirai)", "value": "b55ca679250b1203fdde65750c7bda66da3c119e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132795, "uuid": "92ecbc5f-fa81-454e-a5ae-045d86b0942d", "comment": "Malware payload (Mirai)", "value": "efddd87229d59eada136a7a85d7b81b5c412655ee3cd81108b6e6f3e669517c82c4aa85e74b059830b28aed1fcf36a0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132795, "uuid": "2bb55975-296f-47db-8287-8c2605cb55c7", "value": "T113E35B42FA814B13C4D5237AB5BF41893332A7A593DB730799185FB43F86A5F0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132795, "uuid": "2df16f18-facf-4a2f-8db6-744a8721f4fe", "value": "3072:qCL5Kgby2rcNiX/SfTVZev+7vApPYcWR7r2mWM/91KKkY:7L5KgLrcNiq7VZevAvegcWR7rNWM/9UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132795, "uuid": "6eb177dc-1686-4c8e-bea7-070195393814", "value": 153456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132795, "uuid": "f9e80f73-51b8-461e-9e00-29e6bd28c9aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132795, "uuid": "40ac6b42-3cc8-4b5a-a34a-db882ae8e20a", "value": "f130e469da48edb46252e82d06c8fefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c305465d-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688110990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110990, "uuid": "002b6840-d0c0-430f-acbc-93b3a5bd1454", "comment": "Malware payload (Fabookie)", "value": "422cfa24a760b9a190dce8ba27bfc5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110990, "uuid": "7693bfa4-7e3b-4a09-a74b-45c01cd1e8dd", "comment": "Malware payload (Fabookie)", "value": "14085e7716a8c98724dce8e2d19c371867064764a8088373e0d0d3d7bb3982a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110990, "uuid": "5be7489a-ed05-40c0-a510-bb0c02d6ccd1", "comment": "Malware payload (Fabookie)", "value": "c9a77df2b00f3e4fab60153e9e256d8638cc8c26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110990, "uuid": "a81166a1-7e8c-43d7-b97d-0e027178591c", "comment": "Malware payload (Fabookie)", "value": "33e865eea936bf7b1e2f0f25b3edf7f0f572ad43a7124e38ddbcaf6db2ea46adfc7a55beca939b4c19f9d1b7a98b0d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110990, "uuid": "602e954d-94e5-493c-b43a-6841c51efda2", "value": "T134647C56F36440B7E1528035C593EBB2F6B27C562B20134F17A0FB7A2F336626E29B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110990, "uuid": "d1a27f33-d6dd-4acf-bea0-fef35fdc5205", "value": "02a84429b024f8e8b499d5d5730c3f0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110990, "uuid": "261bc8af-1776-4fb3-a590-909f2709acbc", "value": "6144:S/ji2HtZcrWFoWdN46Vt6VWxtoloBj5rbx:CNZcyNdN9V8VJ6Bj5rbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110990, "uuid": "bf296e18-6018-4a20-a066-4fef3ba0e90a", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110990, "uuid": "a82d29b2-e0a7-41c2-a5be-c5b13d84a2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110990, "uuid": "13769e4d-d869-43cc-8a99-3ee17baafe77", "value": "422cfa24a760b9a190dce8ba27bfc5b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76524b6-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144149, "uuid": "2b598c95-6dc4-4fef-870c-5d65bb93d3ab", "comment": "Malware payload", "value": "4ad2cc8139fdffd857f9e8d841d96aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144149, "uuid": "6c850231-02f7-4afb-a60d-f802c5e812fb", "comment": "Malware payload", "value": "143d364dd50674268fcbf22c2914348ba92f6f1ec2822b43b39a5ba0ed316d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144149, "uuid": "3879675c-0fdc-4b6b-aa32-e21f463d4fb0", "comment": "Malware payload", "value": "77e1ff23dca562b9d1c5b9174c5d4839c100ced1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144149, "uuid": "ea72bfbf-a830-407d-89fd-6646940d3bbc", "comment": "Malware payload", "value": "32d9da87286c1f27fbb86df180bdc2c39c90bb57312c565041a128ebb879d287ad9871fa8d7b63cc745186eadb9b3776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144149, "uuid": "00a0ed12-45cc-4c00-9c2c-15698af2d601", "value": "T10EE6F013B7878FB1C7491B37CD9F15246BA8CEE13713D71A6ACA136A58C37AA894410F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144149, "uuid": "5e27159f-5167-4a00-ac48-967ef4dd290a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144149, "uuid": "f3ebf35f-00f2-49fd-ada7-e2ecf3534ab6", "value": "196608:rkywMIVyOXLGkR4s7ub/4Jsx03geggcufB1cfNJAsHW7wrytFGTRm00Z409G0:pwM2NLGksQJsHxZupGAEqE6R9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144149, "uuid": "c6651f0e-0f07-4e6d-9584-33c40d1d9f90", "value": 15022592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144149, "uuid": "a30a061f-edf5-4012-867c-ec23dfb80a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144149, "uuid": "c3f15d7d-8978-4797-8c64-32994b146bf1", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.23032.28073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4677e3a0-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688150725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150725, "uuid": "94f1d843-c7b7-4024-8204-c1f8495dd1ed", "comment": "Malware payload (RemcosRAT)", "value": "cb7347e9baffc20010abac62c1836095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150725, "uuid": "4204abc9-884e-4705-a7d9-794fd46020f3", "comment": "Malware payload (RemcosRAT)", "value": "14537704270b4f5374035799ad456b43bd9c003a4f705f37a6aee9f3a80a03f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150725, "uuid": "a679ad5b-7f76-4422-a059-f1c166c44db0", "comment": "Malware payload (RemcosRAT)", "value": "18769b8a6fc43887d259ec3fcde5ab24b8a64fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150725, "uuid": "d27cbcf9-dcfa-4329-aafe-9b75615bf3fb", "comment": "Malware payload (RemcosRAT)", "value": "5741f46ed3c6c1ecd3e71db19f6e36d4a895335ba10d45d617cfb87009c313e5046c4986bac6d9d508a304d31b771c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150725, "uuid": "f9fcbbef-24d9-4d81-9634-020333924822", "value": "T1CFC633091AD83269FCA06777E4E6190359F47C5E4335EEBF1E9244158E23BA42B3B32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150725, "uuid": "4fdac923-4a9b-4f14-9142-9d7377c22c8b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150725, "uuid": "7ec5a5f8-baf8-4fdd-acfc-465d5517b626", "value": "196608:kJYFLMxbuvuicV+wFjkCJB8Nw7GjMtBoeLN7X2WpNU757vM07VJ2rJCN90XlVL4u:1vvuSCjD8MGYtBoiGWkbM07DtNaXlVL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150725, "uuid": "c5ce180e-a672-468b-9801-67e01242c352", "value": 12399616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150725, "uuid": "7f3e59f9-926c-4603-8bd9-33e7ea0ed832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150725, "uuid": "8926766d-2aff-4acc-8b4c-1ebd713c8694", "value": "SecuriteInfo.com.Win64.Malware-gen.61.18834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f09f16-175d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140206, "uuid": "61dfde75-2336-42cf-a0bf-3d5f834f05a9", "comment": "Malware payload (Mirai)", "value": "a9c32cf497c256605ce9294fb2210e44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140206, "uuid": "acdd71be-0078-4125-beec-1bea9c5c9f21", "comment": "Malware payload (Mirai)", "value": "14bf3a92d3ca6eb29a282dea2f8c8b65429bf05a6b5b875518c2aaec53423dbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140206, "uuid": "b00605f7-5d7f-4d92-9a42-6c53adad6525", "comment": "Malware payload (Mirai)", "value": "db728d5e3b483809d02e2de0905872e39f792077", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140206, "uuid": "27a542b1-835b-4c7e-bc14-6eeb9759b9b8", "comment": "Malware payload (Mirai)", "value": "29cfab5888b93e802a56662d476b41a36490b7db8e6fd8bb6728ae86742902ecf39b02fa932feb6111a0d081470be16a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140206, "uuid": "11a8ddd9-2d39-433a-8f08-0bbef5556321", "value": "T160C2E154217AEF29D4750C72CAB08EC21D7A9AB467E131F53BC813D6D66434AC9B830B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140206, "uuid": "dfd8ae77-129f-4348-92ca-b6be9a9b6806", "value": "768:1ZqbD9poewFRgjRm6O7NxKnSXQnXs3Uoz5:1s/9KgV+jDXQKz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140206, "uuid": "a121fa64-12df-421a-9917-7eb6b19f5fdb", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140206, "uuid": "6fc2b138-1254-482f-88fe-a5fb35202b67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140206, "uuid": "f2189548-1b11-4465-b61f-b91eecd7d3a4", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e71b8c-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144422, "uuid": "79ce859e-1f69-4955-9229-9f13ee560b8e", "comment": "Malware payload", "value": "38b6dcef3c34e8d787075eb92970dffe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144422, "uuid": "9883bf3e-5909-4cc7-99c9-ad9d0f9b2cf2", "comment": "Malware payload", "value": "14e72b985f07590803c9fcce8d7558b39e93336fe0ca7b0bc0a090a3c38c3d99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144422, "uuid": "3be7ea1d-c5b8-4926-b197-e073228f45d7", "comment": "Malware payload", "value": "f79a750975a343e4dc200c9ae1e299b4dbb2fcd4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144422, "uuid": "e79d4070-1e51-4881-985b-935316e6b095", "comment": "Malware payload", "value": "e13272b5fc1f0f6544bf2af2a345f17caf6e2c722fad32849e7dddaaadb6438fb46f30c33d9aec6989b2504fa0275d1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144422, "uuid": "7b4d9726-e58e-4db8-a719-024354e93198", "value": "T14E646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144422, "uuid": "81efbc43-d353-4398-bf89-a35ad5293355", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144422, "uuid": "115b8a42-fbd1-4108-a9e9-69dcdc7c2963", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144422, "uuid": "2c93417e-ae78-4ac8-8631-86fb6b671f0d", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144422, "uuid": "d448bb69-27c2-4980-95ce-c90a124b35fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144422, "uuid": "30feaf93-8771-4d58-8be4-452a4ee75a51", "value": "22loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2986202e-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108156, "uuid": "0d97028e-45e3-41e9-a168-4677d675b6c6", "comment": "Malware payload", "value": "5df7e0639c2fcbfa3c570cbdc8d9dd73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108156, "uuid": "3edb3fb5-342a-4d34-b71f-72d967cba6f5", "comment": "Malware payload", "value": "1530de331f7f7abba8fc80c39582bd7cb6c598abbb9afc575f58359ea3349037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108156, "uuid": "0fcf1743-b44a-4f2e-828c-2536c37a804b", "comment": "Malware payload", "value": "2f9fa17387f7bb87ae983e23176c0349806da3e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108156, "uuid": "5f1a469e-47b0-4ec5-b474-aa3f98eb2b38", "comment": "Malware payload", "value": "1da3c0d0ae2845caaf657c165ed4f0751d692bf583702ba94dd85e787760813279c3083710faf07e1c57e74a5df3b485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108156, "uuid": "002819a7-357d-4cb7-9fc7-29ef0591c158", "value": "T12C16FAE1750876CFD49F27789B27CE82699D4BF846350807AC6DB4BE7D63C8126CAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108156, "uuid": "6c49b887-4d82-4614-8cb1-0c0768ffba54", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108156, "uuid": "0c084429-b9e8-4816-85d3-0310d41fcd39", "value": "49152:HO5F6O0xLudZB+xDNLxv5/+cwZLlGBPcV+8/7xLh4hj:HlLudZox5Lxv5/+cwZLEBPcV+8/7Nahj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108156, "uuid": "7ab57cbe-28e5-4047-807e-0131cacf6332", "value": 4412443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108156, "uuid": "ed8701c7-d0d5-4976-a50b-d6c3ff81b98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108156, "uuid": "9e1b5070-fd5f-4914-9bb8-8ab5088a135c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0afa172-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144085, "uuid": "5e6172eb-f13d-4aa8-9b9d-4794f5a2273a", "comment": "Malware payload", "value": "8a8d323894b4de290dd5a91639b2fb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144085, "uuid": "062163bd-dbaf-49fc-adb6-9a49bc2b66ff", "comment": "Malware payload", "value": "15517511bb2b6ffef07b48182526f236124b67cb0f3867eed0f144a79d8b2c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144085, "uuid": "f8370914-29eb-486e-bd9f-7b79668991fd", "comment": "Malware payload", "value": "e7f2f76cf5a551a2acf1e473f309fbe29bca84f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144085, "uuid": "60a9d2f7-77b7-43bd-a486-ef57e70bea81", "comment": "Malware payload", "value": "48ca91fe55830ca902254f728794c117bfc595a0314306285e686dc9ca0868138e4bce0e4253ae08e53dbacc5ea2da13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144085, "uuid": "6b5d658e-1aaa-4be6-94d5-85fd691aa6b1", "value": "T1175633774F050827C8A20FBFF01B72EFD2E25EA27531D96B1EA836115970B859C9B583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144085, "uuid": "a6f4bddd-25da-46aa-ab64-4a4d87d14cfb", "value": "98304:H4UUAlmkniSuZfEuIJpbdL16gxE7mWqjzW53B31tD80y0EOm4vkc2XB0Pbl7niKh:H4UUTb6JpbdLW7+jq53m0UWkcBx//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144085, "uuid": "54bc50c6-2c09-4132-aafc-8bbb40e51905", "value": 6410752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144085, "uuid": "42662f63-daa3-421a-a193-f5ba74487e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144085, "uuid": "51f1c698-2171-4d5c-8ac0-5a74b5111f51", "value": "SecuriteInfo.com.Variant.MSILHeracles.90580.3052.19250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dde9658-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108217, "uuid": "2979a35b-5e74-46ed-b382-04d914041113", "comment": "Malware payload", "value": "e27da4409c8247c2cb5d262c3088820d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108217, "uuid": "2798fabd-83b4-4388-9ee8-381c777aea74", "comment": "Malware payload", "value": "15583e89e53f637420377630452c1bb9dc5de84ce852690b26ef6aec9e7353f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108217, "uuid": "557229c6-9541-428c-8b6e-efe9a31a230d", "comment": "Malware payload", "value": "15696d92d55ba9aab1830f31f0e3ee6f164aa854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108217, "uuid": "7527888d-d9b8-4298-8087-db3abd443be9", "comment": "Malware payload", "value": "f5590d21a9461649d20f403f3d3f1565d388b6f96197e5fbfbf76f1b4dafc7c6142a99332aeeb4eb9317a3474f1154d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108217, "uuid": "b982569d-4a31-4f24-a8e3-3ebb4fa436ab", "value": "T16EE4F102BAC284B2D5631D376A396B20647DBD202F75CEDB63D02A5DD9316C0EB317B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108217, "uuid": "2724956e-3d1d-4313-a715-94dc0ace0e98", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108217, "uuid": "d6affba1-0a4f-4b3e-a6e6-12f6fcbc2a55", "value": "12288:2ToPWBv/cpGrU3yVtX+t4Vd2EATjFnUPYEaUa45zf5PEYzTfVHgcpJ3:2TbBv5rUyXVcEAZzF45zhPEIhB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108217, "uuid": "abd59ca6-8077-4df9-9cd9-1e661eb1a51e", "value": 683047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108217, "uuid": "e524b2cd-8c2e-43fb-ad24-59441ae0c86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108217, "uuid": "9e2ee23d-711e-4e57-a182-09e2066d6097", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fc80a9-174d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688133351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133351, "uuid": "d417ef4b-7842-4b11-8b91-e1a1a269b3aa", "comment": "Malware payload", "value": "e90e346a5184ac0afe014459de42b2b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133351, "uuid": "f3914988-2774-4949-9c96-3fe28dd03f69", "comment": "Malware payload", "value": "156f204a180aec2bab5df5c7195643ce71e39dcab4daf289a719ef79d2235c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133351, "uuid": "4a0108ac-e759-4e16-9a52-285983e00162", "comment": "Malware payload", "value": "d6c91dd48af9ba9f0c77546964b65dbe6eeee5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133351, "uuid": "a7c613cd-f697-4cdf-97ea-a4b708699d4f", "comment": "Malware payload", "value": "b118252c6db0ebb600525e490f359142b3c7208a86e06fee09f567d9ac5d18bc1ebe3a2f6c60dd32ef87a2178b9e2fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133351, "uuid": "b3d34be5-7dc1-4c94-a62d-05e856bff678", "value": "T1A2E23A54A7ACC11FE6EF0F7D78611A200270D3A61313DBD61DCD28EEE9A77044A1AB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133351, "uuid": "3637ce2d-8a35-4010-901f-be5d9fa3b25e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133351, "uuid": "01ba1349-2988-4ce9-be90-40bc26599d10", "value": "384:V45F51DkxZsjeJPWFIZL4lx8VfgSd4lKwT9aZcpMQiW4zmkZXOfq14KKZkLMhIPE:VYKlOFe4lx8Vfg8woXbOfq1akgfTdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133351, "uuid": "0844e3b0-b64c-4012-b6ef-8d500c11e140", "value": 33802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133351, "uuid": "4d2ace13-cb15-4a5f-b688-46a4dd02986e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133351, "uuid": "320ad580-4878-4b78-823a-a00044d36b47", "value": "console.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6811cc5-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101171, "uuid": "4f1cba7a-f2f4-4a14-b093-f66d2f964651", "comment": "Malware payload (Mirai)", "value": "7ad30aba234b30f5d36a3f0adef04c16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101171, "uuid": "220c523c-cb7c-45da-b56b-75368c5db028", "comment": "Malware payload (Mirai)", "value": "15d0abbcac44279d7da861bc85bd6729dd03f2a30dec2266d6bd996ea2450ac4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101171, "uuid": "f4524387-2b3c-4a5c-ad8d-181345108898", "comment": "Malware payload (Mirai)", "value": "b5c4182864774ae5a00cc05b81cc1b7649d77f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101171, "uuid": "fee697ae-5b39-43c2-9ab5-1c7067d014ad", "comment": "Malware payload (Mirai)", "value": "85bea512148c9ee454a6c96e27b0a6e17283c2e76877a7a55e85188718e362298bb2d2ef56c6924acfbd35eb6a97133e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101171, "uuid": "c38344bc-5752-4bf0-ab6f-2f829d3981e0", "value": "T184830845B9818E11C5D823BAFA2E118E332263B8E2DF7213DD146F5477CA92F0E77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101171, "uuid": "016db8b4-5754-48c6-97bc-e5d6ea5e49d0", "value": "1536:7tncKUM3Kd4czYFV3SAW76Fizw7FWhuI1czKVHa8VmcMIjVrGIaZ0cbI9ixrG4bd:KKnccH3rWGFkw/GczKrVxHjtGIqrG4bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101171, "uuid": "8b4a0e5c-a11b-4c37-8af8-29270c9f1cb9", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101171, "uuid": "6d463fa0-432a-477e-8484-5b759d7a7a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101171, "uuid": "719b5f52-1a13-41b9-aec1-cebeb27e1931", "value": "7ad30aba234b30f5d36a3f0adef04c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d98ca1-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1688110354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110354, "uuid": "040ba3e8-59e0-4246-b169-d97b6fee3d33", "comment": "Malware payload (NetSupport)", "value": "21978f36ca548b51f169d1a6b1339ed4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110354, "uuid": "8e2e5d89-fb28-42cd-8064-33939aad4ddc", "comment": "Malware payload (NetSupport)", "value": "16d7dfc724821b3e4cf8f566db32e98741e4b5b05bdf613ae5d69e0919b975f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110354, "uuid": "2fa82324-97a8-489b-ac11-6b79bf6255a2", "comment": "Malware payload (NetSupport)", "value": "048864e7ae606e93d0ec48978188dbbcb752b9e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110354, "uuid": "0d9420b5-788e-42a7-81ae-cbc838dd10bd", "comment": "Malware payload (NetSupport)", "value": "047d7b5938661ceba97f63f7396ab0e20100a5947447ce9d1f47c01f60083e35b2787013b668eae6db68b14685a2ce8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110354, "uuid": "23cc1161-b002-4067-9af8-6a129637f4ae", "value": "T18E35126BCD337F7BCAB45324143647096AF7CE01009EF5E5626921AE63AD77E608E224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110354, "uuid": "80509d96-f5d0-4bfd-8b9f-5a06ef8e90ff", "value": "24576:Opxp56IznK0000qpSuXpbHuXpbyuXpbVuXpbVuXpbs6NhSb2bOjeee4n:A/4Q3pIpbpWpepub2bOjeeew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110354, "uuid": "a726d20f-937e-40a8-a033-23e53a083106", "value": 1073063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110354, "uuid": "75b3d894-3a87-4582-ba0e-383b590e1007", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110354, "uuid": "0c70c5de-1c75-46c7-91c5-67f0bec7ad24", "value": "21978f36ca548b51f169d1a6b1339ed4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe5cbad-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131306, "uuid": "aa07b3e3-fca2-4cd7-a8c0-b721acffde0a", "comment": "Malware payload (AgentTesla)", "value": "120ebce72710d7ff3d5b004b28f8cdb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131306, "uuid": "b9a67fa0-5072-4a59-ab73-7dc4dbed5889", "comment": "Malware payload (AgentTesla)", "value": "17b85440e830fbef06c68240cf0024dad39a394409980195c360c0084c4be907", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131306, "uuid": "41e90f67-2c20-4192-9bb7-c5d805d3d2a3", "comment": "Malware payload (AgentTesla)", "value": "1b4b48d514cd6ddce5fb5960191909019e86c79f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131306, "uuid": "37399587-f26c-463e-ab09-86f43df40021", "comment": "Malware payload (AgentTesla)", "value": "9614538ad18a111fbf07faa5bc410cd1995493a93dd3b199df04509edd02883e61fd6b0a35cf7986bb81231f65612f2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131306, "uuid": "4d943bb6-3371-45ab-a3f8-d50b9d5491b8", "value": "T1F4451858B22E388EC4478A3994946E2DDE5C2CD75616933350833CCEAF3D9479E1BCE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131306, "uuid": "62d57308-1206-4ace-9ed4-15664785fd1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131306, "uuid": "544f2492-54ba-4ce3-93d6-23d44a076223", "value": "12288:XjUPKl/CRhFk76tVXQeOiZ8KrkrU5ZowzT8Ga5iCOpSfRE1FTW+Yf/eKq/Crecgx:XjUS5GIKVX0SDkwsN645CFO+fCSD9mO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131306, "uuid": "6f73662d-45de-4501-9359-f8af7eafc9c0", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131306, "uuid": "1a5fe768-fe59-4704-a400-963485e129ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131306, "uuid": "147a8462-b5e0-4d42-8aac-eef79c6561fa", "value": "TT PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b8b894-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101167, "uuid": "8b6c33b7-d48f-4876-a5e0-4d52dbbf787d", "comment": "Malware payload (Mirai)", "value": "9d445038d172b49c5076b7425f99c832", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101167, "uuid": "dc017587-cf32-4107-adc6-efe396d89a4a", "comment": "Malware payload (Mirai)", "value": "18276e79cc58a360403a96f521a6b9f42a36b72118e360729ed133362491abbb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101167, "uuid": "6e7ceb97-9b7a-4d58-a661-4a54f3392785", "comment": "Malware payload (Mirai)", "value": "89ddca3aa314a94d57523a45ed30f4a061e15470", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101167, "uuid": "fd16dd84-64aa-499c-97cc-f92785a2d1d3", "comment": "Malware payload (Mirai)", "value": "6f41d42879bb7863e0d3c515314d314cbb837061aabf40425de7ef004a12161460e200bc50066e29e85aead0296d45e7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101167, "uuid": "ab7bb149-5a7b-45c6-ae06-5e0354e1fa4b", "value": "T124732847688580FCC148C1744B3F757AC466BA7E213DB2EA37C9BF132E46E710E5A8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101167, "uuid": "1f6732b2-1bad-476f-ae35-dd9b86c9f0e9", "value": "1536:zXt94bIjFE7zI8ezYWroc+0j7cr5HC8fLdu/dFoz6NW:jXVjc88e0Wroc+0j7cr5HFdu/wz6NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101167, "uuid": "f728f3ab-e8f7-42b7-8b55-21959a12c0b2", "value": 75008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101167, "uuid": "764f0783-2ff1-4a53-8409-6a225a1af92a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101167, "uuid": "58e007fb-602b-4875-bddf-ea5fb95288b9", "value": "9d445038d172b49c5076b7425f99c832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de63b356-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144967, "uuid": "1985241c-104b-4c5e-b99b-ffbd7f902fec", "comment": "Malware payload", "value": "aad94d989b443764c78db687b20a7b35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144967, "uuid": "80f5c500-8eb6-4ea8-9aa4-f06014d0402d", "comment": "Malware payload", "value": "186197a49d9b8387701eed8b663015bbf8dbc774e06c39d260276487870e3fe0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144967, "uuid": "cc5e97cc-4c09-4964-9a38-35f6f4920c44", "comment": "Malware payload", "value": "8034f79c58bcb0975afc96d14b196f1405399039", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144967, "uuid": "fcac1878-94b7-4d1d-8e3d-d040bd39e988", "comment": "Malware payload", "value": "defb2f3ddc194a4544dcd599c32a1005345da4feba1a796102d3eb2a7d0e769909f27cd6014c327fb0cc8a35ffe8dfb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144967, "uuid": "29ae946b-2989-488b-bcde-18d2869731b0", "value": "T17C646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144967, "uuid": "effac317-dbaa-4a94-918f-204755a161cd", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144967, "uuid": "54d5970e-afbd-444d-bc05-0ca92969f686", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144967, "uuid": "20625595-fdd0-4f52-8be7-77df166528b2", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144967, "uuid": "45926cdd-4247-4cb7-b11d-a8d457b196aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144967, "uuid": "3087b6a1-1dcb-4db9-8678-798ff527d3fa", "value": "94loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e406507b-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144117, "uuid": "3530b278-e813-4a2a-998a-3132579e00b7", "comment": "Malware payload", "value": "132d88de2765740aef2205aad672f7e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144117, "uuid": "89cd5f5d-0cb9-42b5-b2cd-7aa28fb5ffe8", "comment": "Malware payload", "value": "1b2642c0e453c1e332638352dff37eb5c2fa2ba80aea423d7f9b297bf83dab72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144117, "uuid": "8edbc477-910a-4dd3-b50c-31b9d4738575", "comment": "Malware payload", "value": "faf373f9adbc42dc1cf3a531cc77ef61102aca38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144117, "uuid": "143cc44f-6417-444c-a952-afc125d75c9b", "comment": "Malware payload", "value": "675dca9347aea5150b0061fc402b1320facbfbf6f19857055b73bec716bc0d5ed9f519de7ee8adeafe18951c675b9d06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144117, "uuid": "06df9ff7-b996-4c95-aa16-9a2a827041ca", "value": "T1A6D6335C5B89DB13C29F1B78F4635309F686DC2799E0DB1E8198F4FDD6A2BA0C4021AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144117, "uuid": "bf1e0a3a-d2f2-4bf9-bdc0-7e00b4ba8b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144117, "uuid": "71411148-cd74-4ce5-b455-36feaea631c5", "value": "393216:eTXSlRLB9e1nwPkqEm7Vg542C6cHeTQpCOs5:6XSlRLrQnwPjEmeCYTQpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144117, "uuid": "cf7b3220-69d0-43c8-b02a-cb653e776686", "value": 12880384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144117, "uuid": "45937098-d816-4c90-a3a5-6915d9384aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144117, "uuid": "2a4e89e9-6fb9-4bb1-9dcf-b78602b4cd66", "value": "SecuriteInfo.com.MSIL.GenKryptik.GLCC.tr.dldr.17997.10627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef9df78-1744-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688129371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688129371, "uuid": "b9c80d1f-4f70-4f86-8a0e-3b43ffd1ceed", "comment": "Malware payload (Tofsee)", "value": "fc224114fc883bd6a89194c3f4502b0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688129371, "uuid": "b12aeaea-2393-44e8-9a3c-0bc9daed99ff", "comment": "Malware payload (Tofsee)", "value": "1b4a3b486f65037537fc9ddf23222c1793417e1d02fab7d4f7acdf4420eb74c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688129371, "uuid": "5932e267-4908-463a-965c-9bbdba01b52b", "comment": "Malware payload (Tofsee)", "value": "de398a24e9c3ef03f93c82d0c8381df25a1437e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688129371, "uuid": "99b7e690-f2f9-4ec8-a109-62c3387c8399", "comment": "Malware payload (Tofsee)", "value": "8dfce1113cc868122961d7641bb82ca0832cb232e5916240fbbf909d73bc3bbb1b4c9439a87f46b2cf0711be4a63c8ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688129371, "uuid": "248b9280-7936-41d8-b5b5-216102202aae", "value": "T14C543A4382E17EF4E9368B72BF1FC6E8760DF1548F49376921189A2F04B9072D663E61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688129371, "uuid": "9a8ad66c-9545-41d9-a260-f0ba203eb4be", "value": "724f2113bd8cf2467f60e8a645acf4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688129371, "uuid": "52a00d0b-7e96-4d3c-b5aa-0e73fddace93", "value": "3072:Qr/Mi703g8Uw+QLZZAt/IfT1rNFf43HxRakL+BtDm:SzNwRVZAKBNFfTkL+Dm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688129371, "uuid": "9ecc2f20-c4da-403f-8ef8-ed6b80b0c95e", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688129371, "uuid": "51d70f78-b125-4f68-9731-d79baf896aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688129371, "uuid": "2ce2e873-1390-4c4a-9225-577fe327ad5f", "value": "fc224114fc883bd6a89194c3f4502b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfee75c-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131544, "uuid": "d384eef6-bed6-4cdc-bcda-505cab4f4e28", "comment": "Malware payload (AgentTesla)", "value": "048c3672872750704dc94eb8f0552857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131544, "uuid": "9b466e75-d5ae-410b-8999-964e238d970b", "comment": "Malware payload (AgentTesla)", "value": "1b5d95e350eeadcc8bfe9f36eb86c0997cb3b0c5f2cecef544b84efb8abdace1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131544, "uuid": "1a57ba3c-637f-4821-83f3-e560146314a6", "comment": "Malware payload (AgentTesla)", "value": "5e03bebf7d22f69a164c1c3baa86f5500ed8f013", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131544, "uuid": "a0e31cd1-9aa9-4a22-95a9-0e666f69ebb0", "comment": "Malware payload (AgentTesla)", "value": "175e7e05365863dd3a17672505c03531bbb9a8bf1152c240ac027e0afd7bc21bc6c9ba0e35e6441f22aa73360f2b1233", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131544, "uuid": "7b5ce6a9-2842-4dd8-a981-71a89f22966f", "value": "T1FF450858B22E388EC4578A3994946E2DDE4C2CE74216973350833CDEAF3D5479E1BCE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131544, "uuid": "517df6b5-24de-4373-8fcf-90f84cce82fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131544, "uuid": "16aa306e-0662-4103-88fe-b207bfb557c5", "value": "12288:utkZ8AmDgQuk76kuFyVcNKj1go9VOLA8WrYJTv0xWWjcAWr1vcX2M+8RomcpCIiR:ufdBzuIcNKj1gCVh2Tvqjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131544, "uuid": "ea076343-a695-4bc9-9499-f0cd0c774e5c", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131544, "uuid": "b9b8905e-11ec-401d-b67c-1f6643a42191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131544, "uuid": "7613c8f9-bbc8-4f7e-8c64-dcff9cadff92", "value": "INVOICE AND PARKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2fe23a-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111412, "uuid": "c3225a9d-4948-4a0e-8abc-8934e2a67b0e", "comment": "Malware payload (Mirai)", "value": "9f68960843703ee2010967abfdb9c56b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111412, "uuid": "fc2fdfe3-a9a9-4684-ac15-41e064660970", "comment": "Malware payload (Mirai)", "value": "1b8e9ca2d6ddb2c6373e339098a01a1e849927eb6ce08a5b848e9dc385bb9883", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111412, "uuid": "d8c98a4a-923c-404d-9fd3-1dbd0880a6f3", "comment": "Malware payload (Mirai)", "value": "f57bcb5df2c4a4b2f89dda87d373d72716a0cf03", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111412, "uuid": "8881f28a-573a-49bb-858e-877186b002f9", "comment": "Malware payload (Mirai)", "value": "454b52adaf3e7c6c4eb62cee7720cce7726684a49096f12f20b79254c2e81ce8cdf752043253926a1875d84bec098d16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111412, "uuid": "7cbb17b7-2c88-42b9-977c-bff9afe4a586", "value": "T1E6430226C9E9E4D6CEF2247ADC2B90CD7BE6547EE1BD3137C6000196C9E4485F5ED026", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111412, "uuid": "cc0da4cb-180a-4d93-bdb3-c6a84bfcd583", "value": "1536:R3wShPz2dKmMYBcRQQCStmPX0LaTM12hxeim:VwShb2dKmMpiQRmf0L63Yim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111412, "uuid": "3d09d7eb-5194-41ab-b3e6-d7e2691438af", "value": 58620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111412, "uuid": "2dfbd24c-efae-4d0e-ad80-50410bff7c01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111412, "uuid": "c5c55ef5-f365-481d-885a-a53f4dbcff87", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3410eb-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688101186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101186, "uuid": "03ff7b17-a6d1-4f01-8262-c016fe1c6d28", "comment": "Malware payload (RedLineStealer)", "value": "402c4df156c38ca61ccb6652d33878fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101186, "uuid": "aa56b1fa-ae36-421e-b222-85cf504590de", "comment": "Malware payload (RedLineStealer)", "value": "1c18aa2282dc5ea1e20bf68fc1baad134ce84593b4d98a66746b73848c775dac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101186, "uuid": "78bfb092-ef58-466c-bc2d-86a50ac6ce02", "comment": "Malware payload (RedLineStealer)", "value": "e1724be3c1d0f63f229c7b11156bbff0adbf3316", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101186, "uuid": "613ca197-7e10-48cf-bfaf-21c288263ef2", "comment": "Malware payload (RedLineStealer)", "value": "94b937225d9af1d41ba0d549e3fe9a668832e25df930214cda31592d805969fdd713ed1dcfbc8cebe137c5faaae7b43d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101186, "uuid": "58dda843-aabd-471a-8928-84871d65413c", "value": "T11FE633A5F3271B73E1F0F5791EB067637728BA0E198246100503B4CDABB3ED7A262B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101186, "uuid": "914c063d-a906-4445-8327-7e2b17ac2231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101186, "uuid": "1eec88d2-8009-4135-af40-748b35dca90f", "value": "393216:toS+XdkeMCyLC5Jti1KGihrAulTuZWgD:UNk7CyG5JtiVsQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101186, "uuid": "21205db2-41eb-421a-8a73-c715ac03dbb4", "value": 14978560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101186, "uuid": "80b55420-98f3-4e58-b8cd-60ec52689187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101186, "uuid": "3ffa613d-f999-46ab-8f0c-19c3a7fdd868", "value": "402c4df156c38ca61ccb6652d33878fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabe1ce5-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688109312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109312, "uuid": "4d6d4b51-27e0-48c9-89da-589d4e30251e", "comment": "Malware payload (Formbook)", "value": "337be69cdf6156dd577205d1e2efaadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109312, "uuid": "eadfdcc7-aeca-4f95-9bf0-46f00fea2e8f", "comment": "Malware payload (Formbook)", "value": "1dcb47034c751dcf14fe9d403725465f4e1c87cdf4fb15d32ddc731a56a98c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109312, "uuid": "175ee94b-bd15-4731-a152-e1dca14335e2", "comment": "Malware payload (Formbook)", "value": "e55dfa9bb1f7bf00957751040226520ad2c31959", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109312, "uuid": "1112adea-ff64-4142-98ce-770447971616", "comment": "Malware payload (Formbook)", "value": "73bd7eb8ea3fcd5c4b61ee79acf08cedad5398e6c3e4f33c46f03286df0c03d0bb9ce1b7fc5e6ab435d093aa92dcf447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109312, "uuid": "ac31936b-cfc8-48f0-a215-6c8e872339f3", "value": "T1F454E1162913CCFFE5BF42F5182D36516A47FD28D81B151F13D7BE88ABB82A0E02A751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109312, "uuid": "5c01e73a-4873-4fa9-b95a-52d7f0297cea", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109312, "uuid": "0954c51f-9379-4ce5-9aa1-26b527e861e2", "value": "6144:2Ya622DqJGAkDyBKWf3YRHtqcJPFlG6Ox4eyt6M2GXt9c/UT0I1MXgU:2YYILDyBlPYSchFOx4ttN2GXnrT0yMXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109312, "uuid": "4ee26eda-2f17-4038-930d-48440fc172c0", "value": 299937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109312, "uuid": "1e771dba-6b5b-4135-96c2-94db225f27ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109312, "uuid": "2fb32866-0018-4a3a-8189-c50ba8ef5003", "value": "AWB_PL&CI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f722d1-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144627, "uuid": "c8abbca8-7e19-4601-9e99-169f73c8f78f", "comment": "Malware payload", "value": "12480cf00d506ffa8b58d2cd2025cfb9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144627, "uuid": "7120759c-1bde-4ee3-96a4-eae3dfd3d8e8", "comment": "Malware payload", "value": "1e99d49fd5711a0d113a0418afece9701df269f9127bc5d695d36d4e60aa753a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144627, "uuid": "b47c2709-8f94-4562-bba9-537b3b6c6413", "comment": "Malware payload", "value": "dfed1f1588a7b626807a21b2a659cecdd5073735", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144627, "uuid": "aa49585d-8463-422f-b2e8-2f4a21f24300", "comment": "Malware payload", "value": "82e532b00967c55d44934a5ab1c1cc69ae8b20d632a98fcbd9a52a1c1659db4e09de87f6b5732174c20324344e6a7fcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144627, "uuid": "c807982a-9495-452c-9f7e-264a937040d6", "value": "T16A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144627, "uuid": "e5d6bbd0-9b12-4852-ba33-bf0d41eb7400", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144627, "uuid": "81acc829-adf7-4834-83f3-a9f74dd5a8b0", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144627, "uuid": "12e70c5d-433e-432a-b191-d0952d51c648", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144627, "uuid": "299fe5d0-29c9-43da-b89a-fba43ec0b0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144627, "uuid": "240512c9-8b45-4302-b815-d8efe920b720", "value": "4loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8fe2ee-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144101, "uuid": "e10e4389-7d06-41b9-94dd-57af836b6bb0", "comment": "Malware payload", "value": "73a6e79e1903baa7b9c99924b3ead845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144101, "uuid": "6be25011-b8b6-48a0-b8ea-06265a34d40f", "comment": "Malware payload", "value": "1eb67b2f1f44eadcfba937fc9fa51038d7eb2a0a9ba164026c5ee848e3d99eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144101, "uuid": "c1f83cf9-268b-498a-add2-349f67359245", "comment": "Malware payload", "value": "405971857de1a791649f6c3e421d67afdfb6a2c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144101, "uuid": "7809a095-71cc-4129-a101-922185fdcd1a", "comment": "Malware payload", "value": "2513800e851ec0fd9001fedf41fe25b4c7d981a2cb4129a5fef7480393be505a499933b428682405628fe1a85c850c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144101, "uuid": "ba8b41d1-8fa6-49c9-a9c7-9844a0de525d", "value": "T10AF6F013B6878FB2C78C17F7C4AB15262B6CD5C17713C61A6B8E536918C37AAB9C4207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144101, "uuid": "3c559630-5f42-498d-84d9-20d81fadb487", "value": "393216:AxsrKCITZ0ju/JMR701WzKWImPfdjpigCIbHd:6srK1Z0jSJUqqHfCgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144101, "uuid": "50570c85-334e-41ec-8e45-f0ac27809f50", "value": 16616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144101, "uuid": "fd95fc6a-0341-4a67-8a2b-2de9b158ba46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144101, "uuid": "996d7c7b-c7ee-4248-9ad7-1249546bd3e0", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.3669.4929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ca31b0-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144392, "uuid": "9037cfe5-990c-4bd7-8068-53fe69238960", "comment": "Malware payload", "value": "3961b3b5614224e09e1c61e1c5494e06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144392, "uuid": "f83d617c-30f2-465f-91f4-94210d06bb43", "comment": "Malware payload", "value": "1f0d72b1fbdca51019491f0d5847750b43ef4f5934884546504653c8323914c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144392, "uuid": "5af27f2a-d682-453c-b927-9a336a6f79a4", "comment": "Malware payload", "value": "8da29c9040a308b317a30744324dadf0d67a8cde", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144392, "uuid": "5afb391d-e36d-4398-8684-75fb43c503cc", "comment": "Malware payload", "value": "8d283414c93fa17b5135373fdc531ee3b899afafb5432b404b12a95eb8ac0bcd9e5c6d9a82b48feace366ae4d3fdab21", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144392, "uuid": "4c3331eb-a3ea-4936-928a-1741e5925e19", "value": "T196646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144392, "uuid": "25ad4241-fd35-4360-b945-d2f233e29183", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144392, "uuid": "1df787e5-1030-4c8a-917e-12479b3b2ee6", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144392, "uuid": "9263011b-c7fe-4d05-bbdf-ee4a18ad234b", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144392, "uuid": "1dee0550-ff68-40df-8926-0bdcbff8182d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144392, "uuid": "7edcd291-dc65-42d7-9686-544d58798eb2", "value": "18loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1800360-1765-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688143630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688143630, "uuid": "646d1713-7ebe-41ee-bf76-29c768ca7ede", "comment": "Malware payload (Mirai)", "value": "9b5834d46616d9c3016f67379087c290", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688143630, "uuid": "ce486f74-9239-48b7-a74a-1efff56b8c3e", "comment": "Malware payload (Mirai)", "value": "1f767cc66597ecafd5e5410d94b6c2a9b43436f865bb5b4f72949a607e3e3f8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688143630, "uuid": "0faf25c7-9517-4db4-9398-8a4c0fd3be30", "comment": "Malware payload (Mirai)", "value": "b136970de196dd2ebf1f2bc1cee25ceede827db7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688143630, "uuid": "0cfceb3b-5352-4d18-9964-b471412cd27e", "comment": "Malware payload (Mirai)", "value": "fcb73661668a8d52e30cb629c3cca024c01af47e0af0f2fd45221b4555029c17f1ff1744b0a5901caf666fba90e90dfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688143630, "uuid": "035f6bc6-f16f-4a04-b89b-d044adcf6ff5", "value": "T177735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688143630, "uuid": "8784df1a-2457-49fb-9a39-432bd46fec92", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8H:YwfdNu4cmZvFqI3w7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688143630, "uuid": "277d6907-e973-49d8-b841-296deacd31b7", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688143630, "uuid": "2690ce71-399e-43bc-83dc-cdb86a70498a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688143630, "uuid": "c25736d6-f1d8-4294-ad6a-96fbab93c9ee", "value": "9b5834d46616d9c3016f67379087c290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5634c7af-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688111237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111237, "uuid": "3a105361-ac5b-4a4d-b3f5-77b054de6749", "comment": "Malware payload (RedLineStealer)", "value": "bc651ab7a764c0be41b4050e5c3d398b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111237, "uuid": "a224bb14-13f0-4e4d-8dc9-c31b2b17e59b", "comment": "Malware payload (RedLineStealer)", "value": "200068a86207c72382308b2c8214a8a48ffffbf3bb2f390f61b8b317c2c9c09c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111237, "uuid": "9ca037a4-3ec3-4f10-a43b-5ff358952b21", "comment": "Malware payload (RedLineStealer)", "value": "4ac2e5a55abd9f2db11822bdd7e9046590ff14d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111237, "uuid": "b6a68e86-61fe-4958-a9c2-a3b1f1ff462e", "comment": "Malware payload (RedLineStealer)", "value": "301fb4e69dba73fc5c2070d1ff7a6c590d037b4ef7aa4430b0a8d5c700f476c9db25a9e85f12f9b62cc5c9b81a2e3026", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111237, "uuid": "8e7d106e-c42b-48dd-9da2-e7140e59c6af", "value": "T1840502133EECC3A5C1EFF4F780FFBB16DB6943217BB1728B5288906A1A51791521A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111237, "uuid": "64f255f2-6257-4b26-8336-a7b7d9ce77fd", "value": "bb1d8bfc6c51ca02a6f390c720552f6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111237, "uuid": "4d6823d8-29e3-4c99-acc5-eb97a99edee8", "value": "24576:EbJyltFQSnSTLlotRV/r9VJuoDzI+zouk3:EbJktFQSSfatj9V4oDzI+zouk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111237, "uuid": "6d395e18-c735-4a52-bc4f-40d4c8f0f0f1", "value": 851592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111237, "uuid": "7e9ee614-4237-4a8c-8847-669f909e76d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111237, "uuid": "ea310e24-beed-4b2b-8429-291e54bd651a", "value": "bc651ab7a764c0be41b4050e5c3d398b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362611de-172a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688118055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118055, "uuid": "c7559571-958c-47d5-b3d3-4b76229fbef7", "comment": "Malware payload (Mirai)", "value": "5958723f535e7caac01cbfb2cc382493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118055, "uuid": "17bc0c3d-d0d4-4e29-983b-f85e19da4f93", "comment": "Malware payload (Mirai)", "value": "2047230d98e084d7cf2a896edfef200c52d1b0a4e75c180f813c82934c41bf6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118055, "uuid": "dd58a6ad-65f9-483d-b418-28b7b66d3402", "comment": "Malware payload (Mirai)", "value": "bcff269461e4444342e16ce475e98b1b8a4eb592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118055, "uuid": "daeef630-4360-42d8-b769-a61404805fb5", "comment": "Malware payload (Mirai)", "value": "021ad4bc1078f32ef83b040d1219823189fefce8f2f3549c188d15d947a764cf1fbe29c9b050714d8f33e801ab322236", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118055, "uuid": "1879b393-11e1-4e63-aa45-0fc80a7efeaa", "value": "T191231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118055, "uuid": "d6e17ca7-2f12-4d21-ac9b-a8d7fccf8186", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJA:wkmaFEGarS8sxg+JcNS4jNIc329usy3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688118055, "uuid": "b7835d46-d2a3-4637-9e8c-ecbe1d76b03a", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688118055, "uuid": "a3663802-33e7-4729-ac08-66706d37d9ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118055, "uuid": "c0626f01-ea4e-4f4f-ac08-21a71f6efa06", "value": "5958723f535e7caac01cbfb2cc382493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68132d2e-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112556, "uuid": "689f0ef1-5265-4475-aa50-6faf054ed19f", "comment": "Malware payload (Mirai)", "value": "fa30dffb9061a61d6060eea601ddbe9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112556, "uuid": "d6e84bd9-f9d1-4f86-8ccb-5cfe708ba700", "comment": "Malware payload (Mirai)", "value": "21772f31e1f95331ac1a7a2addc4ee8d0dc0b791166573e1f088503efef08455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112556, "uuid": "a38eb458-7e1d-4dc1-b6f7-48eea9da71c4", "comment": "Malware payload (Mirai)", "value": "0ff99695f5b536a4436dd8c4e90586f3dc2df6f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112556, "uuid": "ad099d2e-0979-4c3d-9c2f-1a655e4e7a45", "comment": "Malware payload (Mirai)", "value": "6762b438a9aa0693e9f08393cb91917e05cd38030d19485fc691558f30f660fa02a5e7545b896ef682496aa66093a052", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112556, "uuid": "b3c718cf-036e-43b8-81a2-526c75de5e7e", "value": "T103A2C025E345AEF4DFAF6DA453C1C3C276E543C7278AC4E340EEAF012506056BB88D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112556, "uuid": "d3a5c566-1aae-4fa2-8a9e-75812553cc39", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5b7M4uVcqgw05VxJL:MRxsSVsMD6xiJJE5zRWNxo4uVcqgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112556, "uuid": "eaab83b5-d144-4994-ae9d-5fda49beb84f", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112556, "uuid": "66558483-ae87-4793-8c29-08c734f05f68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112556, "uuid": "394e66c0-2c32-4251-9bf6-357609ce2b49", "value": "fa30dffb9061a61d6060eea601ddbe9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74b5556-173b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688125600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125600, "uuid": "d4bb9c37-d886-4080-b105-b0a96f84af4c", "comment": "Malware payload (AgentTesla)", "value": "c759941da19c31cdb2165eb545103002", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125600, "uuid": "5f13f5cb-143f-42f9-a34a-0b4aeb8b97ac", "comment": "Malware payload (AgentTesla)", "value": "2270f4ee419283f98ba7bb34518092a0d6695e8bdc26af5a9c3ba4e3f72d46ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125600, "uuid": "8a34c752-b5ed-452a-a7f5-d9e1f589e8d4", "comment": "Malware payload (AgentTesla)", "value": "4ae317c0ee1635141163379ac71a70cad37666e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125600, "uuid": "520440c4-b189-4f89-bd60-8129a489bd23", "comment": "Malware payload (AgentTesla)", "value": "a7536daa0a3b5d46399ecabd39659e52afba4ffeaa7aec4c607672ddcf5339bb6d57d94078e900c11698c648b0dad9d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125600, "uuid": "63a694e5-8b0c-4e61-8ea9-948fdc500737", "value": "T1E7D4593C18BD5327C074D6B6CFD1C733B254946B3562AA766DC39BA60796E0229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125600, "uuid": "21105582-5d57-49d1-b7b8-ad0bba29443c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125600, "uuid": "85391014-0a74-4584-954c-ec132dae96a5", "value": "12288:o/oo4eEx37mbxm07hOGqXY71wSGgbXBCptxZ:+oo4eWLmbxm07hOjLSlYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688125600, "uuid": "a90ea0cb-bfd1-4c62-8b86-548f2a3be4c8", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688125600, "uuid": "e4cac825-70aa-46f6-af3f-3b843403ac92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125600, "uuid": "deb5a325-51e7-4376-a468-fddf0e10fdcb", "value": "SecuriteInfo.com.Trojan.PackedNET.1995.32456.18911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e260ffce-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144973, "uuid": "39f9dac6-24c1-4479-a7d1-c475b24c7bb0", "comment": "Malware payload", "value": "fe32f8e5652f7ed1e106a98f1b26dd70", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144973, "uuid": "a2bf5765-ca16-4a30-9d14-f20fe5179788", "comment": "Malware payload", "value": "229964e950e3d20c8fae9c45b11fc3e7288da7edc9a4ae0454e91a7b64ae4d0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144973, "uuid": "03bb4a96-98de-4ead-9b43-106037180b25", "comment": "Malware payload", "value": "a9da9ee2d7fab84445dcada2e63cc413390042f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144973, "uuid": "17acd534-4d97-495f-88af-fa3219a29c12", "comment": "Malware payload", "value": "d4cc5809d862bce67299fabea71b2e2a40749fac2f5c25db2dd9875fa4385abd866b8814c6dbe3262ec63546f78b076c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144973, "uuid": "1fb4286d-49f6-4f10-bee8-f8bb983e6c76", "value": "T136646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144973, "uuid": "733d4301-2289-4a80-be11-0c29dc3c1dba", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144973, "uuid": "8ea4ad54-14ab-4832-bf6e-b8a3c642f835", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144973, "uuid": "af86c890-05d0-41fe-b6ae-d10f8fa2f587", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144973, "uuid": "d7934a92-9096-4be5-a888-a8957c8da82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144973, "uuid": "5a1e85fd-280b-494a-8808-84d3cd19a366", "value": "95loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dc3f72-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144087, "uuid": "38e26be2-a413-4a20-8155-94ba46e7802b", "comment": "Malware payload", "value": "7f74098f87d5a070e59b03ca9b042fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144087, "uuid": "861d08a7-e341-4c0c-be32-5cbe3fff302c", "comment": "Malware payload", "value": "23af16d3c63373e2e6789381782572f3b0d17fe7587f243a100c6123ea1e3020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144087, "uuid": "75ae5a75-6ac4-42a2-acda-177324a962c7", "comment": "Malware payload", "value": "26b883eb1af62dcaf5c0d5c20ab0cd281309f04d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144087, "uuid": "d46dda96-0557-4dff-99ec-ffb2e9ef00f6", "comment": "Malware payload", "value": "5da99fec62d1ac9019ac9a2fd9c0b726bf3a31ed8d586516541856f59e6a4c90a78967328a93f0dfda34c614540ac256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144087, "uuid": "22b32262-be26-498a-bf73-78b389dc015f", "value": "T15376AD07B6D7BFB1C3481B3EC79716342B78D5C1B313D79A6A8A13EA09C37AA9944107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144087, "uuid": "3510afa0-0a8f-4e34-ae5b-bd98b1cd8fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144087, "uuid": "669930a4-f93e-4c77-9d33-f25f621fd9fc", "value": "196608:uJJwSGQtuwVvZnfEJuoblq82iYD4ehf31sD:xSTzo5q81ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144087, "uuid": "bafdc397-60bd-43f6-aa0b-c448d2b9e521", "value": 7639552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144087, "uuid": "d9a69574-4a22-498d-b283-f37be885be0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144087, "uuid": "8b837eaf-6b02-46f3-997c-50e0b05a8666", "value": "SecuriteInfo.com.Variant.Barys.38877.15119.29362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e607bc-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144123, "uuid": "70b53213-0667-4a63-b176-5351883b4223", "comment": "Malware payload", "value": "982f7112e1bf59f45d5c4351eeaf20e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144123, "uuid": "8e64dd2f-ad7c-46be-8671-c1a98f2f2470", "comment": "Malware payload", "value": "23b55daca30ed77b70f4d7908649691a23fb02fdf464fc44183cdad3df8a1eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144123, "uuid": "04295b31-3748-485d-92ff-f5b103918a43", "comment": "Malware payload", "value": "d307b737fe41f4337e3e4ee8b129300d26c2bab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144123, "uuid": "0ecfd88b-c7ef-4635-a4be-ff9b3fcccb4f", "comment": "Malware payload", "value": "724a62019ab6bf418ad3249e1bd4bea7ba3703bd23462027a0eb5a14ad590cf1ef8642f560ee3a84535ed12368559bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144123, "uuid": "bb4bc305-e1a4-4d61-b508-c7eac5aabda1", "value": "T12E863348E2862DE7D80DBFB9B972B1C2536CF97E0C96C55B915C875706E8BE0772AC00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144123, "uuid": "579eec4e-e538-4b37-a2d5-aa393f2729f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144123, "uuid": "391b3b00-08dc-41a0-8d46-aa608ec91525", "value": "196608:khKPdrGQXxeVL5Nz/PtNe6y7l+MWPUilG:GYdyM45NLm6yClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144123, "uuid": "de847271-060c-4981-8690-5b1e856c299c", "value": 8476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144123, "uuid": "a9dfb472-b3e1-4fb2-8add-69b91507e0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144123, "uuid": "b1ba2132-b530-4a23-b0e9-28d79e179763", "value": "SecuriteInfo.com.Variant.Marsilia.44777.22620.6420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d39d15-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688109651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109651, "uuid": "ee17db61-fe9b-437f-bab8-d890fd6bb55f", "comment": "Malware payload (Tofsee)", "value": "17fc098775873adf824bec5368cd8ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109651, "uuid": "d35786b8-5b6e-4e63-9330-89d0c7635ad2", "comment": "Malware payload (Tofsee)", "value": "23f4e1f0fa8cfa2a807a7d817f9af805e4e120edd8645a9998f6a01abf96a47e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109651, "uuid": "d7dead37-6890-44cd-b3a7-0abdee10a764", "comment": "Malware payload (Tofsee)", "value": "4306766ee28df160fcacc2c628dd826aa577d30e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109651, "uuid": "6f395eef-4417-4ca5-83c6-be5342003564", "comment": "Malware payload (Tofsee)", "value": "0aa90a1d1ba2d4c1145d600c62ff10eccfe5f0f2c6b8941ea1ba6709f507f7291828a87a7e65b73e4b5d344f48489676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109651, "uuid": "7634a9fa-d8c7-4e35-9b8e-50e7075792ba", "value": "T133444B0362AC7F61E5E64A3E8E3EF1EC761DB9104F19776A12389A2F15B11E3D272740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109651, "uuid": "a705e1f8-6b1b-4c06-a51f-c3d392fea625", "value": "a871d29930e6695c12484d0e1848ede8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109651, "uuid": "a6aeff9b-80fa-4e22-8a9d-c8056bd3169d", "value": "3072:YXUibJSovNQSKUWbCfADUVdERxYGI4WxxioqveEfU7+yhUpl1:w8SKUWbCfADlRxVsioq8Syc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109651, "uuid": "87187d35-8568-4616-a882-8e6703395abf", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109651, "uuid": "728a9500-fb33-4e42-b786-0d749745b323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109651, "uuid": "d5e52182-4e66-4501-beb3-7ac21fcd6402", "value": "17fc098775873adf824bec5368cd8ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ecb5a7-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144873, "uuid": "457fb75d-235c-491f-91da-2f03a6946617", "comment": "Malware payload", "value": "2b8c0a89c1a965ee4d463554218abc65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144873, "uuid": "30d6958e-b132-4be4-9e2c-c2922e6c513d", "comment": "Malware payload", "value": "24402bdf1677ac76e4af4794d0610df5868df5861f9d06f76f03a6a6a76681e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144873, "uuid": "7ec0924b-b70b-42ca-8e56-0d3a52d316ea", "comment": "Malware payload", "value": "87d4182842901ba29989ec391d7c5fb83eaddc35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144873, "uuid": "c45bfb28-0a75-43ec-9b87-742ca36195c6", "comment": "Malware payload", "value": "6dabdc1c36bd46e5771c45442304f3ab1e6ba8758d9f7eec93697a4682042c0646d4c02d8e3986be3de7ce30dc460265", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144873, "uuid": "9f0190bf-68a0-4f0d-8815-8de0d2040a2e", "value": "T18B646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144873, "uuid": "d96cf1d0-7f4c-4e27-ab15-819fe5ba4595", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144873, "uuid": "9786c166-dc75-4b20-869f-0d310f10a142", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144873, "uuid": "cefef963-6e04-43a0-91f1-95f8af5be440", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144873, "uuid": "59111c2e-125a-4e3b-be7b-4a03496b908f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144873, "uuid": "40575a41-7e67-4a9b-9c56-56d9e28f5713", "value": "79loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e152622-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144402, "uuid": "8b6e26e9-87c9-4f07-82f3-861ecab7bdf3", "comment": "Malware payload", "value": "6cc09c53a5eec79eb10e9f8c5f9894c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144402, "uuid": "67d50eab-e44c-4421-aede-4b2859b5cc89", "comment": "Malware payload", "value": "24504dd2bbfc6954a8ad9c2b81aa7c2fc12de0c478b5effaf4ed55e6322e7c4f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144402, "uuid": "a2ffd6f9-97cf-432f-86d1-508db37ba2b1", "comment": "Malware payload", "value": "1b0439d7b0b7205b2d727de41b18a69e83c8b3fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144402, "uuid": "2ff76565-8f50-4ebb-9860-357744b3edfc", "comment": "Malware payload", "value": "f0a9ecfa8dff84af9a63af98b409ce0ea8b6fb9de40ba308307c751606d00bbb13309dea31231c50c3a4e150ca837d32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144402, "uuid": "9a64b3a2-707f-4902-96a2-1e59248e3a33", "value": "T1BD646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144402, "uuid": "f95517c2-dcdc-4e7c-b0f1-00181a19fed7", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144402, "uuid": "01663ec7-0356-4247-8c00-f303343b53ff", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144402, "uuid": "df7e7fc6-e918-4cad-ad49-a0855fb7a6e2", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144402, "uuid": "352d294d-aa61-4a90-ab3c-9799432e9aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144402, "uuid": "5b63bb66-95ca-481b-bf9c-7305a25db738", "value": "1loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e55783e-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150738, "uuid": "e8278b4d-8e71-4504-9803-534ac67e7b84", "comment": "Malware payload", "value": "eb457508c0786ee25e66069f16e16e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150738, "uuid": "cf026064-7f9f-4755-ae87-184287bf3734", "comment": "Malware payload", "value": "24b05dea7290ca2ab8b49c9efd04492a09fc3e7d6cafba2003316c2a80155645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150738, "uuid": "3ff2fd3b-f307-4589-9a5c-86b5146e3e46", "comment": "Malware payload", "value": "f830789855d8e59b5bc361856ff5d5a11a875a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150738, "uuid": "1b593b4e-49fa-45bf-9a94-4ce2bf9f3366", "comment": "Malware payload", "value": "c7610c872820beb9b799d2942c873df89b90dffc3bfcbe4adb554472a0d2a139882cced6c6c97c1bd748d1ae905931fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150738, "uuid": "8fdd4e39-fbc6-419c-971d-10d2c1f5bf27", "value": "T11666122BBF5A8EA2D35A5B76E55B94094B2CCE41320BCF2F398E3351347B759AD40702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150738, "uuid": "4d004129-4e0f-455e-91ff-7e17f3727186", "value": "98304:dIxzgXZqWTjP7GES/X/QxsuU030V7zGzXPncMLumIbDgUY5lUIxfK7uCmnl3gy:dW0puPXQy0+7zGzfna3gUYzfEFmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150738, "uuid": "d18de141-574b-4201-afae-c627924eb45b", "value": 6873600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150738, "uuid": "5c438b73-0776-4621-ba3a-29aafc89ba05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150738, "uuid": "087e046b-dfc0-49f7-9155-1fc327256f4f", "value": "SecuriteInfo.com.MSIL.Agent.OXE.tr.dldr.21798.30738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1322da3b-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108977, "uuid": "e942146f-cc84-4f19-b50f-36f47c356573", "comment": "Malware payload", "value": "c68b99dc731b7314ea80e4f270468713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108977, "uuid": "abdb0656-c77d-40b4-8aef-c21d437cd19b", "comment": "Malware payload", "value": "250572b649dbaa3e1d1cfc94579eeaed19752310c3e95b7c4105f62bc7385832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108977, "uuid": "5fd32c3f-f6a8-4e57-a128-b8a08f6ee136", "comment": "Malware payload", "value": "c0541ebf8701d8b6145089297722276f84dc3a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108977, "uuid": "517ab0cc-f4c4-46b8-9ecc-ce663d2e6574", "comment": "Malware payload", "value": "c587698914870f56192cbecb4bba7404f0648db3cfe3b53d511d891d87b7a3ee2c61b2af490fc6b8328c9eea701fc6cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108977, "uuid": "0193ede1-ff82-4361-a08e-9101844aa973", "value": "T1F4354C5BB79DA735D5AF1ABFA0E4D025A7A1C94A838FF38F9D8AB6E014413507C08173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108977, "uuid": "0e51c64f-b34f-4b50-8be8-74b3ea7ff183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108977, "uuid": "96fa48fe-f87b-42bd-ba0d-fe7315676c33", "value": "24576:VituJ4/Ne9IXnUjTo1PrbC08KVoiyicGeu6GO:J9snwTo1PrbC08KVoiyicGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108977, "uuid": "7b372d3e-82e0-4cdc-b4b2-bb70483e8539", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108977, "uuid": "8753433b-18dc-4d34-816c-ea0c04f657eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108977, "uuid": "121817c2-5bb4-4435-a710-27e0982ff46f", "value": "New Order Inquiry P.O#20015.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab80519-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144182, "uuid": "62be703f-6c55-4662-8d68-dd0efa1f13e1", "comment": "Malware payload", "value": "f9f57aeb7d905405c2ffe1e4a30762f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144182, "uuid": "3c9389f3-5522-401e-92dd-05c754f7c4d4", "comment": "Malware payload", "value": "25e0f6235b109679e8f74f142eb8807c825d33070c7161c86b9600650559247e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144182, "uuid": "a1bb1311-873b-4336-bcbd-814941736e55", "comment": "Malware payload", "value": "97f935457a5bde2c1c8f2f9c4d657fb44e565f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144182, "uuid": "6b92813f-6608-4f61-a01d-a8ba04791e9f", "comment": "Malware payload", "value": "b0d47a5a49bed19863ecaba1438c85ad7302e49dead8e2a0b0d93108f886d2dac3f6a1ea566e17d41de4f67219605f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144182, "uuid": "2859d042-8c73-4f54-97cf-3cddb4aafe49", "value": "T1C096CE03B6978FB2C3891737C56B16246BADD7C17313D63A6A8E137A09C37BA8D44207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144182, "uuid": "83797afc-68e1-4d13-bf2c-38fb78d04751", "value": "98304:XdAkZ7nzqbc6oqes6pLdpqd76SqPmDr74CibCFky/aXFT+jYLIWimNK4BQMMV43Y:Xv7GcJpLDK6CbLAEYiHM243lMNRR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144182, "uuid": "16494542-3da0-4d90-86d7-cd49bb8fcbef", "value": 9271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144182, "uuid": "bc061526-6723-471f-abfb-004586560558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144182, "uuid": "4305f6cb-10ac-4af8-b634-6fbd8ade9c5f", "value": "SecuriteInfo.com.Trojan-Spy.FormBook.29615.14732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8d42ae-1703-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688101452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101452, "uuid": "0b2980ea-2295-4ec0-afe9-58dde3b1ae93", "comment": "Malware payload (AgentTesla)", "value": "1ae65fb93ed87fe8e82252ab2e61f54e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101452, "uuid": "7533251c-f3b2-45f4-afcf-81c4d884170c", "comment": "Malware payload (AgentTesla)", "value": "262c628a173fda6f1b751bc12415daa77114b0f7eff6f07ec6329b4f79e68369", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101452, "uuid": "c3767a05-51d6-4023-b168-ab20ecdf72d7", "comment": "Malware payload (AgentTesla)", "value": "661774816ea7f458838f4cfc68aa2f16e8ecd35a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101452, "uuid": "b4e76731-1fc0-4ee5-b3fe-119873bd53cf", "comment": "Malware payload (AgentTesla)", "value": "3a0e86b6510098a4b1603376e77913725005721648df17f1d27e5a5b553866ab67918698de7ed111efd0770bbda97af7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101452, "uuid": "c22ffc2d-7e08-42e7-aa0f-38a746727109", "value": "T1B2B4338C81164C67F02BA108823C72A47EDF97B9AEFE559AD1056C61CD0FBF25E9131B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101452, "uuid": "346644ef-ffab-4d7b-8495-d69364e87551", "value": "12288:BVVtinYA5coP9o8Mhu97vUdHtfg3vX1wRuTB1RhXY:BPt85co1mOUHZg/X1wRYXho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101452, "uuid": "d5a726f7-901b-4d20-a869-b2d28988f357", "value": 524763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101452, "uuid": "fd2a6d4b-b147-471f-9862-13900feea82c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101452, "uuid": "43388726-ce4a-435d-b86d-a969868efec4", "value": "ISF document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca362cc5-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154382, "uuid": "af4985f4-0402-4f6c-975b-bbcf1eb67308", "comment": "Malware payload", "value": "a44206287b0729889a74feaf1de4786d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154382, "uuid": "6f6e4f9e-5149-4e57-9719-a0d2e572b106", "comment": "Malware payload", "value": "2687303ea1f52044cc12fc5a6d691e86ff948c18c87a7801d0b4bf374f2468b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154382, "uuid": "a7de1895-e2fb-44a5-9d98-76c606025741", "comment": "Malware payload", "value": "8ea6c6946c46682c2ff4378e322f517cf9efdb60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154382, "uuid": "101d81e7-b369-4e51-acae-5adb1627e017", "comment": "Malware payload", "value": "2ebf688e2989b95e7d8b913a3aa9debbf356313825af03f099be5dd6684ec782d83f2067405fe61787dc8560167185be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154382, "uuid": "eb8a8f7c-f62b-4d7b-8728-41e4c09faea5", "value": "T154560208F3588B57EA8F0BBD9B71905887BDC601E146A74F1E8DE5F29483390D94DCAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154382, "uuid": "5aa05c5c-25a3-4bf5-bb0c-57f1da709a4d", "value": "98304:TZKq4kFR8iRyqfzlf7KaCVIWLhCFywDhotVOPYX8aDSLonP6ou9sc:TZ94kFRFRyQm7yFotVOwXtuLoc9sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154382, "uuid": "e320b798-af56-4efb-bde0-a994fd55f21e", "value": 6351872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154382, "uuid": "9a0412d3-61ac-40f9-8c5d-2cf75c1880df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154382, "uuid": "1ab0c117-30a8-4d6b-9d0c-04eaef5025b4", "value": "SecuriteInfo.com.Variant.Tedy.386572.11501.23190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6261318-179e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688168119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168119, "uuid": "4e886c33-db6d-4b69-bdb0-59095050afa7", "comment": "Malware payload (RedLineStealer)", "value": "4a4e6e2209fb3a909abf3968daf53fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168119, "uuid": "583f51ce-b729-4258-8e9d-82eb8234ebcf", "comment": "Malware payload (RedLineStealer)", "value": "275d1d89926c665e164d81b5be7393a626f1d30aba3cd2e46c3556b5327730c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168119, "uuid": "6636369f-784e-4b49-85f9-47ecbe03c06c", "comment": "Malware payload (RedLineStealer)", "value": "e17780cd7df56d7a58940a4d8088b3988f2a61d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168119, "uuid": "62e764a9-d186-4a8c-8246-b5cb981843a7", "comment": "Malware payload (RedLineStealer)", "value": "544f5675ea788d0e0962f60773a4b55fb86e858b686ef23c546f78470509ec03ca2f4278e172b60ae79e12260d2a8388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168119, "uuid": "25147106-82de-4364-85e3-1d639d620cae", "value": "T1E6644B8392D07EF6E5364B72BF1FCAF8360DB1568F493B6522189E2F00B8176D663611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168119, "uuid": "1625fa16-afe5-4e65-847a-482e5d482b64", "value": "c1f59b5b7783d7b87e622c768d615c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168119, "uuid": "a3031ffd-77f8-4a09-85ad-ffd2cc35e3fe", "value": "3072:dl5vZCiky6G2WujDO6kV+5ck6jqWO+HO5z5TMG6y/XyTs:75RCik3G2bsIakIJOhMny/XyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688168119, "uuid": "eca55ebd-059d-45ab-ab2e-5e4fd40a6e16", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688168119, "uuid": "faa69c84-b2d9-46c4-9467-714267525f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168119, "uuid": "b3518e66-f0ae-45cb-8bba-861bbdbd04a4", "value": "4a4e6e2209fb3a909abf3968daf53fa6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b679f739-171c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112258, "uuid": "5d15d897-70dc-4388-8a9f-d715a45c7421", "comment": "Malware payload (Mirai)", "value": "8f94901e476ae959476bb8bc376485e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112258, "uuid": "21d86bba-baca-41d4-bde9-1788891b4355", "comment": "Malware payload (Mirai)", "value": "284f9d85bc25a93c1f30bc2eabdf1171fcc489ebc3c26a4aa8efe6ad279dc639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112258, "uuid": "b61567f0-f4a3-43cd-ba26-f611cf373fe0", "comment": "Malware payload (Mirai)", "value": "3f81f2be503b9397554d7f76fdd12dee585bc44f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112258, "uuid": "80451a9f-1d47-448f-80c5-f059804064f3", "comment": "Malware payload (Mirai)", "value": "52c2486a98c1ecde3e8bbe8f5462ab9e423bcc5daf8e8061809e0398d1e897f61bec6b2f51d962039fd15088936e76af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112258, "uuid": "b43d2bd8-22f7-4413-8ba0-b136e8daa87f", "value": "T153E2D168E0CD5D5BE9FBFE70CD93E6D523282F4DB9CB098195C0D3129911E392614CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112258, "uuid": "d6c9b588-f128-4a4d-8b71-a22ad3a96937", "value": "768:1nyPGk8GDuY0RPS7gIU3AsUtWOpn4uVcqgw09k:1na85aItXOn4u+qgw09k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112258, "uuid": "c071fcf9-d3ff-49f4-a586-195cea3d4c64", "value": 32292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112258, "uuid": "5c64a563-7cf6-442c-8b8a-2f6ff942ac93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112258, "uuid": "1d3b0839-1147-4f2d-9a33-af859e24c746", "value": "8f94901e476ae959476bb8bc376485e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63c14be-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131638, "uuid": "892e2a1a-1960-4ec4-97ed-9d2be6875093", "comment": "Malware payload (AgentTesla)", "value": "1e54d5721a20e0aa036b978fba2fb163", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131638, "uuid": "de1b5c8e-be71-4c08-bb1f-381fb8442990", "comment": "Malware payload (AgentTesla)", "value": "29f7d3975eb7f911ac01f5e965e3009e1be7723edb854007e2a94a6171accb0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131638, "uuid": "90cc5eff-b783-4d36-8de6-4d329a98dc31", "comment": "Malware payload (AgentTesla)", "value": "31009c474c0bc721f616545ab342311a8ff2e745", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131638, "uuid": "ccd78014-cba6-4010-b2a9-3de914330ac2", "comment": "Malware payload (AgentTesla)", "value": "7a0e7059dce8c812c62f594dfd158b66f2ebdb1e99912297319e4327d479cc681a71512e2c32e5e816122f14a11dfc1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131638, "uuid": "2783040e-d120-4dd7-8824-44623409eb2a", "value": "T129D4334C80A325448277BBB2CF6072DB5E439E99A8F129E374B7764CA1D7CD50D2A90F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131638, "uuid": "0863424c-0ef5-4781-81f7-1adf495e98d7", "value": "12288:4xak1ulRDNtp/3hUj+W5WmIjm0WWCscfWTQMjZyY/bCUrw9ExP+t:g31ulLtp3hMD5W3m8/gY/+Kwexmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131638, "uuid": "3b975207-b314-4f5d-a91a-96d996220979", "value": 620807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131638, "uuid": "fbfdc103-f45c-4665-9d1b-3292fa4b7855", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131638, "uuid": "8d408c89-4a61-431c-9334-98141c2c4724", "value": "comprobante_swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c22acae-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144372, "uuid": "f04085c4-2b33-4395-adf0-54a89826d3f5", "comment": "Malware payload", "value": "c983e12f5e72b0ac0813f6cd6db24ebb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144372, "uuid": "335e02eb-2f51-465a-a843-51fd3f695b36", "comment": "Malware payload", "value": "2a0cd4242842fca2e99612776e115d80ed1040039c1b44f3192431b1f865e415", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144372, "uuid": "ba8567c3-cd27-4b02-abe1-7d3aecba73e6", "comment": "Malware payload", "value": "5f44e7e77aab316927c0c3b08c8bca52a105b575", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144372, "uuid": "2a7fd19d-2f70-4bde-8bbb-7445990375d6", "comment": "Malware payload", "value": "82a8cf3bcfed3884b3b646e7d714e78fef5493b067442c07173ed10c3d07198600264de7054f14514e4cf0561c6323a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144372, "uuid": "d703ad02-061d-4ce4-995c-6d57feeb26e8", "value": "T11D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144372, "uuid": "1c24cf80-9e0d-400a-aa07-c8182abd1269", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144372, "uuid": "1441d53e-0df5-4aca-894b-f0fd7087a39c", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144372, "uuid": "9f486d58-d353-40bd-a43b-9990657fa48c", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144372, "uuid": "d629edd5-b62e-4036-a6cd-c45ea3c4a91b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144372, "uuid": "6717a252-8f96-47f9-9e3f-083a9b86f794", "value": "15loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e8f59b-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131448, "uuid": "33affa9b-9248-4912-827c-7fe1a82e91a5", "comment": "Malware payload (AgentTesla)", "value": "03c4fa55b722503e4d0c5a763fe73499", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131448, "uuid": "45902271-e980-4617-acf5-0016426765e6", "comment": "Malware payload (AgentTesla)", "value": "2be2d84da21ebb26725281d12bfb989af6115a9494b6de2a154c2cdd79f50799", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131448, "uuid": "4dd78f0d-5170-4f23-9666-35c7f105474b", "comment": "Malware payload (AgentTesla)", "value": "97b5cf5452ed5d386578cdbca9214961450f30e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131448, "uuid": "ae8177c9-e703-41e3-8a7d-400f1f34db97", "comment": "Malware payload (AgentTesla)", "value": "a0c8e6d4f4f0d3534e2664cae3958e57e1f63e45f23c3bd0743322b37238fc94cd7efeb18399c960daab17834c967162", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131448, "uuid": "89614901-725f-425c-a0ed-d22185f5d315", "value": "T15025D824997E0913C064C3BDD6C1E32FAA9D4D9724209B321CC27FCE5F7AA06159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131448, "uuid": "1b26bf25-0b1c-43cf-8962-32dc36a5bb03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131448, "uuid": "2db54a40-7f8c-4816-9498-5f8953c9c52c", "value": "12288:K2Bk76pLnb9gZ7Y4a/MRoeC5H3B1Jo/ONOD3eHd:K2usLbCZ7Y4Q1eClvJofD3e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131448, "uuid": "f133c0ca-5a94-477a-93a2-690badc246b5", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131448, "uuid": "02c62696-7b63-457d-a1b8-37cd9d1b121a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131448, "uuid": "bea18e56-2655-4593-b284-5a1e03a56e02", "value": "z1piSpk0lgzRoWENc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7702a559-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Metasploit)", "timestamp": 1688135774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135774, "uuid": "0c8eafe3-ed82-47c4-9663-7ca81e978787", "comment": "Malware payload (Metasploit)", "value": "12471e2a6e8ff8feee7a954b72d2dbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135774, "uuid": "c39787e7-28d3-4893-b31c-65d5f02528d5", "comment": "Malware payload (Metasploit)", "value": "2c1202010c1914e517f2d1303c82283286adbf56be408d0facadcba5154598fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135774, "uuid": "534690c3-572d-4380-b1dd-167277bf325a", "comment": "Malware payload (Metasploit)", "value": "13051b97dbc32cd74c1efeb4ca8493b8ec2888ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135774, "uuid": "7f57cf46-f71d-4b5f-9c92-a8610f54ba4b", "comment": "Malware payload (Metasploit)", "value": "874ac12ba027660a61dd96fa2e65f44ae856e51cbb4c072b8d95d7abf93130d3624d1bd386bd8f478097d991120e27cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135774, "uuid": "05c8c2f3-3cb1-40f5-af08-9282aa0f239e", "value": "T13DA6330973901CE9F9E2503594B14922C276B9730780D98B5A78A2636FA7FF47E7FE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135774, "uuid": "7c7b627d-5c5a-4298-a1a8-3eab664021c5", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135774, "uuid": "da72d417-75cc-455d-be6d-2378392f797b", "value": "196608:P1x705fhkEI/F5D/SFGK1GICteEroXxWVfEqlbkkwR7VTE2EOsUr6VDDpS:rEhQfukInEroXgfEqirRRotJUOVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135774, "uuid": "ac86a38e-28e9-4402-8b5c-c9805276eea5", "value": 9892606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135774, "uuid": "e5d09fed-008a-45d0-9468-2464665ddada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135774, "uuid": "e6114296-6dd5-4edd-8f20-be48cbbcde96", "value": "\u4e95\u4f0a\u306e\u3070\u3089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d38ce3b-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688109531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109531, "uuid": "42e8441a-0600-46fa-942e-2e79e5cc2678", "comment": "Malware payload (AsyncRAT)", "value": "095b6b74e7a848e9ab27d08b7cddfa9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109531, "uuid": "5784f103-106e-49e1-98a9-24ba2b4f5db8", "comment": "Malware payload (AsyncRAT)", "value": "2cdb4743c6084653715446d7103b5ab3ea2b81d1785f2e5d0af5f34dc851de5e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109531, "uuid": "eadf42cf-fe85-4228-88a9-f90f2407ed46", "comment": "Malware payload (AsyncRAT)", "value": "e3b3632089d41a73325a7a4f117a1227e2dee22b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109531, "uuid": "53b54905-d10e-4ab8-93d2-28a0d0364684", "comment": "Malware payload (AsyncRAT)", "value": "1c1408dbb6b1ad956f2b49e723d1f9e5d2f34f8913a0dddf03347c63e279d5999326fac7e1ded40c9b924c791951f647", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109531, "uuid": "c696c352-4752-4824-958d-fab470ad2300", "value": "T1BD347E1437DA5A6AE3BF9BB8F460011593B2E413B526C79F1EC498EA0C93315D990BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109531, "uuid": "1c5c77fa-9de5-43b2-807e-49d3e963130c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109531, "uuid": "312e9e14-4c12-4365-895c-0a88f68b49c0", "value": "3072:D+STW8djpN6izj8mZwwCJ+D42QTKseUbBfHF8wzxAA8ta9rBKiDoqkxoVfo16+Wi:g8XN6W8mm5epUbP8uTV5k+Q+fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109531, "uuid": "6259cb96-24ea-4679-8426-4875d84d35a7", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109531, "uuid": "84acbd60-9ae7-40d6-8830-d2f4dfad9ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109531, "uuid": "819c2c1d-6b39-4a95-b344-f2ef733d5884", "value": "095b6b74e7a848e9ab27d08b7cddfa9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6ee973-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144879, "uuid": "dd3f4a84-070b-44b4-bd80-973ede188ef0", "comment": "Malware payload", "value": "cfb5c364106cc3971e5b2f81f6d0a445", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144879, "uuid": "cad3ee75-1127-412c-a274-c6740da846aa", "comment": "Malware payload", "value": "2d2c3a8b6fa5ff7f53c2f6ac3a5c43308c0645b41a552a58254a1b44763afca6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144879, "uuid": "e1ccb842-7fb5-4a6c-aa2e-08a98a400f09", "comment": "Malware payload", "value": "c52e83552de01b2485b9b886a37fbde050f74d7e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144879, "uuid": "98e5ae88-c2f6-4a80-9ead-e444f1b0e55e", "comment": "Malware payload", "value": "c70bc4cb39d1f47700f4d6aa4fb6a4159820f02152179acb6ca78cc3e168d67d419b6f1195d8fc5bf5c759478f1f8037", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144879, "uuid": "628431c6-970e-4d55-ac37-c531e8976265", "value": "T133646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144879, "uuid": "c0b9aa4a-dfd8-4455-8e1a-e8b640e94a23", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144879, "uuid": "3eddf0c4-0f2b-4df0-b6e6-c0b400541885", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144879, "uuid": "83a5d09a-1b36-4738-9333-da930c714302", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144879, "uuid": "b7106346-4407-4433-9fc7-1bcf8e7b0a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144879, "uuid": "fe365b11-5be7-4ea2-ae52-885f5d54ef1c", "value": "7loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb4baeb-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135815, "uuid": "cc9c43a6-8ff4-4e68-8fac-70d326145193", "comment": "Malware payload", "value": "8ef75c4e34da6a7e7c6cf0eacabdcc47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135815, "uuid": "3bd53ebd-29b0-454a-92fd-40405e22f6e9", "comment": "Malware payload", "value": "2d7c79940727d8309cafe7c58204386db4d08c42623087e1acc36d7b8fa670e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135815, "uuid": "4b7f7bbf-275d-4344-81b9-949830ca1a9e", "comment": "Malware payload", "value": "c7fb598ca7d72e2ae16dc4636381557601ad3a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135815, "uuid": "ce13347c-bb24-45a8-ac9c-364dccbbab02", "comment": "Malware payload", "value": "fe6d0a36ff1dec67c767842adb1720bb0e19979e9a04b4522aae3dd58a26c97e589b550f4781fadc04eb4c7b1ec27a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135815, "uuid": "6de46464-4bc8-4557-a96d-13f2ba34ec82", "value": "T18726339B2DF614BAC8949FF20653B4B1973AE32A837D5ABDF74E2C0DF641369418E500", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135815, "uuid": "19795f68-f337-4bf1-9169-138d32677c1f", "value": "bca6eef833a3a9c7d08eeaa3fa5b1e34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135815, "uuid": "05afaa05-2ca7-45a0-bc8b-3edca99d0b49", "value": "98304:ceWBd2WBznSMTgXOdsL/vNliTMasp5MdM9FU19vpI:NagXdLXG5+U1Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135815, "uuid": "722e7c2e-9b14-445a-827a-ee5bcd02a513", "value": 4845568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135815, "uuid": "cc224405-b7a6-4cec-8580-57236f70357a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135815, "uuid": "8fa5e8ca-4f04-4667-99bf-8f94100ccfe3", "value": "vvsoy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f57b081-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108166, "uuid": "b08586c2-fdae-462c-9d4d-f6fbeb56607b", "comment": "Malware payload", "value": "b3a2da8e99a92df8796ccb82fb7c07f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108166, "uuid": "7b8e6cf3-fc0f-479a-bbfe-ca44e87ca3a0", "comment": "Malware payload", "value": "2d7f0de779464abe0578741fdf7496bca72f258e11cd1173d6c87cfcd5070fd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108166, "uuid": "cf44d38a-a122-4fa6-a721-94f2f64a6ddf", "comment": "Malware payload", "value": "74a04e3a4152f216ffb065c2dd2ee003e66cc06d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108166, "uuid": "5d2285ed-fde8-426e-9cf1-e8c3edb2fcf0", "comment": "Malware payload", "value": "4b7eb66e4d285732d68e70ca825a83618ec698fc5f6369c42e07909d1d82c1495bd0034fd7c997c30904e698f6484f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108166, "uuid": "b476798a-9eb8-443d-b970-990e46dc7eb4", "value": "T19B551202B9C148B3C9721C335A785B20593DBD201F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108166, "uuid": "45bbf0de-5353-41e0-b8fb-7a41e6bf7dbf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108166, "uuid": "ab4dd723-b981-49c2-b0b4-dd173a0780b6", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnA5:IBJctgBhc6Kus+9gO0qnA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108166, "uuid": "004cebcb-f69b-4e07-a19e-2e153b2c2563", "value": 1353331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108166, "uuid": "5999f415-46c6-40b4-b8c7-7b6205ec4f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108166, "uuid": "96a593d4-cb04-4771-b18c-381ac58afbba", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93790cc3-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144841, "uuid": "1d3dcefd-a314-4c5a-b71f-bc5f3d052ba2", "comment": "Malware payload", "value": "e839e1569f97133659884b5d5d2a49ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144841, "uuid": "091c63df-52ff-4f4c-a59c-1946767bd648", "comment": "Malware payload", "value": "2dbae146dc9a47f564b57571fa47289259ab6dd13d59133374e5d0bd5eccf187", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144841, "uuid": "d335f0e6-0a35-4946-8410-79b0a1aaca0e", "comment": "Malware payload", "value": "1b1e6af4dd166fa372577f84f0a4b6840f445895", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144841, "uuid": "fc460d5d-a363-4991-b86a-d81ffe175952", "comment": "Malware payload", "value": "b38c65d089537b430c1e5a74d22cf46251e58c2c868f66e11530e85ed931a01a3c6e9de91cc206d9dbb83c006b6fcbc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144841, "uuid": "80302cd1-cba2-4780-906b-6edf48733b47", "value": "T15E646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144841, "uuid": "b4ad9c0a-c5e4-407b-b40e-ee269902a75a", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144841, "uuid": "3087ab3d-4ec6-43e0-a2b7-ae02b9ca914f", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144841, "uuid": "24949fc1-765c-415f-a270-0b55b4c14f5a", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144841, "uuid": "e415d803-c684-47ae-82af-0e8d12fd06b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144841, "uuid": "389f9f35-12e2-456f-a6d8-1372e87e9708", "value": "74loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ebcf4b-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "4dad8edf-e6db-4544-829b-a460c7225ecd", "comment": "Malware payload (Mirai)", "value": "458533f97472ef819373eb2c5bdb35d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "b55e1782-7ec8-4428-b10b-526832d7691b", "comment": "Malware payload (Mirai)", "value": "2dbf8e792af2a953d6e3645b5e186e2b763895968947b1cb6ec8cb9f23c2d828", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "556d5b11-5c27-4aaa-a125-3eaee3d86509", "comment": "Malware payload (Mirai)", "value": "65e235b9ce67373bcf697b96aa99604411066878", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "5e273659-61af-4d75-8122-11dfb93a9eed", "comment": "Malware payload (Mirai)", "value": "452930788edbf9abde495fd5bba761da3fd5e65fce5c957e98dcf81c9ccb27bcbe506b875ca36c7e6776a48c30828d12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "891bb3da-d93e-4e6c-8e89-08dcc0f51896", "value": "T1DEA2E01572A32D56E3EC1C3DC96E8357F9A70BFC90F5327679415620C94924A3E38B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "eaf19269-33df-4ee6-b43b-e7a5de7fcda7", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjshymdGUop5hU:vvQn4j+ZO5fKAlxws3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111420, "uuid": "ad296b41-f0db-4a0a-8735-a1e76d68163c", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111420, "uuid": "a46c3a1b-76fc-4bf0-bf0a-2855cae9e07d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "82b7c919-2198-45c4-87cd-c18a65c260b0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3480032-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144518, "uuid": "c9fd4cee-9f39-4938-91f8-0f604556fca3", "comment": "Malware payload", "value": "48265db4bb89ae90be2518d3ab12cd0e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144518, "uuid": "0439a684-5acf-4f56-a8b9-81c3636b18f4", "comment": "Malware payload", "value": "2ddb79276b8e0a72f1c1c1b52a3eb34306ecd5250343d4789d5c9c0d05302be8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144518, "uuid": "add5c84d-c665-47e7-a0c6-874042fa6d4b", "comment": "Malware payload", "value": "415f3b4fc200d105fcaa07ad237aa54dd99bd2cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144518, "uuid": "9bed2f21-a4f1-4c11-be91-0c2e59a09c97", "comment": "Malware payload", "value": "13ea5224b6f9d86c3e527d5e87543ccc9eadac275bff6d053e51dbeaf790d68fdcb82688567a0f74bc566a37f6995b8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144518, "uuid": "0e9e0f33-d4ac-4060-ba51-fbe4f8fbdb20", "value": "T164646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144518, "uuid": "b257196c-3c72-4f88-bb8f-c55dfcc11d71", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144518, "uuid": "625bd174-5202-48c4-9a33-8e06f9541bc2", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144518, "uuid": "1fae13f0-dd92-48e6-b05c-6f81292dfd62", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144518, "uuid": "a551cb17-e3f2-49cb-a399-c354e3112edc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144518, "uuid": "de39a541-b2a2-4458-afc2-167b0e268a1d", "value": "36loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a303a2c7-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688111366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111366, "uuid": "05ee37a0-43ee-493b-86b1-1c5a43d9939a", "comment": "Malware payload (AgentTesla)", "value": "64b1852c267d339ac93100e291da7aad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111366, "uuid": "56a78ed9-ecb1-4e77-bbcf-7b777dc92e1d", "comment": "Malware payload (AgentTesla)", "value": "2e29e6a4b0be6fc27da448eec0e9f06757ed24399cd33af0b113f51062fe6608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111366, "uuid": "9e0d3239-bd41-4997-bee8-74e8e04f85c0", "comment": "Malware payload (AgentTesla)", "value": "9431785a4d91cbfa0a907f5fcb27623bb2ff8417", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111366, "uuid": "ab2ae8eb-f7c0-4b7c-b24e-3541e799b0ce", "comment": "Malware payload (AgentTesla)", "value": "3b52a5c96bb4611e3edb470bb4db7da772b3a01f1f9029085c5547e611276a02518b30edb5aefbb1aefa0b744389c7f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111366, "uuid": "d508c6de-a72d-452f-a7d7-102f62ba44b1", "value": "T180E4483D29BC5723C130C7B5CFE19723B224982B3161EA365DC39B964796E4229C367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111366, "uuid": "58880c48-6328-44ca-8b4c-313a87bc034f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111366, "uuid": "706f95f3-67b9-4c53-b9f5-5ddf2e5ff5ff", "value": "12288:sFNFLxFOcpB6dov97hGKJrTb1Ry685ZjGRQH:SNl+c7PF7h3JrNRV85hQQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111366, "uuid": "f9447f6f-beb9-409e-a2a3-6d756aa735ab", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111366, "uuid": "225ad63f-00bc-4764-bf7d-36f52d09d705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111366, "uuid": "f493b20c-995b-443d-81da-e509ebfb6fa6", "value": "64b1852c267d339ac93100e291da7aad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67883095-1755-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688136607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136607, "uuid": "1ec43be5-5cf9-4310-821e-939dbac35b16", "comment": "Malware payload", "value": "00c38c824575c2468d059365952c8ce7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136607, "uuid": "2c2c0d4f-63c0-4836-897e-14699cccc8b2", "comment": "Malware payload", "value": "2eeb4abb3591e78aef882455d3cee633d3e8a8a3d98811f16bedc5db1698a427", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136607, "uuid": "c80cd389-bfb1-4251-872e-2ca7c0d957c8", "comment": "Malware payload", "value": "8b3dc208027a2e08d4b47b2dfe07d666b7930922", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136607, "uuid": "03c2a187-2991-475b-969c-83dc9a4555f1", "comment": "Malware payload", "value": "bc3b4311c836f7aed8b8cae4a24e81636f22547d883f0d73f38765bee45aa1eb31ec25ac24f94b07562f0a184dd0365d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136607, "uuid": "507742ba-f253-4afb-8c07-391b81dc2bec", "value": "T13E530782FC81D902DBD4137ABA6E51DE33253399E1DE7207DD126F503ACA91F0DAB192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136607, "uuid": "888d898b-0e15-493b-a380-1d12b079f0a3", "value": "1536:sYHNGMH6qn1tQfSKUyB/QmGVqCCtJhBOF7UJtz:sYtFH6qnVyxLfK7UJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688136607, "uuid": "58f8cf6f-a797-440e-a176-69f488fba10a", "value": 64064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688136607, "uuid": "9a840933-2af0-47df-a53d-53d9eb0d834e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136607, "uuid": "12096aed-bd5b-408a-8e99-a97e9d28bb2e", "value": "0xh0roxxnavebusyoo.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c281fcb-170c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688105154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105154, "uuid": "681d6aa5-5714-47e1-aa55-925be985c1d6", "comment": "Malware payload (AgentTesla)", "value": "fc9d19003018b53bf56e9a6a00ec1674", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105154, "uuid": "ea03540f-f0f4-4ae4-8af0-a31591c7e802", "comment": "Malware payload (AgentTesla)", "value": "2fafb501cd734bb370ebf3a5e7b49089620aa4c4556b6a1d79277b1fce36118d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105154, "uuid": "dad47bc9-229f-4616-8657-462f04f0fd40", "comment": "Malware payload (AgentTesla)", "value": "772871b924dda8a1c97a00a82c6b47a949c21012", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105154, "uuid": "9d86fcc0-aa21-47b6-9f3d-fe5a1247b86f", "comment": "Malware payload (AgentTesla)", "value": "f2f342288612f563c150c9eb50d39c1db32013a7cf2ea124f3c3148e4b7d1786fc7a8b0b66bd60b654e72a54eacd9be7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105154, "uuid": "6d7914ce-81e5-45fc-9a20-c3685ec42f28", "value": "T194E4493829BCA327D178DBF58FD18423F7A4952B3126EAE56CC253954356F1229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105154, "uuid": "7535f825-d1e5-48fd-850c-462e7a50a898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105154, "uuid": "7a190774-047d-47f5-8ca4-33aadd31b71f", "value": "12288:+9XncUxf01gJOy+H0mPoWkAUdru6mcHHAISMWHuBxRq:bmUH0mPoO6rHAG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105154, "uuid": "ba7200bb-4693-4c37-b6f9-f8b5d55ef13e", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105154, "uuid": "7164c56b-d074-4e16-a516-9a24c7deb6fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105154, "uuid": "5228ea8b-afa3-4c70-a379-5b33d4c82d4f", "value": "Paul Reinhart New PO 79071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e23c3e-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169266, "uuid": "71cdff31-9bef-4d4b-adbb-46a4b3f0b17b", "comment": "Malware payload", "value": "e5f7f85299ca7073173f7033b7454334", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169266, "uuid": "0ff142ca-a91c-4520-b8cc-3ce92233eccc", "comment": "Malware payload", "value": "3079b6363d0cf2832980ed9bf8f6a75e4a86cb6ac4be05ebc0a3a9314dda0235", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169266, "uuid": "6656c1fb-e44d-4102-b18f-afe018010233", "comment": "Malware payload", "value": "be958cbf52f4889c54b6dd1b57c0efeed47b7f68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169266, "uuid": "eeed4744-f2b8-40ed-a74e-d23a055a96b8", "comment": "Malware payload", "value": "9220678ee0434be3c6624dbb46e642f4d88b9ede00c4269810a09529c2465c23ed3bfbb6ccd5d4f261d1e0bb24f7a8de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169266, "uuid": "2068bbd5-1094-42ef-8c32-2a99f3573fe8", "value": "T1A4F3971E2E228F7EF678C73447B78D25976823D626E1D684D1ACC2105F2429E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169266, "uuid": "3c57c331-0f21-4c2b-909c-f074b9d99d0c", "value": "3072:gLb3WWqRJcLgJh/HeBGVFFvR3jhwAz5E+3:gLbxqfRh+CHvNhvF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169266, "uuid": "dee8270f-a9bc-4d36-b34d-0ce5238be885", "value": 170584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169266, "uuid": "693689b5-de28-40bb-9c09-547377b233eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169266, "uuid": "fc184c57-cf2c-4ebb-a446-ec6bf52b799c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e579eb-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688109546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109546, "uuid": "ad28c3da-c1de-4651-bad6-cd68345a21b4", "comment": "Malware payload (AsyncRAT)", "value": "62b6260c98e5afe1c20f7dfb031c6cbc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109546, "uuid": "645bd73d-fc60-462a-9d51-514385836c31", "comment": "Malware payload (AsyncRAT)", "value": "3163cce36440d2b1cbc265a56298664026d1ddf3885ca0962367028c88d07113", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109546, "uuid": "7f8938c4-784f-4338-a91f-7c30ba7da212", "comment": "Malware payload (AsyncRAT)", "value": "cea0e62f31a0ab68ceb8fff68d36e8c09e8a9c83", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109546, "uuid": "ec7232dd-fed9-4b5e-8f79-4e5a269524a7", "comment": "Malware payload (AsyncRAT)", "value": "be825fdf97828651a593505902c96fe279b3e6c3a042aeb8f98461ea1e91ccaabf3c1bca84340e9742a47e369992e945", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109546, "uuid": "fdb22a5f-7755-49a4-a40d-c744a08f3291", "value": "T145348E0437DA662BE3BF97B8F460011583B2E4137627C7AF1ED498E91DA3315D980BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109546, "uuid": "5ffa512a-36d2-4adf-b981-33295e085de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109546, "uuid": "8f1f3a4c-1f5c-4d6f-bc54-60c65d76146d", "value": "3072:j+STW8djpN6izj8mZwlsdZ5b4GaBfVaDUbBKfDqRY6RAYnecDQ+g3H1vKx6+Wpw:A8XN6W8mmlKgfMDUbofDq+YnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109546, "uuid": "47c3064f-ce66-4621-afa6-428c759c7026", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109546, "uuid": "4b00880b-cffd-4c8b-a577-4ae901a9c78e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109546, "uuid": "c1925442-12b4-46df-8880-02e55a6b4676", "value": "62b6260c98e5afe1c20f7dfb031c6cbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a73a7ee-1764-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688142920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142920, "uuid": "15b9adb0-66e7-4c80-8552-017230793994", "comment": "Malware payload (RedLineStealer)", "value": "32aee4842dfd7a8b5b019e54ec39bd94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142920, "uuid": "7e261404-d27b-4eae-9c65-180ebe0b141f", "comment": "Malware payload (RedLineStealer)", "value": "3165f664c4c755bd9715a7f004b98f1990a2055aa1ca4ab8ea75bf2d7730dfcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142920, "uuid": "6b33e61e-6e03-4720-b688-36dbf00bbf1d", "comment": "Malware payload (RedLineStealer)", "value": "7210a3d3862cb5edc77d434eb6acd1b7a6176428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142920, "uuid": "142d56ed-3180-4f01-8c84-7b4334e934b7", "comment": "Malware payload (RedLineStealer)", "value": "4bbe16c436b73749d0be2b0bbcd8d1384e9e89eeabe642caa48849dd22800e84fe5fb2237a502c7495fc2cb2298909a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142920, "uuid": "edaa90cd-6018-42cc-971d-56d3375e1bd2", "value": "T194848C4392E13EB0E536DB72AF1FC6E8770DF2548F497B6622199A2F04B80B2D563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142920, "uuid": "03927ae3-c879-41d2-a854-66724234130b", "value": "1ff66a1ed7eed59bc0ffd84293a8bb71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142920, "uuid": "10e9fd7c-65c4-4b74-bf72-be7f6a78b3cd", "value": "6144:EuAGIn+1HrmhSTL/z/XWRtoHuFTTM4jrvuco9XtpQ:EVGIn6HhL7KtrTBjzuco9dpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142920, "uuid": "19f7c579-395c-48a1-9f84-bbe6465e8156", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142920, "uuid": "25e9e097-ee5b-4565-a53e-c317e9bd4cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142920, "uuid": "4c24489d-3b11-4b8d-bb48-dec37ac111eb", "value": "32aee4842dfd7a8b5b019e54ec39bd94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359e0273-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108176, "uuid": "dff72467-ebed-4f5e-a6d4-633721ca3c80", "comment": "Malware payload", "value": "12cc71072dfad6a7b4564d457ef3c394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108176, "uuid": "9ba8ab4e-6587-44aa-ab3f-38e1a50ddde8", "comment": "Malware payload", "value": "332924aecd052ae84ac99d9d3dfce674f9e78b8dcd219392eda299d283723b0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108176, "uuid": "b25b1f82-7daf-463b-9d27-a67ec432b658", "comment": "Malware payload", "value": "8fbacca82d91032f1b2dc252a42de779f3bc418f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108176, "uuid": "f17fd83a-96a7-4918-b30f-3568c035823a", "comment": "Malware payload", "value": "77cea56e348fad73d9b8611eb8cd0e312e74a652c89f2cc062f6d5cdaffd3674d052aa04b77fc34b0f84c50c4f975c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108176, "uuid": "5c35ce6f-048b-4de9-a5f3-adca2f24b86c", "value": "T1D86619E1750976CFD49F6778AA57CE42A85D07F846250803EC6DB4BE7E63C8522CAC38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108176, "uuid": "98c28c54-65f8-4356-9699-4988da160620", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108176, "uuid": "5e253d7a-dcd4-4a62-a468-e1ff645e96cc", "value": "98304:HlLudZox5Lxv5/+cwZLEBPcV+8/7NahLd8IPVYbL78SaNoAJN:XJs+Z0aNoAJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108176, "uuid": "8b13e9f7-14a6-4b14-a1b5-f3361d23dc21", "value": 6640329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108176, "uuid": "342503f9-3a1f-4077-96cb-8752f4f0ca83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108176, "uuid": "6954b369-4768-4dcc-b0b2-49378b2c4076", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9566fed6-1701-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688100606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100606, "uuid": "ca374f8c-640b-4377-8714-aff95c645c3a", "comment": "Malware payload (Mirai)", "value": "5437033a291628dedad009e349e42cee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100606, "uuid": "cc5d46b7-afbf-4399-ba7f-5a05337e81a3", "comment": "Malware payload (Mirai)", "value": "3393db6b8f1f65c223443151baf652f7ef59dfc8617489118201357fb480cb4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100606, "uuid": "eb02d283-6ea4-4273-8c8f-6851d9bcc036", "comment": "Malware payload (Mirai)", "value": "abc3f91b1ff6da9595d980e2e4b0477568cbd813", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100606, "uuid": "8d324680-b088-4035-9e31-4866ae220011", "comment": "Malware payload (Mirai)", "value": "65e9de6749e259d0203461c327b0fcd468742be8eb8e7dad7a603b5439beca9927473b37735d27e553cf0c498231a0f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100606, "uuid": "9a4401ec-b45d-47b3-88ab-da3bd988ae0a", "value": "T12FE33B46FA818E13C4D5277ABAAF42893332A765D3DB3306CD185FB43F86A5E0E63511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100606, "uuid": "bf02f62a-de69-4015-8f50-3d53e7a683d0", "value": "3072:bydJfvCMOpjaJEczKBViD79DY+gFlE76KhTGzK4XATsM/9fV8R83:bydJfvCMOpGJEczK470FlE76KNGTXAoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688100606, "uuid": "101983ae-d8aa-4388-ae51-b6f47f6d440c", "value": 151564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688100606, "uuid": "f9ee1d54-d75c-4936-8b8c-55b183ddb467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100606, "uuid": "284b1c0a-a95a-4cee-adf2-0ae342c27c1a", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3075b7-1717-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110150, "uuid": "72ed345e-3635-4c22-be30-536182d06ae2", "comment": "Malware payload", "value": "b0011be8c7cd1c9865e1f1ed406197d4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110150, "uuid": "ad82fa08-4c2f-46d6-84a8-c586e4043799", "comment": "Malware payload", "value": "33e6b8a634ba08facba420eed6f61933570fb26e59fdba5a52603148c31e8792", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110150, "uuid": "63c218f6-a1eb-4f4c-964d-613573aa6308", "comment": "Malware payload", "value": "ddf1f665023dcdddf23576d4db27e65323482d58", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110150, "uuid": "dd1826f7-f760-4a72-aabc-ee08c1c0323e", "comment": "Malware payload", "value": "018feff52f9fd3349fdbe71e11b58abfb0884a0b613fef15d6da6156b67ad2e5e1160fde7443376c615274c0a573b180", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110150, "uuid": "258f12e9-8327-4cfa-b008-7e5ff53e04c0", "value": "T10A420A04AAFC023FE4BB13B889A357400B36BB776513DF2E2ADC71591C517544A263A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110150, "uuid": "ef799e24-d893-4fd1-8bfa-6c0798c4ff6d", "value": "192:VqwFkb7H0rKTW2eOF93JceyCxk6XY5V87W1tf8UoupfJf6myRRW3ZDkmiPmiz10:BUTcOF7cDUk6XYSswunHhITG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110150, "uuid": "1ac79835-83df-447e-9b36-ae721f830f65", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110150, "uuid": "aafd55ab-50f6-4b90-aa77-48ab5de5df37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110150, "uuid": "c4915369-6260-4ec7-811f-c5098abe4a91", "value": "b0011be8c7cd1c9865e1f1ed406197d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d915be-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144358, "uuid": "cd0bcc42-a89f-49b0-9e40-69bd947559e9", "comment": "Malware payload", "value": "1e818c26395170e7f0b23a95f0f5139a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144358, "uuid": "91d88cb3-4102-48dc-a901-2bdc3a292e54", "comment": "Malware payload", "value": "34da925146f809cdcbc7f27b5e551e34f1ce233de98c79323d4c07c1d537196b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144358, "uuid": "b44d065b-1be8-4c3f-a918-03df4f9a5858", "comment": "Malware payload", "value": "156627f9d1988e3af43008c5086e0f7058561f12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144358, "uuid": "ff4a0be5-20b8-49b1-af8c-8c0c29f62611", "comment": "Malware payload", "value": "99b812cb89117fd1da0f943bc661a165fd509df75b6eea44de6b804698ae63fe6b4f7de5e9b5bbd26b31a006f5c65a25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144358, "uuid": "afea0cbf-e709-4601-a5fc-873135f1d555", "value": "T19A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144358, "uuid": "3a6dc452-abe7-4d84-9b00-6efc7fd2d2db", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144358, "uuid": "5bd080cf-5b74-4595-bc50-8c13c5b686b5", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144358, "uuid": "3517b754-f349-461a-bfbe-29cef0942f81", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144358, "uuid": "001dbd83-465e-471b-b8bd-5a45c1a2a612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144358, "uuid": "ab6bdbf8-f156-424a-b3eb-f8c0c627f944", "value": "13loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478ac383-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150726, "uuid": "736d7915-8191-4369-8406-8100a263b007", "comment": "Malware payload", "value": "3b9a9971355e862ed469d5796ed858a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150726, "uuid": "9d6b8fc4-8229-4e08-82e0-f0f3e71aa064", "comment": "Malware payload", "value": "3537a7be62a48e2caaa9324caf8420834f78824358b6cf6b599b0f9494ac6f94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150726, "uuid": "5143ed72-b2f7-4170-8a3a-66acd92d7140", "comment": "Malware payload", "value": "0c5541042d95e25858287b1968a1bafd6007c966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150726, "uuid": "5ddbe738-b301-49f2-8cc3-ad00d2431e6d", "comment": "Malware payload", "value": "78109d476ac97eb5550ff628c897ac6c631f60ab55082a976ce67009668530df5eda4cdc9a75a3c8a84c18c68e89298a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150726, "uuid": "c9ac9705-3899-4f59-91a4-a170aa105441", "value": "T12D463347BA93CDB2C205E7B7C68B79144776DF49E363CA02B29C627781D33AD810265B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150726, "uuid": "3043ce04-2661-47cf-8a83-378f76dfb76e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150726, "uuid": "357c5541-9049-4cb2-93b3-db83d56bb4dd", "value": "98304:OPEUpMsm98cSAJnWP0jWDhvEXM+ofXemlRtnXXx6Yvn28s+0CSVw7q:OP1w8dcnW8jW9vr+ibz+8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150726, "uuid": "a7846296-a1bd-4888-8bf1-70a5b4b3bfc6", "value": 5382656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150726, "uuid": "4058ca91-d31e-4bbd-aaad-ad90969fff9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150726, "uuid": "7831fbcb-5c0c-46ed-82b0-4f9573322c00", "value": "SecuriteInfo.com.Trojan.GenericKD.67726076.28062.8729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fa52c6-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144758, "uuid": "ed0d5a79-d0e4-4081-9336-265abc2add1b", "comment": "Malware payload", "value": "c82a14e53bb71f2954eb876b7d2d9aee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144758, "uuid": "9f794330-ec0e-439d-a5bf-580aa23e40d3", "comment": "Malware payload", "value": "364e0221f61d2a4fc93b987d502b4625c15f5fc3b2c5617e98482bedbf3738c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144758, "uuid": "0a7ae0b8-a9f6-460c-8163-2ca47b1174f9", "comment": "Malware payload", "value": "d3ba717f37dd96a5429e3b0693fa71700304357d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144758, "uuid": "ce68b3c2-d5a0-4774-ae9c-3dfe11f2165a", "comment": "Malware payload", "value": "5b31c58280e1de7baea66823d6b060d63cd8680916b4a2b7d2dc69e722c98864d90b0403e5d1066e25e00b3d867f21a0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144758, "uuid": "1ce551ed-460c-4d80-8617-7f1fd5c5d5a1", "value": "T119646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144758, "uuid": "86a8f2b1-0f4e-4a28-b429-0c73c18da01b", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144758, "uuid": "6ef45e57-1f1c-4bd8-8eb9-5e373fc72485", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144758, "uuid": "361288f0-8ee9-4d3b-b2b6-d339cf95f1e8", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144758, "uuid": "8aeec68b-5655-492d-93bc-cc1cf7e8fd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144758, "uuid": "e07f37c9-6221-48a7-bb6e-b9855323ccd1", "value": "64loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa782083-176b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688146302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146302, "uuid": "f945e817-7d19-4859-8177-19333228d742", "comment": "Malware payload", "value": "62e2cf58a7475f125915511ee224facb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146302, "uuid": "22ebe201-4b6d-4501-a4eb-2cf564cb7395", "comment": "Malware payload", "value": "367817b892346a3f912c854d06bf0f815e4ea9dd2cf7659d49e0f0229535b30a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146302, "uuid": "0e2af48e-9fc1-419e-9878-66061fbaec4e", "comment": "Malware payload", "value": "47f6985b5a2b56452564574bf782a4d27f6a4296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146302, "uuid": "165af358-0f8e-4b3c-ba48-01888d804c81", "comment": "Malware payload", "value": "df745b3dd670db034b08833308f00e04022bad6f8eb104f5b9b90f31e145c7cf4e78e6287e4dd3ac58942060ce0bac7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146302, "uuid": "fbdc5be4-14c1-4b29-aee0-4831e4696eea", "value": "T1B6434CC5D6C3D4BAFC171176503BBB338B73E62A5025DA83C7A9E432AC13611A25B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146302, "uuid": "855158b8-fb18-4545-9fae-5d0329d7c224", "value": "1536:RRWpZRHcQVMSc9nirUzzojvCuP65lX83K:RRQDjK9irSzEvZ6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688146302, "uuid": "4a1a38de-7db4-43f6-9864-ca6bd9d5674f", "value": 58356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688146302, "uuid": "96888754-7960-4718-ba5a-ebe9efd76f0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146302, "uuid": "de4d31dd-d2dd-4618-8ae4-d03a866193b9", "value": "62e2cf58a7475f125915511ee224facb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079f7377-170f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688106381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106381, "uuid": "5c549e5f-1ab9-43fc-9643-af583fdab169", "comment": "Malware payload (Formbook)", "value": "f0624386c0f6acdb6bc4510eb93fb327", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106381, "uuid": "6cc41362-19e3-48cd-991a-96adc22a1240", "comment": "Malware payload (Formbook)", "value": "36c59fca2be8a3be742cfa48db7112d01fc18ec1eb855e46f44a014de1726607", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106381, "uuid": "ce344ecf-4960-4e58-8bd9-6c7e31fb3b19", "comment": "Malware payload (Formbook)", "value": "cd17f46a9e3d47cbc3fda12c82109df11fb4d458", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106381, "uuid": "f3d7dfbe-2296-4dc0-83d3-4bf128de43eb", "comment": "Malware payload (Formbook)", "value": "eeb19da50fb07f876acbd7f1a3077d797f16632e0f465bfcfc3c16fcbad68a566a576ccbb2a704dbb947a30832289474", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106381, "uuid": "a061640c-b8b9-4554-acf2-85def82a9932", "value": "T1FB34239BCE215654C5DF227516C676B345AA378B65A8C3C07EE01392C068A3B7F78BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106381, "uuid": "b22df123-ca8d-4617-aed0-633ed4dc2267", "value": "6144:RpU8PLhi1LB2NHdPfIOM3lZEjs8E8MMRbWLhU/:3PLhi1ENlIv7Gs5MRbWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688106381, "uuid": "fd14be1b-f584-418e-a613-7228eb62b973", "value": 231008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688106381, "uuid": "c5697101-5a9f-44ab-a750-848a4344c81a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106381, "uuid": "cf5a848a-804d-4c15-84c6-44f92817786e", "value": "PRE ALERT NOTICE#202307.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907f1482-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688120784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120784, "uuid": "a1008122-1741-44c1-bf9b-e2360addc689", "comment": "Malware payload", "value": "87e0ee49c52ea68af821635edf8340a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120784, "uuid": "54ff2c99-1451-4b8c-9972-febdfdeae489", "comment": "Malware payload", "value": "3747fba78912e05b113b36d6e7e60af297a087911c5dae8d768ed8e100b12a06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120784, "uuid": "25a856d5-b7cc-45ef-93e6-13875ee35039", "comment": "Malware payload", "value": "7dd936946eaf69beb0e17a8a78e7769c4f08096f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120784, "uuid": "8e21c8f9-97e3-43be-9285-4e6b620f589b", "comment": "Malware payload", "value": "73683cbe8f10fb6af6f892d845dc3fd18c0b867537d0898257d4bedcfba04bb0e5c6815cfd654ecb190140268bced5e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120784, "uuid": "03a8b813-6d0a-4fce-a4ae-66813eaa0b4e", "value": "T1BC23F25D92A63489CEFC9DFD40D68FA02F32FED1754F6B9CEB40C9045A50146A3E78A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120784, "uuid": "26850689-7edb-4e9b-967a-4d1f1ce43229", "value": "768:6mVrzmxLbztCDKWk76ac/R3TId2re/CmuDSS16qk7OhfoiWTfuz9ZbIrAW5OIHmJ:6u/oLbzYKWk7FANTIc68WI1o3TfoePs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120784, "uuid": "64f6927a-0771-46ab-bf39-3c0cf5ec7448", "value": 48296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120784, "uuid": "8541467c-88a1-42bc-9bc6-63cb39c4f1ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120784, "uuid": "aef66fb6-a21b-4078-8d94-12b0c680fb74", "value": "87e0ee49c52ea68af821635edf8340a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b686ed01-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144470, "uuid": "e1308e9c-2fe0-4f9c-be33-22b85c5df54a", "comment": "Malware payload", "value": "c135ca66d094334c131e9c79241b4a3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144470, "uuid": "1fb9df3d-b24f-4133-97de-e84206da4978", "comment": "Malware payload", "value": "37a2d00e2910cf726e147f41b0d6faca19a64f4c0cb27b447f6764055d9fc57e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144470, "uuid": "08e82942-3653-438b-895c-8c781ebf2a53", "comment": "Malware payload", "value": "b7ef3c61db488effa786cb030000b7d03b2d526b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144470, "uuid": "5b06e737-4ee1-4c8d-8ff2-5644374de6c5", "comment": "Malware payload", "value": "43f63e79337be373109373b08ce2b52ee16591a01857c469e9218b15fada358a188566f88c0f01377a2a599409093a13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144470, "uuid": "d623eab4-c4c8-440e-b451-576d0195f349", "value": "T182646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144470, "uuid": "13236d58-065b-4659-9717-c4d936c5033d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144470, "uuid": "9b91afe9-c147-486f-a4a5-83b78fbbffb7", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144470, "uuid": "fd55d00e-c475-4356-930e-c7c4abdf0272", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144470, "uuid": "15a9d5af-dbb1-4f50-927e-1c3678e50d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144470, "uuid": "4d75fde6-b06d-4905-bdb4-79e04fe770a2", "value": "2loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633b7106-174b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132304, "uuid": "ee0fe528-7476-4d56-880e-272c30ad4b11", "comment": "Malware payload (Mirai)", "value": "07e1ed28018577c3044b75f692789bb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132304, "uuid": "30f8d718-33c6-4301-8f74-2f6ba8473328", "comment": "Malware payload (Mirai)", "value": "37b485beeba6a863a9e19043bdece704df27ec5554f7a03ca53486fe88136766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132304, "uuid": "0326b91a-1ee5-46dc-8c3f-c9f72bbb975f", "comment": "Malware payload (Mirai)", "value": "fa431249d74899408803934837a806d47930411d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132304, "uuid": "568e5dde-1d89-4948-94c5-b6d6e6b6e15a", "comment": "Malware payload (Mirai)", "value": "a9dd0c34bfdbb35a202b68151c05a36b49c31c1fe7a0a805d4451612da03eaac20b157c08e5593bcd88578d68fa63b0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132304, "uuid": "4f4edeef-37c8-4478-85c3-d9e9fddc2ffd", "value": "T1B073F551B8829A27C6E4237AF5BE448D372067E8D2CF7227CD216F10778691F0DA7E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132304, "uuid": "972cb9a1-26c0-445c-9e38-fa4f55994844", "value": "1536:mMWS4TDvYZuamVBqjuoOxovm7fkuqiqwqHTRYYU:hWSoEIJVhDMyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132304, "uuid": "9c9a93b0-0f48-4817-bf9d-d2e1b6027fb1", "value": 79644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132304, "uuid": "30dfd2f8-a623-4820-b41d-1dc4449d7b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132304, "uuid": "0f18d5a4-6a78-46b1-af34-33230bbcdd64", "value": "07e1ed28018577c3044b75f692789bb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bf5956-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150700, "uuid": "b8bb1de7-6a90-4f70-9d9e-817b1f3e94ce", "comment": "Malware payload", "value": "450d8900f699a7730d0219ab789fc7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150700, "uuid": "f3d1e7ef-b7b5-4b3c-8107-e84fa51b0934", "comment": "Malware payload", "value": "383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150700, "uuid": "b89aecc1-270c-4cb7-82f4-cea592e74b36", "comment": "Malware payload", "value": "713a63d0321c51b0c91347d407ece92d8800c0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150700, "uuid": "1baef3a9-c2f6-40a4-8949-94a614fc5c83", "comment": "Malware payload", "value": "1b21be155992ef6187875751171524b192fcf127a3c8534cc3098599d7e195bab8ae50ea82f66801f0fbb84f39a24837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150700, "uuid": "4619060d-4805-4326-a449-82e80f567023", "value": "T13ED633D9649D6147E1AD89BAE803C740275A6F8A4E12A4D13F047F6F74F90B1E0B0BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150700, "uuid": "7c88daad-fa67-4aa1-bd1e-5c5c8d60dd07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150700, "uuid": "5d965557-9a40-42fa-b813-606d181a849f", "value": "196608:7zLA8rc2nh3bgz/KjFmRJKxwYfzBaHIGWtqfuNLPRt7WNGV/5BJOy9k0YNiE3lgq:3Lz5UTKuJKxk9WtUMXVVjYym0Yke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150700, "uuid": "ea81beb8-ae8b-4cd0-8f57-aa61123275e4", "value": 12836864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150700, "uuid": "0e713172-55bb-4072-80e1-bcd2d92801f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150700, "uuid": "e2e11bf4-e9f1-47bd-a5a4-2a4d1b71271d", "value": "SecuriteInfo.com.Win32.RATX-gen.24734.17790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c697bc20-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154376, "uuid": "8015b62c-735d-4aba-aa6b-bc13e82d1721", "comment": "Malware payload", "value": "6ded49ae8ec00b7475f17c20a50eac9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154376, "uuid": "9fcc439c-1cf0-4356-b2aa-1e361efbb4c0", "comment": "Malware payload", "value": "389a7b386cf1cb266462813f116b66c1e01fea86116a9c9c9630c890418fb2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154376, "uuid": "116196ee-4037-4ed3-a8c4-e84fa1844ee1", "comment": "Malware payload", "value": "ed494a14b1c5f46116582d4c20124adab5d08a1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154376, "uuid": "c210b23c-08df-4282-af2a-75331c28f50e", "comment": "Malware payload", "value": "6d565e2912ce2bb71799af4cdcdb4a29bad82ee826c859d4a5127dc86ec8d5b7263f79c1dffa12d92bfb9b3e8198c7cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154376, "uuid": "19ef954f-a4ca-4fbc-a691-0739fac4f6fd", "value": "T132D6235BF3D8ED71E58F66BEE152D9098363C41692EBB39D6A89B3F500C6770C908183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154376, "uuid": "f074ca56-38b5-4f0f-acff-40f3d4f30f80", "value": "196608:vGFYCPlajIJpFElcbX8l1NB/FMjScYG8+KxJyiGRwCblthl6IkDDaVVivzWy:OF9ajIqlU8lvfcYD+MEtltOIkD+gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154376, "uuid": "c9d13aa0-3251-45fb-94c4-f10b140d70d1", "value": 13682176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154376, "uuid": "14db8a63-e40a-45ee-8495-ff31ab1ed51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154376, "uuid": "12f36a44-babb-4f8a-9152-d1e84b548d88", "value": "SecuriteInfo.com.Win64.DropperX-gen.5482.22547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5f8677-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108213, "uuid": "cf64c5fa-383f-48a6-bb27-ea48c7555dd0", "comment": "Malware payload", "value": "38274413276749627c4025d73a77d3c2", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108213, "uuid": "acc91869-1b6a-4bcb-ac7c-ce82ded5315d", "comment": "Malware payload", "value": "3a3b5c21b6001ccc8f8b9584dde44a35a146b2ad7340d83772352987afdf7f26", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108213, "uuid": "fa99114b-5ef5-4bf1-887a-9cb0e4fa19c8", "comment": "Malware payload", "value": "e93607e40ab32506b735afd836bf4b87ad10e4d3", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108213, "uuid": "abe64aab-878a-458f-a870-7d45e56a08da", "comment": "Malware payload", "value": "6e0a0ac8a817904e0a6ef58f769809614586ec881638e01dd6621a8fea683c5f19c244a3c925f38cb2c3dc0043a1ffaa", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108213, "uuid": "a9f5989b-6d80-4e93-9e95-d81cc8a016c5", "value": "T15D45BF81777ADFA2DE3943F981A314512BB6202F5010F7547C8B70CA2A31FB6419ED6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108213, "uuid": "c393bb01-c780-4745-8e90-bd5047cb00a7", "value": "6144:982nTFKbLkeEJchg8UHQKLKL5Ncgh+yWSisy+kw2:C2ZKn2aYwKLU5NcoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108213, "uuid": "309079c0-2273-478d-aa1a-e38ebc8da28b", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108213, "uuid": "627865d6-83ba-4b09-ad33-58cca5eb4ec3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108213, "uuid": "6fc0e6e4-0adf-44be-96c0-628675cdb086", "value": "SWL7345860L.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d31aa1-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144580, "uuid": "911932df-1fd0-4794-b226-699a64059f1b", "comment": "Malware payload", "value": "6c15ee212795776faa4faafe61eeca71", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144580, "uuid": "4026978b-d745-4354-9df8-0ef667528225", "comment": "Malware payload", "value": "3a613ceef615508f56436debf235f4f3fa4df4c3ab7f5a29eff0b78924593ebb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144580, "uuid": "6db2423c-2c2a-4257-99c1-0764f39cecfc", "comment": "Malware payload", "value": "2b91df5cfa9d231027fd00a32a76996b182e42a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144580, "uuid": "9e385b68-b3f2-4703-8148-f47a6f8d74ce", "comment": "Malware payload", "value": "6225e5032f47e747cfade35991137f0c8aa46f39f7ef951b631e54734d67836af39664ff8b978f87a7da5d4b25c21fb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144580, "uuid": "88a5d128-c50b-42dc-8d06-8a42db4ced4c", "value": "T1DD646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144580, "uuid": "dceb8f25-5384-4b84-b4bc-5442514d9129", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144580, "uuid": "7643b9fa-4915-4bb5-a440-7ededfbe4d94", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144580, "uuid": "21ce5b98-03f9-4dbc-9277-3b80e53b3ec6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144580, "uuid": "c909bfd9-6c25-46b1-b66e-0d30099e1c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144580, "uuid": "672e5e0b-6683-40dd-807e-fe4e0406ba42", "value": "43loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8ba583-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110391, "uuid": "3052c26a-1869-49ea-9d66-d017554a87bc", "comment": "Malware payload", "value": "17dc35f769c29240711eece3daf2a254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110391, "uuid": "f1fcfe09-786c-47eb-a2ae-2c1bf8532244", "comment": "Malware payload", "value": "3bc50e3fd73733d5a331c67f78fa40136affdf7fb0f3da22da45095ee63657d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110391, "uuid": "f8352c0d-ecc4-4243-a4a4-f2e462d019a4", "comment": "Malware payload", "value": "a68754199f0d11bfe4736d978bba31d7e9bec3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110391, "uuid": "77f413e4-ed9f-471f-adf8-81413f886926", "comment": "Malware payload", "value": "90d64e2cb4467f76a0f94d537d63da87541bc2b52550c7779a044af45a69d9bd73fe85866b6849b839275b4f6bc8e008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110391, "uuid": "1113dc73-592e-4eca-9964-425b3d055351", "value": "T1A17633126BC26134DD7F983830A198770577BDB22EB4DE9AB5D46BDC06304C0973EAB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110391, "uuid": "499467dc-881d-482a-879f-50971130eaa7", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110391, "uuid": "80ca8506-714a-4a34-8645-2f189a2db74a", "value": "196608:zrIWLrTNSgx+8AtpM2Y34M7ZepYU2YRkQ8O:zrIWXTZPAfYoMteWU2YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110391, "uuid": "7fcd4198-a8f3-4ee5-9023-dd46c5346f48", "value": 7245462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110391, "uuid": "e8856cad-caa8-48af-832b-31fee12d9341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110391, "uuid": "52b3a967-1a5d-464d-be84-aa75c1176d97", "value": "17dc35f769c29240711eece3daf2a254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100da512-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144620, "uuid": "72f7c630-0b76-47cb-bea3-69d5d8e21783", "comment": "Malware payload", "value": "67fc68581a475d356c8da0ed22f38224", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144620, "uuid": "ee647dca-a142-468c-8260-135b2b35f780", "comment": "Malware payload", "value": "3bd44bfcf5e0378049534052830d1f9516e0fab2327a2e19798ba55bdd6dfdc2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144620, "uuid": "de4b4d29-3c91-4cec-816f-4f2bee72125d", "comment": "Malware payload", "value": "dacebb9df4035725508c69f8e4347e73de0caf17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144620, "uuid": "85acd9e8-6c90-4e20-87f7-2feb5efbd69b", "comment": "Malware payload", "value": "63b879a23b55dfb90a66295ff64c6c1d66d3ff32c8039586dce75a8370b3203b18c854a447ed094b02df7b2d18cf5fec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144620, "uuid": "a87c784b-a199-4c9d-95af-4a43c38d520c", "value": "T11E646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144620, "uuid": "3a956adc-bc77-44d8-9b93-d17bd8f41742", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144620, "uuid": "d1b8d998-8cd6-4f66-9561-2a802161483d", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144620, "uuid": "f35dc777-0ac4-4912-8b3e-60d28155b3dc", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144620, "uuid": "b797c4b7-0b40-44ab-ac81-1d7e11846549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144620, "uuid": "3a532ad6-b138-4f16-acd4-73e32f407a4c", "value": "49loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be5d5ef-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163109, "uuid": "aca86690-8a03-4acc-b2d2-76e9fbf6a016", "comment": "Malware payload (Mirai)", "value": "edc24c1e747b1a26fdc540851ae8deb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163109, "uuid": "e36cfa9e-a765-42bb-b32c-5b7bd67c5ae1", "comment": "Malware payload (Mirai)", "value": "3be4ce001b0d415e797e35894df3275ceb605bdf7a32f5cef39562cfbec567fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163109, "uuid": "2c7586f1-d3dd-4490-84bd-782194bec2d3", "comment": "Malware payload (Mirai)", "value": "4a6bd9680a7e854f3b3b979fdee172d313d0f28f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163109, "uuid": "a90db1e0-6379-45db-88fc-04103ac9b606", "comment": "Malware payload (Mirai)", "value": "043501809009abf5272f0795a251cf329e037845ae4177641eb3ffd5fff296a1e42c539492ba7a9c54be50af1cfdac1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163109, "uuid": "8d56374e-a26b-4e2a-95f5-fd3c95695633", "value": "T1ED933B8592A3CDB7D4871BB902E7AB360531FC561B3D8E06E36DBFF56E025C4704A226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163109, "uuid": "4f2eab2c-e2b6-419a-ad84-f08782d97a4e", "value": "1536:fbmZ8oPfVdmsXWIKXalUJkZw0LAhSLSo/j7IkCgAAfC:fMlPPmsXykNAhy3agZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163109, "uuid": "55893338-e665-42b1-9b09-a95ce85d923e", "value": 90719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163109, "uuid": "b757af36-aad1-4e15-89d6-45e49739ec24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163109, "uuid": "700ca24f-dad6-4053-82cc-29ac5436fef3", "value": "edc24c1e747b1a26fdc540851ae8deb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7ba9bb-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688109126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109126, "uuid": "82674c43-f451-4cc4-9d8f-90c225375d82", "comment": "Malware payload", "value": "92e7045409cf8625c3cc13cfa6dcf96e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109126, "uuid": "abc1e27f-4ce5-4fb6-b3c7-c1588a9fba7d", "comment": "Malware payload", "value": "3bf7eea3c296aa5c8ba2bc56f56a83469a2ebdf4c97f8b87bb8c135bd27de6ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109126, "uuid": "21b43636-f073-4c9b-975e-0f8ef93a3953", "comment": "Malware payload", "value": "e2438fbe16c126073f220d60746d14c6603c8def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109126, "uuid": "f0fdc629-af07-495c-b0c7-d0d08122ea3e", "comment": "Malware payload", "value": "bcbfa2a499c07c2e7ace62c9907ad5c20fcc9b561219e595c15210973b386d0268da004b959a361d9764745cb5d1e0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109126, "uuid": "29a53186-9868-497d-9666-df99b3bff8e1", "value": "T109344EC5E98456A0DD59AB706A36CD3552237EFDA874A42C28DE3E273FFB2D31025063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109126, "uuid": "57471355-7f31-4d1c-bf1f-01ad40858f9f", "value": "6144:VnAkzL7r9r/EDppppppppppppppppppppppppppppp0Gk:V5P7r9r/+ppppppppppppppppppppppG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109126, "uuid": "5216863c-02d8-40fb-8aa9-a1755583f9a0", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109126, "uuid": "93324e93-823b-4214-bc8d-adad05a32273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109126, "uuid": "6745ec98-22d1-4455-9340-73488ff9c1fc", "value": "VND14NV04TR-E 10kpcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ed8aa-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101163, "uuid": "6986f9e2-68ba-4430-9fcc-ac8936cf3e87", "comment": "Malware payload (Mirai)", "value": "42fda82eea4cc4a75ddd3d082d4fc6d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101163, "uuid": "0098bae5-afc9-4238-9279-18e27e83eeb1", "comment": "Malware payload (Mirai)", "value": "3c215f919ac496e6c77c740c61a5b85a704285d5d33afa88339d7e931fac217a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101163, "uuid": "6354ce17-8bfb-4a3b-b0f6-0a6a3c248a23", "comment": "Malware payload (Mirai)", "value": "95df3f93f70c31cbfe724c0bc5e1dc6e4e4515f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101163, "uuid": "3530c1f0-89d8-43fd-9acc-b08fbb3efbbf", "comment": "Malware payload (Mirai)", "value": "2ba18101b8f60bf27dcce286c272b2558b4b58d575bccfb797e3376b21a9bd4373d82e98015a006abb308d75c9d07985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101163, "uuid": "577b739a-844a-4d22-81a4-2abc0ed0d909", "value": "T162A3C60A6E75CF7CFBA9823487F74F209658339636E1C645E15CEA021E7034E741BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101163, "uuid": "c37d5119-a604-4bfa-baf7-b732e6a09706", "value": "1536:DxCMvVor8jyV1KkyFamdrSgs49gofPRceAj07jyvBbmJU9iFO:oMjQ1KksRVs4lR+07jyvhmJUkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101163, "uuid": "4f8fe33e-3af3-4c8b-8a72-db2967e5d33e", "value": 100524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101163, "uuid": "a182c9b1-f7be-45d9-a7a6-8ca657c74c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101163, "uuid": "dc18b2a7-013f-4e64-8465-d8ea198717f0", "value": "42fda82eea4cc4a75ddd3d082d4fc6d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88018e97-1779-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688152123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152123, "uuid": "c1a73992-4615-4ece-910b-965ca776e705", "comment": "Malware payload (RedLineStealer)", "value": "3a7672c0d0002621ffb756afab204616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152123, "uuid": "54b3ef7d-dbf5-43a7-a359-ea250464336e", "comment": "Malware payload (RedLineStealer)", "value": "3cbdedbfb28b0c6dbb28631b4e215fac48f965cb2c5843033ad8be0bcdda717c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152123, "uuid": "e2f9041f-07ca-4c5e-a2d4-14652fb838d1", "comment": "Malware payload (RedLineStealer)", "value": "e047757a76f8c9ee3c6e5af8068195d263b38bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152123, "uuid": "6d229a2e-5596-4d83-99d8-708ddf3d4fd1", "comment": "Malware payload (RedLineStealer)", "value": "d3d8e4fd0d4f004f5fa57e4d875cd3419517692c8d90886571911a58427be9478337dea3961865d22e7008b21745e0a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152123, "uuid": "dc379c0e-a81f-4c4e-b836-26118e348c68", "value": "T14BD35B9533D98925E5FD0B74A5B1002943F0F8236512DB9FAFC1B4DF1A32BC0B6266B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152123, "uuid": "6c9bf40c-ded2-4910-8185-a1cecd630651", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152123, "uuid": "86f0a89b-a39d-406a-ace8-0524c8c5879b", "value": "1536:fapcnVHT1e/ofspSm+fqpSmdsr/OfmtZ9hZjfubV7A/uprOsYgibfbFDKsRy:CpcZZU6ipSFrkm356OmZYgafJly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688152123, "uuid": "396e9192-0fc7-442e-9fb2-7fca858a7533", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688152123, "uuid": "f0b476d0-7698-4d1d-9162-dbc10eb6d1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152123, "uuid": "df82c0dc-dace-4c86-90e5-b95898d2ae42", "value": "3a7672c0d0002621ffb756afab204616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11056fb-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144917, "uuid": "6b744881-567c-4d8a-8a64-7ed059a173f3", "comment": "Malware payload", "value": "822e6b4bb269e291ba4a04501ec4243d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144917, "uuid": "37765f61-4fe5-451f-854d-9172698b243d", "comment": "Malware payload", "value": "3d10b4c9002fc20fe1dc434959b9af6cef4138ba5e40ee1ee0bc99a7dda2470e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144917, "uuid": "919542fa-64bf-4889-a319-5b2f9fe96394", "comment": "Malware payload", "value": "14db3ae26001e68b470fe56611bdc2cb4985dc68", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144917, "uuid": "61d441bc-b6c3-4c99-854a-4973c2bda19e", "comment": "Malware payload", "value": "84d61fa58bc4b59afe2effcb90da44d6f64eef86a89b0f75272a32ca9b4643867595057112f788d41c892f05dc9b4310", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144917, "uuid": "42d39d95-a5c0-40fa-a4d6-feb43c7d99c4", "value": "T1D8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144917, "uuid": "328e3e6c-30d1-4418-802c-e39b03e12e14", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144917, "uuid": "e7fccbda-a2dc-46ca-9992-a33719634fed", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144917, "uuid": "cb7a15d7-b022-42dd-9ff4-45aa37d6074c", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144917, "uuid": "6226d9cd-60bc-4174-bb49-4ed1226cc6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144917, "uuid": "f53a22c3-496a-43f5-8e04-eb19c8d2392a", "value": "86loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3c3dca-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1688135761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135761, "uuid": "13427818-b700-49ad-b8c6-84d6d386c8b5", "comment": "Malware payload (Gh0stRAT)", "value": "fa70826a556bbcff34ef53d7ff1a88d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135761, "uuid": "1464b2ea-001d-4461-8efb-29450041fcc5", "comment": "Malware payload (Gh0stRAT)", "value": "3dbee9fba96b94f460c826c2e16173a3ea261e9fff379f6c5f419324c7703cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135761, "uuid": "a0b7e0b7-9c50-4343-a6dd-fa8761a3e134", "comment": "Malware payload (Gh0stRAT)", "value": "29a0f3ab2b84e20399497ad6c1f88f7849a245bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135761, "uuid": "a2c84927-a4a9-47c7-b0c0-56fa0d18451d", "comment": "Malware payload (Gh0stRAT)", "value": "28750796bbb18ccf918ea64d836b5e1571457588fc4a3d22b0e10b966d83bbe703baa36aed21c5932aad479fb4e3316f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135761, "uuid": "c58e955f-0878-446b-9205-5cfea8ece4c4", "value": "T19D959D317A508077D9632530965EA779F6A9FE200B3942F356902E3D2E305D2E93CB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135761, "uuid": "13930841-d82a-4fd3-822e-1da37d218147", "value": "d98a24bc14dc5836bf996c7f692775a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135761, "uuid": "f44124b9-2d88-4cc2-a063-daf468bb24dc", "value": "49152:XoTpxQCb8CmdRk0bWCte0K+T4v1E7PGnTkq8pGoC7mDxztV1FBjGqkZ:QHrtmdRk0bWCxT4v1E7PGnTkq8Abydzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135761, "uuid": "31b05b72-f0a4-4a0b-b079-863acd49fd31", "value": 2046976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135761, "uuid": "850cd0d2-a04b-412b-a0e0-4c5067720ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135761, "uuid": "ddb58721-0e3f-4a74-9d41-84f3db15087c", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321ef393-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150690, "uuid": "79ab8417-0140-4b49-bf5b-fb667f7b6968", "comment": "Malware payload", "value": "2c1d896cc10c660fb2b3192754fc3eea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150690, "uuid": "90f2f1b3-890a-47a2-8adb-90e1a521be89", "comment": "Malware payload", "value": "3e864c247730019a728fb2e73e5f3956c6afcf268d831a6b39baa65104b857db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150690, "uuid": "ad738bc1-8c3f-4f2a-a87f-be00f868098a", "comment": "Malware payload", "value": "6197b496e4b3b1fdf174b3d98be5fddf594ff0e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150690, "uuid": "0296cde0-0a54-44e2-9fef-822f3bbdfcbd", "comment": "Malware payload", "value": "1889685c7c3b82fb1cdf0dc4d2e34446bcdd88939220975c6907037d11fce122d96b6dfdf97d0953963565951bb98e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150690, "uuid": "983443f8-1d94-4f5b-90d4-0e561763f922", "value": "T1B13633FB0658C286D24254F0E96B42F0B5C4DB5B3B2ADDD3B43A356AB2933780B1157B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150690, "uuid": "d6402b5d-4091-453b-a78e-ff97a9f4e325", "value": "98304:JB9MrKs39ZZ4ifJNpKruXoS5ZgkJ2PXVcsok7J4JIBJAn:2nh4ifJNEreoeZgy2dcs7JbBJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150690, "uuid": "5d9f3c6f-6466-49ef-9d70-0205529c2b85", "value": 5336064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150690, "uuid": "4cbc6248-972b-4dd9-b00f-74dfc42af7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150690, "uuid": "0cbc4c2f-079c-41fe-9d87-82b4565917f9", "value": "SecuriteInfo.com.Trojan.GenericKD.67632328.15070.27292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b4336c-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144737, "uuid": "b8290074-bb71-4cd4-b4f7-5ec713ecfdf9", "comment": "Malware payload", "value": "70dc48397950f06369ff36573c39e87d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144737, "uuid": "a67249fd-437d-4b26-af56-33d064eaf2d2", "comment": "Malware payload", "value": "3ee5e7736b391403c51dd08d18a80111ef5e6aaffea6099ff5eec5e57b6314c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144737, "uuid": "0ee186d2-4755-4020-9b91-1a947e1494fc", "comment": "Malware payload", "value": "13fe25f07887d5a00b34c6e49e1e2af5b466e07b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144737, "uuid": "bcf08e2d-f789-4e13-8c88-6c2ace248c88", "comment": "Malware payload", "value": "31c513b712886001bd657cf6dbdc493ee730e45aba9f3069a6243df8d22239699c12e7c74af21ba9e56f80a23c812fad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144737, "uuid": "bf313970-8eba-4abd-8e9e-204b854dcd36", "value": "T1A4646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144737, "uuid": "c579e306-7abd-4a89-83df-389dae55a56e", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144737, "uuid": "120593e8-3538-4c53-86ff-c4fa28b51e6f", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144737, "uuid": "f0072c27-f467-4f48-ab39-841622977b84", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144737, "uuid": "6e3ab967-fb9a-4b04-9981-d8904ad9716b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144737, "uuid": "06c0d810-54aa-4a2b-8948-95787556ba54", "value": "61loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0167949e-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109377, "uuid": "a69bfe83-f7bb-462e-af4d-895f1a40ad83", "comment": "Malware payload (AgentTesla)", "value": "dda7e4b341b33adf67b9215c642ab9a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109377, "uuid": "6f3e22f4-f4cb-4cef-9cec-f61e78f851bf", "comment": "Malware payload (AgentTesla)", "value": "3eff8258ac6c696c721f2f69d9d233a026dfff9ffadeb7a7be42ae4abdae2aef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109377, "uuid": "a4c7d675-ca5e-43ef-b01e-8bf4d2e4c0a6", "comment": "Malware payload (AgentTesla)", "value": "d5d2a4ca9cf25f3d8de44d30f317927f1d23bba2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109377, "uuid": "cf58eb28-3711-4316-a20c-88bfc8cb743c", "comment": "Malware payload (AgentTesla)", "value": "7310b5b49c03c7b511cf165d0ff8a795f24e1fbdbc0f81b8e8a874a3acad025ad950d60bd85642dc10c04e6ba4f4c230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109377, "uuid": "aac4460b-2679-4692-87a7-ee6806512552", "value": "T1BAD4593C18BD6337D074D6A6CFD1C723B264942B3562AA765DC39BA54786E0229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109377, "uuid": "14808c28-0462-450e-bbc1-d2e295dd92fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109377, "uuid": "25ab2e29-f93c-481b-9185-0aee285fe32d", "value": "12288:km3+qtF766Nz5SQAkZbF5qtUhHHd57fubggC66zNOc:v3+866BnAkdF5qtUhdBfkgl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109377, "uuid": "ce1b276e-a115-46ae-8910-ffad135d57e8", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109377, "uuid": "351fa5e5-5530-42a3-9000-40b0fe403298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109377, "uuid": "087fd897-7ea2-4bb3-8b6a-69cd71a88917", "value": "TT application copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1313fc-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144694, "uuid": "05fe868f-d6ac-4295-8b00-94dc5c757946", "comment": "Malware payload", "value": "ef92eaeece043709966281b62d553648", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144694, "uuid": "84b8ba05-9af5-4e9b-bc2d-917f84f97f47", "comment": "Malware payload", "value": "3f0067c6fcb26d766285009f5bf125b892f98d78d1bc83f206a14203d1bb92aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144694, "uuid": "bb71ef2a-89ae-41e0-b256-921b1e6ea347", "comment": "Malware payload", "value": "3b9e244c8e27a3270e1880d2ba363547de7b0c64", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144694, "uuid": "c0c9a219-f71a-49dc-a52e-8ee18160d7e6", "comment": "Malware payload", "value": "9fdc4d975b6e06cc2e8260832ea0a9c2ef252b9546e88f01b0288b6eaafcfa8f4b61210cb6625d3dff94871eb81a1a47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144694, "uuid": "dffe929f-54f7-4762-863b-e467924bc8b1", "value": "T1A9646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144694, "uuid": "28edacfd-1366-4c40-a1f2-e27d2d308795", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144694, "uuid": "994de614-785f-41b0-8d05-78fc14e7039a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144694, "uuid": "f23f8abc-de3a-4479-bc2b-7663d754d980", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144694, "uuid": "a1ec4cfe-f9df-47e7-b002-42221234fd53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144694, "uuid": "55285492-37c3-46c1-9cc7-5a625c722133", "value": "57loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fe793e-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155695, "uuid": "569685f1-3443-4a53-818b-a2314654ea0b", "comment": "Malware payload (Mirai)", "value": "6b7cb1482e6a1ea6009d06ede3d6ee56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155695, "uuid": "cfd46e90-77b9-4934-aebf-b85c79e82596", "comment": "Malware payload (Mirai)", "value": "3fae064632ef1d58bb845c38e550c89276a7ba018c195116e863cedbabc064aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155695, "uuid": "d450a827-9790-4332-8a73-2fe92255aae8", "comment": "Malware payload (Mirai)", "value": "06f53deb11ca7a0ff6a14d1b0a2be226a4e5079d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155695, "uuid": "1ee0317c-f13f-49ec-91ed-ad231cec9366", "comment": "Malware payload (Mirai)", "value": "f1ec72c9491b1443ab9888d338040d8ae82ad50c1a3d8177b1a536de095f1f99c67dc59fc52b99d6a2b259eb1bbc2208", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155695, "uuid": "4450d0e1-26e2-438e-8fc5-78065467036d", "value": "T17C3302A256AD29E291704373FC33EC1A66EC17E99D67309A2CF45A1977C18064EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155695, "uuid": "a735b87f-db12-4b20-a7a4-964fa97871c8", "value": "1536:s9O/ZMAXIxNUk0VLcPqF1aBexo4opKZbx:s9O/ZNKyxLGqFUFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155695, "uuid": "e57848bf-3b11-406f-9e9b-388a6152b5c2", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155695, "uuid": "7dd2bbfe-e02a-4ed6-bc4f-b51aac807271", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155695, "uuid": "5b37b341-322e-436d-b37c-c2335e8a0d03", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6736a0a-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144953, "uuid": "214e8745-ef17-4055-bab9-277de0d6e510", "comment": "Malware payload", "value": "d280f4609be9ffc73c4f4d211a4f224a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144953, "uuid": "8734d2b4-154b-47e8-b58e-c32793884515", "comment": "Malware payload", "value": "40a55ef76804ebd169475f2381bad7b5d8734a7ea154584850fc9a6cea7e134a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144953, "uuid": "175c7bd3-6d8b-4e86-9c5e-0c34f1fd9d13", "comment": "Malware payload", "value": "9f326fde29bba5a327aff06f0c4fe31491c04b15", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144953, "uuid": "bdb1644c-f7d9-4eea-b58c-3cfdc63e58bf", "comment": "Malware payload", "value": "2b4e068c221af0f9f21e2fdcddef5580360b792cabe28549c67d663e8015db30431699a9389a880ccdf7d68f72fdb455", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144953, "uuid": "7b28b269-dcb6-41f0-86b0-58040644315d", "value": "T107646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144953, "uuid": "28b331c7-5160-4782-b4d4-46374ce73775", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144953, "uuid": "76154a18-6fb6-47c1-8ba9-ca04b5ba4e66", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144953, "uuid": "aba926b1-d673-48e8-9284-42a6326459fc", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144953, "uuid": "103dea99-a376-404c-8dae-bc56a7ae04bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144953, "uuid": "950ac545-b33e-45d1-b850-c8b76f8abe6c", "value": "92loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e55322-172a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688118073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118073, "uuid": "a18b6eaa-1863-41a1-a68c-169d6f3ea3ee", "comment": "Malware payload (Mirai)", "value": "ae5d3aaa22e1b9840cdc00190c017567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118073, "uuid": "0ea02362-3f91-4965-a607-db861da7f6f6", "comment": "Malware payload (Mirai)", "value": "417a4e46b0119e78440d17dd224934d5a84fc1ae3f3f182073f9b10b8a494c0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118073, "uuid": "0aa18dee-1c9b-4320-842d-24dc08e0b3a0", "comment": "Malware payload (Mirai)", "value": "5f9c487402fc264aac64fc8c9b8445835145fef8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118073, "uuid": "49e51e34-0abe-4c24-9aac-771248550a34", "comment": "Malware payload (Mirai)", "value": "1ff7e63ae76f520d9aae01aad394d73499d8c9119e957589d820b7a2922a13b665ebc211007256ef84bbd0062adcc07b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118073, "uuid": "c663690e-e3cd-45c1-b040-2385a294424b", "value": "T1E5637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B797D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118073, "uuid": "0845f7e4-e589-4643-a7cd-39c7f6eb5060", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyDr1Z:FJs+9mLiJMruw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688118073, "uuid": "9ba62e0c-232f-45d9-b422-b68130f91f9a", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688118073, "uuid": "8f550862-3c2a-4fdb-8ea5-83e198978449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118073, "uuid": "9da10962-ff7b-42d2-bff4-66a365792338", "value": "ae5d3aaa22e1b9840cdc00190c017567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c3184-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137204, "uuid": "24595ce4-ce00-4608-b9e1-3114bddd8bf7", "comment": "Malware payload", "value": "221634fb8a0081777f418a5c8c8b333f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137204, "uuid": "258d77a2-7b59-4eba-a2fc-980fbf5d4902", "comment": "Malware payload", "value": "4197e1ead545b7629a6cab4ebc62253d04046931ffcdf830ddf6436473ed8fd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137204, "uuid": "972cbc37-9451-42a4-ab47-746fbf5ecade", "comment": "Malware payload", "value": "84d3c68d9840b5b963c9fba68eae1c4e00c6a6b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137204, "uuid": "2cc6fdc3-ab1a-4d08-822f-dad85abae37f", "comment": "Malware payload", "value": "ad8ac4bfbff96a320125d29bba8c4c8224d0dbc4931abaf306bb1c5fa31c67fbf747424bd3dd9496c79118f0e4ccd1e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137204, "uuid": "3710c631-1468-4405-94a4-a079f8ffcc34", "value": "T1174339C8E6D7E9F4EC090A313137EF32D6B6E13F252CD993D7986963AD41642D4022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137204, "uuid": "28e9e1a7-d4d7-4c0a-97ba-deded28370ea", "value": "1536:CVKFOD7prJkaNup1COy7O/HgeGDp8Q8bi7EnhP8xs:XFOXprOfPTy7yHgeGDp8Bb3VQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137204, "uuid": "ffbdd7e7-eb54-4477-97d5-d2e27e58c908", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137204, "uuid": "fa63bce4-b010-46e6-808e-bd0796597e1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137204, "uuid": "9bccfa5f-6550-493a-bacb-41a5ed507ddf", "value": "0xh0roxxnavebusyoo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8577a-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163105, "uuid": "dd0c0530-3aae-4c11-9d1c-564216dea744", "comment": "Malware payload (Mirai)", "value": "b92ba73f53ecedcb578b6b67c111d65a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163105, "uuid": "c75bf559-6b00-48de-b7c5-c95b9ed904ca", "comment": "Malware payload (Mirai)", "value": "41b4d913e42d21232470ed0ff3e037f12e8267b8df1dfefc0e6487d8fb5e7373", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163105, "uuid": "4553e5f3-4dfc-412b-b976-ebc737f38598", "comment": "Malware payload (Mirai)", "value": "f6f8e123afa975effee9ba05d8ba23062811dedf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163105, "uuid": "6f21ba94-c6c2-4846-baa9-4953d3269d0a", "comment": "Malware payload (Mirai)", "value": "63e093cce4534646738f06f3b336cfe73bc129b472ec40080803cf0f68efee8dc66976282a10ae41ca287b019a822aeb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163105, "uuid": "720066d5-325c-4102-aba4-1e0d2b26ca15", "value": "T167B2D06E5764780BC0060C39331A2AB169DFC44E9BEE965E58D0B4C723179C875E3D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163105, "uuid": "b164c051-e9cb-4b22-9fb9-ecd4bf9f468d", "value": "384:hRMCOy4goj6wPIj1zcZuHt+CuSwwn1qwJgKbqni3Up+EsdOYwPz/aPImg5Rc3iFa:bcg27QcG/aKx0gdOYCYg5R+sXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163105, "uuid": "b24ec56f-d87f-4852-86d3-bcaeaf783a6a", "value": 25716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163105, "uuid": "63cfd77d-89fa-44d6-9bc3-0a702883200b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163105, "uuid": "b564d503-90a2-4887-bd12-70d620ff6e7f", "value": "b92ba73f53ecedcb578b6b67c111d65a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d114499-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140857, "uuid": "1ed6891b-ba7f-44e4-aeed-3e7c9884056c", "comment": "Malware payload (Mirai)", "value": "bd4467a665aa77e87818cacda9baea22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140857, "uuid": "81d20734-afaf-46d2-8590-ae1da071b1fb", "comment": "Malware payload (Mirai)", "value": "41c46a39ca09aa71401b58f505e2f3527f26ebf8b5ae9395cca81051a6b40751", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140857, "uuid": "dc67bd30-472b-4644-adc8-2202e042f3f5", "comment": "Malware payload (Mirai)", "value": "438afd6ab416563f88c00336cc6be78d1314fde0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140857, "uuid": "8ebf0d67-f804-4e3b-88b2-6611c42a5fae", "comment": "Malware payload (Mirai)", "value": "ebb4ded468f29cffc4c8b9dbae23969fa3e5b689e52b76424a253dcfcb4ad5af115c9e376e4687544b1881724684a655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140857, "uuid": "6c9a637e-8881-45a6-9d8a-cc19d5bcfdf3", "value": "T12C539FA5C5ACAD58CB1445B8B614CD388723F408A5E72EFBD646C796800BEECF1587F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140857, "uuid": "17ae4f95-fdb6-4b52-8a12-6b0677ec6968", "value": "1536:XaoJRnrB/mUU5XtiYmG6u1KUDYofs3Qb9jQrNUxb9CH:XHJRrBeUUfw9MXBf+QJjWNUxb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140857, "uuid": "1d7c18eb-3f0a-433b-99cc-7a5860fa407d", "value": 63768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140857, "uuid": "27e2901e-b0b0-43bd-b42a-63b553562398", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140857, "uuid": "2bb82a62-fe38-4535-a993-eea7098a81d0", "value": "bd4467a665aa77e87818cacda9baea22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a7bdf8-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688111506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111506, "uuid": "52e40566-dff3-4640-83b5-d5126124834c", "comment": "Malware payload", "value": "45143df507c4bfb3301e3addc029b93b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111506, "uuid": "6942b147-ee9e-480d-8335-0d8a0a499e74", "comment": "Malware payload", "value": "4200ae1f7366584cd6e5e7d1d85d37e8d5b6bd6fcd1b1705ede0a0b31303f452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111506, "uuid": "6c369a01-af56-4c4b-9002-9123118ffc90", "comment": "Malware payload", "value": "c2f69eb02330e8f3de96ae36c39c58966e218090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111506, "uuid": "38ead381-1d54-45db-953a-c239e644267c", "comment": "Malware payload", "value": "1501e694c2c3f471dbaef24707f0a726bddcaf5618528c649c48c4d6a61d1f4ee7975d9618ff782d0428325b2d1c850e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111506, "uuid": "b2a2e2ea-4a6e-43d8-a2c8-eca22bbfd5c2", "value": "T17EC4F11339EC83E4C2FDF433815EF8158E36E7B11E72698B63E4A15E1A706419932BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111506, "uuid": "6c7ed81d-49ef-4e9d-8bd3-f6448f0583a4", "value": "ae3313a7e55f2835265780c2d394ac1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111506, "uuid": "6ecb9764-2964-4998-9457-31219a4a7cd2", "value": "12288:7u9vfF7AR6tnIu2k1JiMVubH75+vPlyqtcHohUHA:Ml7QSnb1i2ub0VyNHZHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111506, "uuid": "b16a167f-e59e-4794-910f-c7e5d116c6e1", "value": 563848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111506, "uuid": "49e18978-73e0-4e25-85f6-431306fa78c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111506, "uuid": "c09ab15f-053c-4d39-a44e-31d554651a73", "value": "45143df507c4bfb3301e3addc029b93b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34f069a-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144867, "uuid": "e956c7fe-7d27-4cef-9cef-63be169db8ca", "comment": "Malware payload", "value": "4f649526093e37ef1f39da20a6307343", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144867, "uuid": "45fe3389-0f22-45ca-b9f5-ba465c915c04", "comment": "Malware payload", "value": "425f81bdf064df34de9c4d9383d3c1de2c90fe47c326168ff1de3e6db205d970", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144867, "uuid": "e166c25f-2dbd-46e7-95f9-0879271c40ab", "comment": "Malware payload", "value": "ab69082f9a85a822fa562a566522f0e2b1ff17d8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144867, "uuid": "4ee8866d-2ffb-4706-aac0-690e1933aafc", "comment": "Malware payload", "value": "2b802393b7697f78edf126ce170bf234f08ad2f52e80bfcc7186c1e2b4f41331326a9fefca8a13e16233c7936ebc458c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144867, "uuid": "152a35ab-6f9d-41d4-950f-cc2f744ffd7b", "value": "T1FE646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144867, "uuid": "97a46148-5e4d-4462-88ff-3df42350d46a", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144867, "uuid": "da667512-f39f-4c6c-bfb0-a031e74f9e8c", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144867, "uuid": "1a197f16-e6ae-4323-af0e-7b5f4590c284", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144867, "uuid": "64f958cd-f852-4b4d-804d-550ef0625da3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144867, "uuid": "90929564-1356-4570-b144-4eaac1d241cd", "value": "78loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f6b9bf-16d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688083514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083514, "uuid": "552644d2-b1ef-4694-a21e-f3fe8f63dc7a", "comment": "Malware payload (RedLineStealer)", "value": "8eca708367942803dd00ee83d0a3944f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083514, "uuid": "3aeec919-18d2-4620-9c60-3b66989a1896", "comment": "Malware payload (RedLineStealer)", "value": "43065af2c6ec6608d11054a01873b3b15a8e2ef2a35bf1e1c9098b50f63541c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083514, "uuid": "e4d85321-da02-46bd-8716-0674f02571a8", "comment": "Malware payload (RedLineStealer)", "value": "191e93eee81081cc4b10a7df768e5dd579cf743c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083514, "uuid": "38db47d9-d98b-466e-9d48-fbff68f27a3f", "comment": "Malware payload (RedLineStealer)", "value": "96a4b54e747572204d84e42ba2b9a61b1299c919e1affb543e91b06c02c7a6613242e486a2a63bbe9365319e26ac7514", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083514, "uuid": "ecc20b09-f1f0-477d-b317-632071765cde", "value": "T10B849E1352AC7F60E5E2463E8E3EF6EC761DBA504F59776E12385A2F15B12A3C172B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083514, "uuid": "14d35545-5c99-4016-a360-25f979a431c7", "value": "0bd2f32677a0e93201a9419699247165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083514, "uuid": "a5e6c058-cfc4-4878-8851-9ab9a8076d13", "value": "6144:F1S1JeTx0k9etQwbByFz8zxqgUgHVjKSWQjbviQ:qHeTx0l7bByFz8zU8WOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688083514, "uuid": "4d1491ea-f964-4705-92b0-702a49881f57", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688083514, "uuid": "50d27019-e629-4b64-ad28-f89b2d179fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083514, "uuid": "9e3f0d6c-c572-4da8-8667-99ad78122634", "value": "8eca708367942803dd00ee83d0a3944f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db0bd3d-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144428, "uuid": "986101be-746e-487b-b51e-24794b2eaf63", "comment": "Malware payload", "value": "8630b6844eab81b8e102469a414309a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144428, "uuid": "ec101885-96e1-46fe-9a09-0c3c7202efee", "comment": "Malware payload", "value": "4337f4f66ef34f278050379928326fe7192fb2f45e8bb25fbb32b437ad97fda7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144428, "uuid": "d4722133-34cc-48f1-b6b4-166e22147f4c", "comment": "Malware payload", "value": "7b7b6608594dc1c600ff8b051323f75446a0e23f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144428, "uuid": "7c2d6414-d1ab-4853-91ac-f5c6770bf629", "comment": "Malware payload", "value": "b59b46ade1ce89569f49a9b50c12d84964d63fe53ebec81081dae253aac5f448b95c2387754bc2aec3e4f1a040941cda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144428, "uuid": "c9f891bc-a431-446d-a393-7e7a3464fbce", "value": "T178646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144428, "uuid": "607b9eb3-f475-4892-afc1-5900878d2cc5", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144428, "uuid": "f1cfb6f5-5117-4dee-bc88-4d2ac9c0607b", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144428, "uuid": "e8a78669-d346-46e3-9463-92d2be23dc50", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144428, "uuid": "5b3a0da9-514b-4ad3-a754-71cfdb472a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144428, "uuid": "90160501-77d2-493a-b4c4-d26bc37ad737", "value": "23loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344d3aa4-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110321, "uuid": "c4336c10-3c78-4689-ad6f-2f143d883070", "comment": "Malware payload", "value": "5aa1632f55900e2dc70d44d686a4e653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110321, "uuid": "28991d19-e5b8-40c6-8df9-6fa65934d5db", "comment": "Malware payload", "value": "4354f07c674a42dca5f0b7683cee22396e5ce4f619c45b7e4d8440db5d8dcbe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110321, "uuid": "942cbe5d-5eb3-4056-a81f-35633da39312", "comment": "Malware payload", "value": "da34428421039131cab91d6125880e29abff4ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110321, "uuid": "9a015750-5a8f-431e-9aaa-c0cbff431989", "comment": "Malware payload", "value": "b4426b12ba7ca9212e221f71ab479619b415b74e1a8a15d9124a652114fad0f49c03e532fe0aed2e9bf8931c1b7ac5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110321, "uuid": "4925c74d-0f6e-49bc-9254-d836151a43e1", "value": "T15EF48D21FB918437D1731B74981B96A8A83D7E213E38A80B2BDC1D0C9F79B917D153A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110321, "uuid": "74cb39ba-394f-4b6e-b51e-9f853cede094", "value": "42c89d50c523f8a95da74c4f94676d6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110321, "uuid": "d2e62bd4-3188-4838-874c-3bb6330c2a56", "value": "12288:cZWHw/+9pxSY/9VEWbIq3ZO5QWPojARdL7CSoshZdKx6yPWoo1t:cAQ/+F/9yWbIqMGWwjARd3h9ZKkyO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110321, "uuid": "0a9e1d0c-6c80-4570-ba63-46d31751ad56", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110321, "uuid": "5ce069d5-7860-4b68-b7b3-224acf10f48c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110321, "uuid": "63169f59-e193-4fcf-b574-281bb8c9f0d8", "value": "4354f07c674a42dca5f0b7683cee22396e5ce4f619c45b7e4d8440db5d8dcbe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb87a01e-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111407, "uuid": "57e9adf6-87d0-441f-810e-13b7585171a6", "comment": "Malware payload (Mirai)", "value": "f45e48abe9b0e4b9fbe1754addff5ef7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111407, "uuid": "1f515404-6b2e-4358-9677-d199a8bf8c4a", "comment": "Malware payload (Mirai)", "value": "43ef3259539d01bd20c308c5445b5061f34d7ae2793f88ab4909369ec7c3919b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111407, "uuid": "05722959-f9fd-4bf6-a35f-2d37a1cf1782", "comment": "Malware payload (Mirai)", "value": "84a33a261e8efc43bcde096e4204d444054bcd56", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111407, "uuid": "c52f0e83-679b-4527-ad0b-4029ec8ca0a0", "comment": "Malware payload (Mirai)", "value": "97d31682c9b207244bdb04fe0f9c809905b59c222fb3701f3a86357707858744c3f19f4754799fe20301b40068ecea06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111407, "uuid": "8bbff47a-8557-4328-b5c4-0e98fdf0d52e", "value": "T119E2D01E87F59B01D06F913A9B5EBEDA1CF0E3248759D2EA65C461522A05FF8BE10AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111407, "uuid": "9f07f2dc-fc5c-40b7-8de0-a4aa6b70fab5", "value": "768:9Ip0IP9wpaUXJsAO4P5LnK8kFYPdhLtY3Z/4n3CjLChQgyCTFqspmyjHnbcuyD78:6p0IV5U5sxKLbdN2Jg3DhQmppnnouy8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111407, "uuid": "b09c2b24-4591-4627-9668-805a41c1bbf3", "value": 33848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111407, "uuid": "88c418ee-afa1-464d-b8ee-29b2462669cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111407, "uuid": "c037936b-16b6-4c90-b71e-06681355a47c", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b349846-1726-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688116480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688116480, "uuid": "d2105dec-350a-402c-bf12-71d975102ed8", "comment": "Malware payload", "value": "81883b354b43a169b32c0f34425f8ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688116480, "uuid": "c336ab76-7617-4303-b2bb-debd58885f51", "comment": "Malware payload", "value": "43f0d4ae7757937f33e90031a0aafc7828300bfe8074f022d0c1988ffa28e45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688116480, "uuid": "11db1f4e-9a29-40be-a299-85a2e7dd3c8b", "comment": "Malware payload", "value": "f42634aa68eb2897b4bf92541c45de2fe52f7602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688116480, "uuid": "99049b4f-f552-42b7-941b-9a91ace23338", "comment": "Malware payload", "value": "d2b636559a6fb1acf636deeda176152c5ae5b33a1c78db5724a9c12fadf99cc042055b80bd389c7a4b1c72ead1087f83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688116480, "uuid": "b1e69f3f-a273-4295-b09f-2256645c05be", "value": "T1BE362807F89151E9C0AAD230C6669252BA717C881B3423D33F60F7B92F76BD49EB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688116480, "uuid": "6efa68b3-a21a-4078-afa7-6147b65f22f5", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688116480, "uuid": "4df882b3-8ff8-4796-9938-126396abfa8d", "value": "49152:Aa8C6fJ32G2hlL4Prb/TJvO90d7HjmAFd4A64nsfJMeV27xd7B9Goi61fAdrouIs:A32R2dNlCeoJaLCAQBnEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688116480, "uuid": "be85cd80-1b06-4b3f-995a-645e25a562ba", "value": 4940288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688116480, "uuid": "5369c1cc-9aae-4816-9526-c53c7b04b0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688116480, "uuid": "9ed46a19-8b51-4d2d-9669-7b0bace39c72", "value": "XJdshajda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31bc9284-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108170, "uuid": "630322b3-934e-41a4-94ab-caee91b81546", "comment": "Malware payload", "value": "c7006ab0f307859361d4b2406a473d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108170, "uuid": "f74ea6eb-7792-41f7-aae2-4bf9613b0fe1", "comment": "Malware payload", "value": "440bf24789917b163bf6c4f46aaae219976c2dda968501f6786065664dd480db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108170, "uuid": "a1eec266-18ef-4ccd-9da2-3093edbeb586", "comment": "Malware payload", "value": "c195515e894da0de10911b9276e9e4be349a56c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108170, "uuid": "72efa9c0-2a0b-4e3d-bf2a-39a48a419843", "comment": "Malware payload", "value": "3cbc62f7e7d35ae6db3b17794bb96b90b25f90b7e847adc08025f72648dbe667f59b2982db19b3847ff86907f8aabe87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108170, "uuid": "5de7703c-2737-464c-9234-c571182bbb77", "value": "T1ED551202B9C148B3C57218335A785F20593DBD602F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108170, "uuid": "f049c390-00b6-4083-b543-faf2a355f3c1", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108170, "uuid": "2d67946d-11c8-4555-aec2-c24b54893037", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnA0:IBJctgBhc6Kus+9gO0qnA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108170, "uuid": "8012fcce-79bd-4aae-9ddb-bd20d946dd13", "value": 1349359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108170, "uuid": "09751be8-e7aa-4301-9f35-7de788061c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108170, "uuid": "3c26b5d4-9009-405d-b416-5f72bd3f1528", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9fdab7-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144799, "uuid": "287eafb0-5a2b-49d4-82b6-f5384760ad74", "comment": "Malware payload", "value": "cc020da94114e995cb787ca26a4ec8d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144799, "uuid": "7c531472-ab47-49f1-a94a-e0e6cba91193", "comment": "Malware payload", "value": "4435fdd4b94ed49e7e13811b8f5a4e22130832e45fcb5418cc50a7b0dd44f4b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144799, "uuid": "0a03a3aa-4d6e-40ca-b713-34f9f2b597d1", "comment": "Malware payload", "value": "212cd1f707540a21a862701001af63399e9963d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144799, "uuid": "39af19cb-f8da-43e8-8f7c-53591c1850ed", "comment": "Malware payload", "value": "8ab2ac77d1888af5997ed7c1678699f08f2ddccdcd59c7dc1047ea0b2eb21c1932381fccf8dda6a21973cf584c4569f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144799, "uuid": "edeb3154-4d62-4aa1-89ce-3a5026d2713b", "value": "T11D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144799, "uuid": "3c083a59-1a20-4fc4-8dcc-aa9c5da07971", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144799, "uuid": "c0a928fe-ca65-4e99-810f-2721e3e3c265", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144799, "uuid": "5f8affc4-d70f-46f3-9034-a7fd44523ecb", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144799, "uuid": "6ef58a5c-e0f2-4b5e-b672-71aadb382792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144799, "uuid": "6a32c2be-d98e-42fa-951f-1e2a63eebfee", "value": "6loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5a3d84-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144933, "uuid": "d250a9be-daab-4f64-8688-e2d71fcfc1b7", "comment": "Malware payload", "value": "38deeb1e800cc197ce4876312c24dcf8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144933, "uuid": "e4eaa5f2-40a2-4bfe-952e-a62bfc3a0187", "comment": "Malware payload", "value": "444f96f9e97e1dcdef54678c888e07a9b791358a6a2d25c8bf8c93196f61201d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144933, "uuid": "692d1b90-9302-458c-b980-f46c0d56bf3d", "comment": "Malware payload", "value": "10de8d7dd7ea58725c4b178201017755d7486709", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144933, "uuid": "07c8d919-4197-450b-ac85-8d731f4c5acd", "comment": "Malware payload", "value": "50ec274ceca853f58b761133cf35064b12d437dea6ee564e2ef0369cfc8d2f1b26f1cfe6bbbec80cc5c4be64731ec368", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144933, "uuid": "970560b2-0807-42ba-897b-b8ad2cf092a4", "value": "T1DF646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144933, "uuid": "575c13c2-eb83-4661-ad09-b3e06eafed28", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144933, "uuid": "5e022651-0ac2-48ac-80d3-047cd454620b", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144933, "uuid": "ccd3da24-7bf3-4353-8aab-397cd5d1b60f", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144933, "uuid": "8ab1e64b-fb6f-46ad-8ac9-56004b6a530d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144933, "uuid": "a64ab6d4-3b2e-4d9a-b4b3-70f1e2ec047b", "value": "89loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9188db5-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688120933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120933, "uuid": "ba896bda-fa14-44ce-8323-b6b037f86c54", "comment": "Malware payload", "value": "1eb611dcb30106eec15555718e953cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120933, "uuid": "3d263470-384d-46b8-8705-3dce97836228", "comment": "Malware payload", "value": "45459279d0e4ad96a22ac1c3653ada56cd4490bd12d66e0567d62c62653ed390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120933, "uuid": "9982e006-1cb1-494b-9c89-30304acba726", "comment": "Malware payload", "value": "e3a0ab3349210029e2f1fd01712dddeaba19c6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120933, "uuid": "a002a2de-2098-45c7-bbbb-0fe61bb414d1", "comment": "Malware payload", "value": "1d52388563f36cc002a6d85a4d7f43e903a81d3847e4b2a3b34ed577f1ec8bc720e2a3184c3d42d3c25890523299fd45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120933, "uuid": "4948408d-9785-4172-a70f-13c14ebb5ec7", "value": "T15975E136B681C937D1374E389E4BC1985A19FB101F38259B3AE52F4C6F781827D3A1E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120933, "uuid": "fb41f95e-4722-4211-ac01-b9a353b3f452", "value": "f686a81f9da8241dea326e483f0f88b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120933, "uuid": "a88f28d3-0a91-4b8c-97b6-108e56847f3a", "value": "49152:lSr1VgXPNxNNUfRlGQG57q3MxaHjQwLxsdB:l6DqPT8ffI57q3xAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120933, "uuid": "0a3593d9-a6ce-48c3-abb5-fc395d9f3bac", "value": 1606656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120933, "uuid": "3d99baea-407c-4fb1-8026-c127a92b0313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120933, "uuid": "948a8020-640d-4ec4-bbb5-324bf8757e72", "value": "SecuriteInfo.com.Variant.Tedy.197311.29167.32662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ecc9ed-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144771, "uuid": "efd9e668-59eb-4dff-a4f0-91acce74c903", "comment": "Malware payload", "value": "403bd2ddceed6167a5b5642cf49f4722", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144771, "uuid": "87bf74e3-1aca-4628-a776-59e1b9ecbf60", "comment": "Malware payload", "value": "45836542250f83dd4d4a958078c4e566a387cb09efb60d7c1ea714ed7ccba3dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144771, "uuid": "ce535e85-0ada-4dff-a8c6-fff90ca4a5dc", "comment": "Malware payload", "value": "7f64e2d46e1461b27b4c8adf354b51273c4a95e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144771, "uuid": "a52bd3be-326b-4020-9649-925a89877fca", "comment": "Malware payload", "value": "01f109183883051a0df194cb4416f6d6dfc58d92f5d698a650744fe0795e7456c610af7f9fbe30ab46f9a65363014e16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144771, "uuid": "b6bf48fa-a24b-456f-be49-c5ebcf73d57b", "value": "T180646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144771, "uuid": "f305e1a9-cf5e-4e97-bdf2-d3c995964986", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144771, "uuid": "8f471634-fbfa-4bfd-b840-69c4e9fddbdb", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144771, "uuid": "b606b5c9-2ac0-4fb0-a27b-6146280efb42", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144771, "uuid": "abe5cc96-0547-4244-8626-3ebb50e80e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144771, "uuid": "2862178a-5b2b-4979-a1fa-c0b9697cf6c4", "value": "66loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a452f52b-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688154318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154318, "uuid": "e9aa310c-6852-4e0f-8d61-7c503f4c0b3f", "comment": "Malware payload (RedLineStealer)", "value": "b95ab99e6a587359151d51423b674af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154318, "uuid": "0587686d-321f-45b5-bd12-0c06d5565ed9", "comment": "Malware payload (RedLineStealer)", "value": "45a6282b70a05ade144a7262655dfe34760414a9c8edf613ee648b6bfc5ab92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154318, "uuid": "214234b3-1343-4809-a963-f694f394d647", "comment": "Malware payload (RedLineStealer)", "value": "af2dd91aa337c54d91654043517d0b1bde35025e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154318, "uuid": "1f1622af-c53c-4be7-8da1-6385868f53b3", "comment": "Malware payload (RedLineStealer)", "value": "4ec4d3f3f08a0982ad6442cc1ab0f1badcf2e92f8ca1aa56a4f197110b341dccd9dcca0242b43a0e1bf82dc052a70ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154318, "uuid": "9db04c19-c9b0-46c2-bd34-b14afd4da97c", "value": "T150847D4382E13EF4E9368B72AF1FDEE8760EF1548E497B6521189A1F00B81B2D673715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154318, "uuid": "bb2daf10-594d-4fae-b8e8-77eb2258f198", "value": "e01beb805c20903e324ef65e741d0209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154318, "uuid": "b30feb7a-7849-426e-b2ff-bec6c0c752cd", "value": "6144:5BYG+v4cb2bwJk+R7kkSyC+3GRo7cHlC:5+GgbjmsCloIlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154318, "uuid": "039498c4-7640-42a3-b2fe-a7b837c25abe", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154318, "uuid": "e6ac93ca-d547-4be6-8d8c-b82715ae9f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154318, "uuid": "a593b4c7-64f5-427e-9bad-eb2cd8952d76", "value": "b95ab99e6a587359151d51423b674af0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869215d8-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688137088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137088, "uuid": "023980c5-681e-4d38-a3bc-aef5a7bf209b", "comment": "Malware payload (RedLineStealer)", "value": "3b3ed329b47e2b7162409b682aa61653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137088, "uuid": "fe41f5ab-0bd6-460a-bff0-2b9acb5e075e", "comment": "Malware payload (RedLineStealer)", "value": "47677d1b0a154564df5f5fbf5f16e8c2dd493dc3c927ab44afaf971c0120793d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137088, "uuid": "75ce9c3c-cc18-4d70-9e8c-52357c485e64", "comment": "Malware payload (RedLineStealer)", "value": "32c21b4e0687c88de0687b86d6215c0bf03c7373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137088, "uuid": "a197b39d-7080-4ae3-9b69-761d7e33ee1c", "comment": "Malware payload (RedLineStealer)", "value": "4179618f09c6f43b0d304e0aeeb284e215ad5cba5f7c9ecd7459dd71fbe1696dff886c5c85482961d6a1545909387b25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137088, "uuid": "d4727ca1-7105-49f2-8640-54f15203e099", "value": "T19A546B203DAED3C9F8E6D932DA3DBBB4F4669DD114B0F787279101ACC92018295BD6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137088, "uuid": "e457295f-efeb-4d1a-911c-42d803e5390f", "value": "ae3313a7e55f2835265780c2d394ac1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137088, "uuid": "287911dc-c875-4ec5-bbe6-42c80e454ea0", "value": "6144:isO3VUfHU6Ps3bsmci25sndkzOYFwKBbvoEo+ciVh+d76u578C1A1EofDdxpHSqp:6QHnQLiVhc6uuEABLdb+jWrtJw7EszfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137088, "uuid": "b4d08d06-2136-4169-bb4f-8bd24dbf8828", "value": 290952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137088, "uuid": "b45e82ce-1e63-4562-8628-89cf944d8603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137088, "uuid": "0940e97c-d7da-40e0-b7ee-c28da2bf54f9", "value": "3b3ed329b47e2b7162409b682aa61653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8774b8e-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144447, "uuid": "3622699c-f99f-4d83-9890-094994b5e4b3", "comment": "Malware payload", "value": "937a648c9d71beb264f5af281af18b81", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144447, "uuid": "6d88283a-b4a7-420f-8dc8-a2ddf784f4bd", "comment": "Malware payload", "value": "477d948c0c0ceb1a7e04f72f82abf13109a4566b23a9515e9fcccc23cf3be5e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144447, "uuid": "49ce899b-b213-4019-a390-9e24e35eccf1", "comment": "Malware payload", "value": "98d7568014fbdf8fc576e8660a107fa93bf0c788", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144447, "uuid": "b3d00be8-ef94-4896-9564-5d67a144d174", "comment": "Malware payload", "value": "94ce8c955ab00f4920167fa8576c5ff70ab0e0ca906c35bdfbfaac8864e77ad2258b9dc6e290131e0f01db2e4f17a66c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144447, "uuid": "4e7d61c6-b953-4565-8cfd-683d4b0dd6b8", "value": "T194646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144447, "uuid": "15a87a8c-9298-4de3-99f1-ce8d99ad64f1", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144447, "uuid": "78d538bd-688b-4703-bb4a-0e8a3b67829b", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144447, "uuid": "937446fc-9f6b-499a-acc1-2028802b2d0d", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144447, "uuid": "8ce0607d-22a7-4bd3-a1cb-7788c05e313c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144447, "uuid": "5b212e73-b79e-4709-9596-ed933d70a23a", "value": "26loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec35a36-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1688109561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109561, "uuid": "40846699-7636-4851-ae2c-df827a177aed", "comment": "Malware payload (ArkeiStealer)", "value": "2bc310d6ebdae84ce4f495336e996ca7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109561, "uuid": "597f4805-ec93-4361-9ca1-1eb205d8eab7", "comment": "Malware payload (ArkeiStealer)", "value": "4794278c71d13ede97f6fa073fcc8546412fb2631996b068a279138169e0fc2e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109561, "uuid": "aa56b1a4-8c39-4bc5-b663-dd7e6c0dae72", "comment": "Malware payload (ArkeiStealer)", "value": "c5f54e4c168aa34f190f3188bdeeea0f515eae7b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109561, "uuid": "45cec8f9-e07a-4602-80c6-0a7af7a14d5c", "comment": "Malware payload (ArkeiStealer)", "value": "1e62a57841dd0d858b34ea2e80f1c5930bbb317ebd7eb1859c5d4ba1778428b259b2625ca3fecbcd1ae20bcdf4ede473", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109561, "uuid": "d53c7883-a831-4e87-b950-e169de8afdb4", "value": "T1A1949E439290BD54E925CB72DE1FC6E8771EF9508E497B662239BF2F14B10B2D1B3610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109561, "uuid": "37cbd9cc-5385-4cb6-b52a-7c1fb413a8cc", "value": "10c92732e2f9b87d0a930bebb28e6cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109561, "uuid": "fc5ff655-987c-430d-8550-14e39ac34e8e", "value": "6144:kJzKHZ/YaWWOpCtTapT+w9crB1c+vrvYQ:8QZ/pWWOp6M6w9cBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109561, "uuid": "84ad3ef8-ce32-4b6e-99ed-128f3c05c6c7", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109561, "uuid": "26a84998-7eeb-48da-b575-363ccbd154e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109561, "uuid": "872625cd-20e0-4f53-8ed0-8239521dfe23", "value": "2bc310d6ebdae84ce4f495336e996ca7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d472b418-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154399, "uuid": "d05b980a-4893-4328-b0c4-f00fdceb6ee6", "comment": "Malware payload", "value": "ff4295c4555a0ebbc91adcd5509886b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154399, "uuid": "e275c379-0e4d-4e90-9359-58c5471e7b20", "comment": "Malware payload", "value": "47c3a1bfebd6f5c6335836f8c313284e16d1fc62ca0a81addd350670d85cdf69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154399, "uuid": "79928cdc-c17a-4980-972e-1d21ac7050e5", "comment": "Malware payload", "value": "82c8301e21b9402a6539159be4a074835fadd610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154399, "uuid": "b5fdc948-276d-481f-b448-6e64ff513dd2", "comment": "Malware payload", "value": "8db813a69c17c26bafe5836321f2071a50ed69ab942c1148e16b0b82bb9f932ba6a2df193b0fe708ed7a7c5ebceb7614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154399, "uuid": "913dd6b0-821a-4de7-b331-310265222b33", "value": "T1F8F623786BD8DD76F9DF12BBA3125515CBB6C193B26AE38E4698F6F01C82350E834047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154399, "uuid": "045889d6-0ad0-4648-83e8-16c9c651b172", "value": "393216:Z2zEJ9v32fsI+9hIjvO0qBfrNxSM5t5c:ZKET/2fS9hIjO0qBfJH5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154399, "uuid": "c7544572-001a-4abf-8b9d-ae959fff0172", "value": 16190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154399, "uuid": "a1a198f6-18cb-4080-b398-d83ce436bb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154399, "uuid": "e1bec02c-8368-488c-af32-20ede1892625", "value": "SecuriteInfo.com.Win64.DropperX-gen.13187.22357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c77f29-170f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688106430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106430, "uuid": "a66bbc5d-7116-4128-8146-383855e66a49", "comment": "Malware payload (AgentTesla)", "value": "b45ac3d395b7354fa58ceb8b8a7072f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106430, "uuid": "f2db21e8-d53a-4c5d-8e6f-53daae5f4010", "comment": "Malware payload (AgentTesla)", "value": "47c89c8b504cdbd28b1e573025fc005b8a89fe4e7e6d61a608921881f41a7f44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106430, "uuid": "95ee5ff2-4951-404d-b328-76ea7b0ed284", "comment": "Malware payload (AgentTesla)", "value": "3ca84f5c556dd01f8a2e915d4e5b07d9f5083299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106430, "uuid": "7780cd9f-2e2c-4cc7-a1e1-70181a9e0294", "comment": "Malware payload (AgentTesla)", "value": "5ce0ac08f399f8567b9393c570181eff8f83c953aa696cc3c82fcdd7b76ac353beee930f81befe898243e8bba0229eae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106430, "uuid": "07382d39-7fce-423f-854e-41901023e74e", "value": "T1F6054CB8287C936BE5B8CBF05FC59013B7A0662E7085E7D6ACF313855352E5128C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106430, "uuid": "a678ccfb-69a9-4de5-856b-c8bc8dd1fd61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106430, "uuid": "d2dc833d-4bda-4a98-b5a2-e7b48fe8f45d", "value": "12288:u9XncwoPeeyy6/32BYGPnVkoDt4EzQPS6fA/dX+PDI1mPne+ox1bbbbbbbbbbbbh:MyA2BYG/ZDtAx+8PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688106430, "uuid": "83cb86e1-c3de-454a-9630-3a7faf817318", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688106430, "uuid": "be186cdd-28ad-414a-be26-ff0853eea4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106430, "uuid": "82b44e77-f1b3-48f4-a66b-b3742141d7e8", "value": "Remittance.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4485ba9a-170c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688105195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105195, "uuid": "6e619f9d-e82e-4af1-bfcd-f8c9d281a900", "comment": "Malware payload (AgentTesla)", "value": "8cd932c72a7fcb77360ec720d8b0f58a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105195, "uuid": "e65de3aa-f790-4dc5-ac8c-794e0ebaf66b", "comment": "Malware payload (AgentTesla)", "value": "496f81bf302b5bead2c2e6091deb5bb5b43c0bc7b825fcb30353e80ca55b8a80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105195, "uuid": "fa78f000-95eb-433e-8bcd-f492249a0e04", "comment": "Malware payload (AgentTesla)", "value": "c4fb4077650e71f263f91d7e4de10df82bccc85b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105195, "uuid": "6f5afecb-da28-42ce-8acc-8e87df0a47a7", "comment": "Malware payload (AgentTesla)", "value": "3440c360c2abefa4f56e845c3196484b29d7faf2126d3397236e20ec775794a79dfa46bd08628519157fed42c90f38ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105195, "uuid": "c1b09678-ccaf-4d28-a99a-3b710ed4812c", "value": "T132E4383819BDA327D134C7F58FD18427F364992B3021EAE56DC267E54626F122AC363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105195, "uuid": "e9d5aa15-92f0-4c4c-b66d-1bbf12d78b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105195, "uuid": "eb75e868-6793-4b10-9db0-a44ac56eec30", "value": "12288:OVp0K8s6owGNizGxZB7dk1or3wUK1vcfxJLgjdOwUzKHedQQkD:OVp0K8s6owGNtxdk1YgUK1vQBgjAzjQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105195, "uuid": "33db0702-b130-4f0e-a6de-0700ad68bcc0", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105195, "uuid": "22475076-ef4b-4df8-b196-4c4540aeca31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105195, "uuid": "01de7a3a-1a7f-448d-995f-21ba9e1434a3", "value": "PO# VN 00680723 JULY - SCANNED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db40cb95-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688111461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111461, "uuid": "50707dba-4df4-49b3-8272-ecaf19efb680", "comment": "Malware payload (RemcosRAT)", "value": "2df34ff3875b05c2afc9ce4b5565892c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111461, "uuid": "d0586ddd-d091-4626-93d7-7c89c9218f56", "comment": "Malware payload (RemcosRAT)", "value": "49e4d4f6aaf967b656487d0d3dc27ecf3812b2d454b85339ae9ea79021bbe0d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111461, "uuid": "653f39ee-b697-41a3-a382-9ac112857890", "comment": "Malware payload (RemcosRAT)", "value": "1145f3ef27ce7e9b9267fa6943ab9def386ab415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111461, "uuid": "25bd1714-3006-4062-a997-c279cf84c979", "comment": "Malware payload (RemcosRAT)", "value": "bb73dbf68ec6ac5e25b47b545ee09f0eee2196c9bfa2c470de57cc98cb45fd7672ffc9815ec5721a45ea71a2f99cd49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111461, "uuid": "3278a9e8-b471-44da-bea7-b3139f74182d", "value": "T180259C3D29BC6323C134D3B6CFE1C723B264982B3161EA665DC397954796E8225C363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111461, "uuid": "b0ff4702-6b8f-4f3d-b224-a48676e99c13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111461, "uuid": "1401f497-d0c1-4a92-a3e2-47a4c34c066b", "value": "12288:3FuSRx1tgUSihFLK/jsqb+JkacFuSaLUaeD5XZ9dNG++Fzvf:VuSRtg2ILNi6a0aga25BN0Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111461, "uuid": "6233431c-00b7-482f-bb45-1a03887a32aa", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111461, "uuid": "bfec6c4e-1ce7-4350-9258-e0e463a710a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111461, "uuid": "ea5e3771-3546-4504-a547-4bad0fb16b47", "value": "2df34ff3875b05c2afc9ce4b5565892c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7721c639-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169275, "uuid": "807c1daf-fd7d-4651-a9a3-3f713ca8fa38", "comment": "Malware payload", "value": "511b5cd4e34caf14798eef316bf5919a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169275, "uuid": "4b7d2e03-d6ef-4980-9945-589fe84cace4", "comment": "Malware payload", "value": "49ea91c178855bd87cfbffbf77e92674c9f4b15dc41e42c8abb44408d40b25f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169275, "uuid": "4b4fe9ec-0e07-4bd1-adc8-04e167376252", "comment": "Malware payload", "value": "6064e0fe1944fcd6d3e273dda7419cb5096b3e91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169275, "uuid": "e5f96501-3557-4b71-8300-7adeb172a5c4", "comment": "Malware payload", "value": "7cbc0fa7ad62fe11874523c3c5e4d0278c48d8baab43f581f4a17e4078fc3c2318c365a8ae6ddf2908854067aeb3b13a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169275, "uuid": "d853ded5-5f53-4e90-860b-587e7b265557", "value": "T124E209A2BCC2996BC2D4237AB66F469C339537E4D2CF3713E8051B41368652F8D73A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169275, "uuid": "81a6be77-bc6b-47af-86d2-2ec1871163fc", "value": "768:b+81DmCxEl/8f6EG5KSirWX7RH3qO5CoRFdr:KjCyEfFG5KCrRP5br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169275, "uuid": "a534810d-a0f9-4059-8f0d-2f1f99c5cf00", "value": 31592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169275, "uuid": "3df08b76-8961-422c-8a71-b03108c3f3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169275, "uuid": "b3e58754-3602-4325-b96a-4bc9ea229337", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3116568-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144464, "uuid": "ed427579-c704-4a7e-b670-3af3a39dba06", "comment": "Malware payload", "value": "bea98ec01b4481ca758b2acf6ffa6cc7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144464, "uuid": "c2275a8a-2927-49e0-83d7-648f0f59f03e", "comment": "Malware payload", "value": "4b2e6e71162857931fc426b17288192fb226a5b35373e5bf3ff87c4eafbb9105", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144464, "uuid": "1363f412-ccc4-4b5f-a5c2-56568105e24b", "comment": "Malware payload", "value": "949b1fd73d934bd2fa79fea25d8bd177ddda3d55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144464, "uuid": "3123c2f0-85a6-481c-a321-63b341fdede3", "comment": "Malware payload", "value": "e6002dbcab45557bf4b3c86afa368f2577a7bf887198d4363e08d24aa765962014574b983ec383af00b4a6176fc2da8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144464, "uuid": "2a2125bd-e162-481f-abb1-4569a2c47b89", "value": "T12B646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144464, "uuid": "272c7b0e-3131-4b16-9cc6-508712f43bf2", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144464, "uuid": "c29a9cea-aa9a-475d-a685-96809215eaa5", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144464, "uuid": "152ef0b7-ea60-4db3-b539-45c9db8a7737", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144464, "uuid": "0b6c076c-8197-400d-8ecd-1a00f2b1b60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144464, "uuid": "c23c6e07-48a7-4d4f-a20d-ad143e7eae45", "value": "29loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b4129d-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154367, "uuid": "24b74679-a58e-496e-8bf4-1510c88e5575", "comment": "Malware payload", "value": "cca6bb61fd97882215e1f79048962ba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154367, "uuid": "bde4a9f3-7b99-4707-94eb-1d8364980712", "comment": "Malware payload", "value": "4b3fd775a80b08650b33e1df27b2dcad6d48740918776c7ff1a8d648927bb226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154367, "uuid": "a7739070-12e1-4ca6-a201-56132f18b371", "comment": "Malware payload", "value": "a3809568f127194e9b8689ccd0a6e3a33a9c3107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154367, "uuid": "b86c3715-2110-409a-afe6-db509feb18fe", "comment": "Malware payload", "value": "73b852304d21c6e22c7ba347eace2e74fe767666b9566562d6d8bc91bb4451f3ece4e77073e8fe2c2003ebc7be3b60f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154367, "uuid": "fc7857a8-8c63-42ab-82ea-74ed9642c764", "value": "T196D623087398CB53EADF0BBEA271112487BDD501A1CBA74F164CEAF594433A0D85ED9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154367, "uuid": "b3c5282f-e960-4b67-a82b-d32a20c31072", "value": "196608:ISbbpDedIlQs40iwP8BIgNbNoyaqrEXJ/sJzrP575nUz+WWp3JUqoqG+Pr:T/j40r83BNoIr4J/+rfmTWpZ5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154367, "uuid": "20a53e5d-c071-45b9-8e3d-78690df200d0", "value": 13770752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154367, "uuid": "12c771ce-102a-4b0d-b602-9446092136d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154367, "uuid": "38d0abba-5fe6-406c-ad19-882b98e5e962", "value": "SecuriteInfo.com.Win64.Malware-gen.30205.9755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c594e51c-1717-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688110136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110136, "uuid": "2c07637a-40b1-49e7-9b64-7a7a910aea99", "comment": "Malware payload (AgentTesla)", "value": "2107b9cb24164e7b6fc6b8552f8a6574", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110136, "uuid": "a143366b-72cc-4a00-b502-bf6b75e54441", "comment": "Malware payload (AgentTesla)", "value": "4b40e11d7fcbf9eb1f49889af19bc26a8c3ef6faaf2c8614919d1ee0ef8f2ff1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110136, "uuid": "c2436212-d9f4-4ac9-9f45-80f76e6da19e", "comment": "Malware payload (AgentTesla)", "value": "c20c283439e9ab4ebfd2a1bd43a37ec27db494ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110136, "uuid": "fae2e694-df9e-449d-900f-1f628b425e6f", "comment": "Malware payload (AgentTesla)", "value": "caae4bf8fdaf82fb497c9c100f7ecac249732d7815128a67f891624fd7f9bc9028852d15042b9cc53b83c512af2fea16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110136, "uuid": "52d9555e-5f70-43a5-b36d-1c42d0bcb2af", "value": "T16D158B3D29BC6723C174C7B5CFE18723B224982B3161DA365DC39BA54796E4229C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110136, "uuid": "0b606e7f-85a7-4eab-8529-f1424cf2c1ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110136, "uuid": "7243b394-5af0-4a47-bc35-50d68a252681", "value": "12288:0FxMq0mQB5AmZD9vOgux4JNP+i+dRgoTWTL59sEt+hzt6nIMUCaPtBoWev:KxMqPmZ1OguePB4goTWL5Cg+dIrCsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110136, "uuid": "9a684f10-55a8-4390-a98d-d5dcd74012c1", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110136, "uuid": "1dfa80b0-d09e-4f89-89be-5f4f6abede7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110136, "uuid": "ce438718-8983-4ae0-ab78-c9522faeea57", "value": "2107b9cb24164e7b6fc6b8552f8a6574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780ab779-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169276, "uuid": "9ce7bdbc-6c5d-4773-ba98-a1ef2c3d287d", "comment": "Malware payload", "value": "f17157fee2aa4d0b69cf0434d6dbec62", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169276, "uuid": "6b0068a5-96af-42ba-b69f-4021dc2087d6", "comment": "Malware payload", "value": "4b65bfb15a4762cb2030ef64015f54cda01206eab6b415bf54675a08496b3537", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169276, "uuid": "6652d249-2ed2-4048-95b6-c0773636d3f1", "comment": "Malware payload", "value": "30d87731ff97c38fa3f881a79f9fb2522cb117f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169276, "uuid": "60346dac-2a79-4cd1-a2f2-3fbef4cd0076", "comment": "Malware payload", "value": "2754dd7922af462f7e7ad01fa7c55f7768a3f992e09cdfe1f660da984b68868f4b827285fdecb60f9747e4c49c1e3bc3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169276, "uuid": "bbc8facf-7ce1-4ce1-8750-d45b320f1420", "value": "T1E2C31945F8509B17C6D652BBFB5E428D3B2A1768D3EE32039D156F20378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169276, "uuid": "c9648282-d861-477b-a165-efa19562e5d2", "value": "1536:P05C7AmdJ8dD9kSkRKU8dAz4V4VW2IxTNkybumMR09Fv2KTlVAwywkIGXkSjvw5L:s5C7Am6kSGb8dd4dy5hbum/je8Yrwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169276, "uuid": "daa9691b-d649-48c7-8634-c4713facab24", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169276, "uuid": "0cad02c0-67bb-43d9-8325-83e39b25e6fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169276, "uuid": "55343eb3-5440-46df-a8d4-5d887a2783c1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e86571-1732-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1688121598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121598, "uuid": "03e02ca2-2663-47e9-bb76-bb9f20f15d91", "comment": "Malware payload (STRRAT)", "value": "4761d770468b1b41eb0aa26c57e4e605", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121598, "uuid": "c1464aa9-0107-4050-b2a3-a36a245cb959", "comment": "Malware payload (STRRAT)", "value": "4b8d0b78d89d1907b33b64cd146900580c7d50771ad7f224c4aaebec14eb3212", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121598, "uuid": "283d6018-2e72-4f09-b22b-4b4b5a64a122", "comment": "Malware payload (STRRAT)", "value": "d5674e55de3521a89b9e0b04bac2b96bf7d187f4", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121598, "uuid": "a7bbc6ce-512b-49b8-b9c9-73dffb2c1390", "comment": "Malware payload (STRRAT)", "value": "a349790a47e3bacd7d27c89385137077f5479a9b29ff0d1fc98b7aea4c8eee8bb590b65b02f7106d0a1bcd43d66832a9", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121598, "uuid": "f0085e7d-d118-4686-af46-ef4db91eabaf", "value": "T1CB63F25B3FA855A5D247EC3C630206A7A8DA60ECFC67F65EB9BC46A74414838050BFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121598, "uuid": "1529c59d-fd54-4242-bfe7-3d29fce177c9", "value": "1536:qRG3rplWPsBziFqGWGuhqqOGgPqNGAO53N+3:qRGb2meFqGWGuhq3Gpa5303", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121598, "uuid": "546c7628-2310-4720-bc45-05db6e80b16c", "value": 72261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121598, "uuid": "0834c039-3316-4e64-b5b5-b3ed76c0f11c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121598, "uuid": "da3e9400-fc96-4bad-a215-3496030fc143", "value": "Payment_Advice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cb4ea8-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144113, "uuid": "1ba2cdf7-7ee1-43b7-9b89-361632edfc18", "comment": "Malware payload", "value": "84b21d8725b7bec20436dbf3f82d2c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144113, "uuid": "131ffcdf-3f73-4894-b74d-595205d06e42", "comment": "Malware payload", "value": "4b95b4baed8ab99e460c00c628280a1c3c10f209f47712b7336b554ef19ea8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144113, "uuid": "c8c2d546-e10e-457a-8d32-9d3321d9e8bf", "comment": "Malware payload", "value": "c214f3bd59a1b4816074940ed2da4ca3dff176fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144113, "uuid": "3c49078f-6b2c-4107-9e17-9dacb5eaf943", "comment": "Malware payload", "value": "4e8ce56dd51fc7bb3323d48bc82887643f57aac11e243686ed53a980c27f85f351b01e77d03dc299ab7596a8431b9342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144113, "uuid": "97eef1a8-e088-467f-aa14-e5f54b87c1d2", "value": "T13BE6331953A46A90C22453F627F18A47042878521E34DA9B369FF33D1CF299EBE35F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144113, "uuid": "de3c5790-6deb-4fe1-ae3e-404f6ee97894", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144113, "uuid": "d89035e4-da60-4ba8-9539-8f84f4a55805", "value": "196608:241EQYGZWHHnaDjH16JEQwZm058MKG1lXN2BGVsE8hSzJwJll8wQhRdxXe:ZEQYGZvD71CE205bpXUE7zJw3l8HhFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144113, "uuid": "f58abd0b-29e9-4686-aa0b-9c3e99c097a1", "value": 13957120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144113, "uuid": "5d396016-25b6-413d-9371-f851878df550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144113, "uuid": "86e33ef1-9b87-4f2a-8597-e2856f1126d4", "value": "SecuriteInfo.com.FileRepMalware.2822.22739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29b927f-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150879, "uuid": "048a4b48-f751-434b-aa17-74e9a5c45712", "comment": "Malware payload", "value": "d6b2ea8abfaabacba99ae29a4e402068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150879, "uuid": "7ed1d2a3-234e-4163-b535-ddad888d6b27", "comment": "Malware payload", "value": "4bcf0fc6828cb53dac953f6426aa5bd70b9c05c596dbe4d81eeeefc4f98e936f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150879, "uuid": "8db650ca-5fdd-49b6-802b-6c3255c6b827", "comment": "Malware payload", "value": "a34517ff4dcd7744e72138bfe81142e35b1786c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150879, "uuid": "40322307-0af3-489e-8782-f6a935ab08ed", "comment": "Malware payload", "value": "63a4a823c74b26ded3e99da891ef7b89c2651be302e1df24fa501592869bb87dc593085354f0a27faa2cab9f9ad33a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150879, "uuid": "53a54175-3362-4ec6-8ac1-96cb3969ac54", "value": "T12975D061B561C033E1A231B696B9C77AAD79B530A72894D7B38C0A781F306E17D3D34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150879, "uuid": "db3af505-0545-41c9-8deb-3bbf5f8a9024", "value": "5eba888f6c96615f0ad20e3959c5bea2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150879, "uuid": "cfc67f12-f4b1-47a8-905a-641f3ca4204f", "value": "24576:ZLUkPbvoVLtECQr/r4HZaLwWoZ5WCparnSLsmgrDPQsc2UGI8mxc+bbVgIppVquS:RcGC6r8ZaHoiCpUnLVDPw2nIr/VLzecQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150879, "uuid": "4079c0e7-426c-4a54-a8df-eab201a5446e", "value": 1549488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150879, "uuid": "49fc70c4-aeac-407d-96eb-1c2f7074f2c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150879, "uuid": "09dd79a8-0c1b-4b64-b0ce-48ae17166150", "value": "360\u662f\u6211\u5927\u54e513524pp@pp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88cbda3-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688144071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144071, "uuid": "7cb130e5-3053-4a2d-b20c-dfb1eff1aa18", "comment": "Malware payload (DCRat)", "value": "4d242c5ba8a073fd3bdc6e21d4206297", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144071, "uuid": "a6f34203-6eaa-4c50-84d0-fe86eb00a2c5", "comment": "Malware payload (DCRat)", "value": "4bdab9a6c4d44f4404bf56fd34b5d6d9dd602e88cc02b5b57b09cf7e55e71cb1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144071, "uuid": "755f2fb9-82a3-471a-82d7-d348135131bb", "comment": "Malware payload (DCRat)", "value": "1d75900b8763b47da81af317f1e146232d4252dc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144071, "uuid": "04f4ed53-db64-401a-80fc-8b0ad6ce45de", "comment": "Malware payload (DCRat)", "value": "bd4e46499d827519586bbd306f0b9893e5501d80cc62e55554901eb74ddc66bff1fc24a86cbdd511bf30c9504773eed1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144071, "uuid": "5cc0a159-11b9-4008-b3f2-4345568003b6", "value": "T121D63346EB015229D8B95772C4D2096964FAB4F3AF06B6BF346C5E5E8C27FE04C3E121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144071, "uuid": "0ce200d7-a056-428e-bbee-b119c6b27524", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144071, "uuid": "fdd5c7cc-f42b-4d2a-8b8c-d424bfcf4ac7", "value": "196608:b73DBivaR4eB+qj8yhn2kg2tpexvMs7pzGQU4Px+FFaZTMZhKTC6QYP:bBi0BE4XIR7pzGNkx+3aZoKTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144071, "uuid": "4366f79a-34f0-47e2-91a5-568a746a90f4", "value": 12691456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144071, "uuid": "6b028dbc-0ed9-44e2-82f1-bd87ff5f28c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144071, "uuid": "f0337e82-b535-45b3-b29f-a2ffcc607af8", "value": "SecuriteInfo.com.Trojan.Generic.33996402.32730.25858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da0c579-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688111330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111330, "uuid": "746c00ad-177e-4b6a-9c49-590bda925e12", "comment": "Malware payload (RedLineStealer)", "value": "96dce509b8ec69b138d279a9b4aba079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111330, "uuid": "0300ec18-aa1c-4b84-8f07-fb07e8bfd550", "comment": "Malware payload (RedLineStealer)", "value": "4e058a4182bd3c1715a44fbdd4154900e15869c44641d97793b4817071ef5697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111330, "uuid": "73513910-cccf-41fa-8950-789205e5b556", "comment": "Malware payload (RedLineStealer)", "value": "d572cb1d9e0363492f4763ab55ddf0f6491f470d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111330, "uuid": "8eda70fc-30dd-49f0-8d8d-c118ca535da7", "comment": "Malware payload (RedLineStealer)", "value": "034beffcc9a06d95de2c530263b821bcf3bacb1cf77147ee030599bb1911b94fbe4eb570b81cffea23cf686d1c209360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111330, "uuid": "003cbaad-bcaa-48a2-ba73-be0715cef0a1", "value": "T1D10502033EEC83B6C5DEE4B681FFB9158639832127B3728756C4A19B1A64BD0907E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111330, "uuid": "8db04aed-62c9-400d-a3b8-1697884c9176", "value": "bb1d8bfc6c51ca02a6f390c720552f6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111330, "uuid": "fb815a4b-f679-48f2-91e8-9aeac2247f21", "value": "24576:Q0QDNEQSn/728OarXScri5yG3JYBvgV2ig1gP5QlyWeeMw:Q0sNEQSzrXS0GZYBg2PeBQMWeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111330, "uuid": "45374fa7-7a33-45cc-95ac-1298b5d04987", "value": 850568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111330, "uuid": "9f9d276c-f493-42cc-8e83-6e6351c3c38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111330, "uuid": "cde0fecd-d8dd-4e92-9186-e46e37eb3373", "value": "96dce509b8ec69b138d279a9b4aba079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce500ef-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144722, "uuid": "9861fdd0-73ed-4ccf-aa45-c0307ac01d8b", "comment": "Malware payload", "value": "c4de36a7748abd017f40dfa00e72c8ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144722, "uuid": "d9703e66-2fa7-45ce-bbee-60aa706606f9", "comment": "Malware payload", "value": "4e1d3dfbb4c3cf6590b072ecfbc363085164f7abdaa5a74490f40a60c3f83ab1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144722, "uuid": "3db5981a-3795-4a97-a115-c8ae3f8595a2", "comment": "Malware payload", "value": "90d637fa6462b7974a9084fe698c01a85185d256", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144722, "uuid": "0004145d-5536-4035-8aee-f18d078150ff", "comment": "Malware payload", "value": "fae122784e502c980739a570b41c50de867a697ecd1b80d6f030798320167aa8c6d9b5b36d5d3c107529f9a28bd9b963", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144722, "uuid": "c1cdf9c0-0cbe-4d9c-831c-f7f1d76af001", "value": "T1E2646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144722, "uuid": "8452f579-8760-45b3-b6ad-406ea879bc52", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144722, "uuid": "e4ecb03a-a46f-44e0-b535-2e8f93f07285", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144722, "uuid": "665fe30c-e436-433f-8e53-83714181b108", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144722, "uuid": "13763805-58af-4c21-86b9-d86f1d14024f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144722, "uuid": "7eb7fd0d-fb16-4fff-ab08-23c0f94590bf", "value": "5loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782ef45b-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144366, "uuid": "5605dd1f-e2f7-4257-9850-08d3f2f9241a", "comment": "Malware payload", "value": "94526f3b3f9d98c6e86307af0cccb2ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144366, "uuid": "95a48af4-b78b-445a-a12b-c953cbb98543", "comment": "Malware payload", "value": "4e47f047e62eeeda6d94c1e36ad7de906f8cc14b2ab718f81ff50b2c6c76ed08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144366, "uuid": "6badd3d6-3c17-4cf3-a790-5060a74aca36", "comment": "Malware payload", "value": "5dc60ed39487da4b91eb18bc3a7e7b15a821547e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144366, "uuid": "148ce733-7f23-42da-8691-2fbc3e056501", "comment": "Malware payload", "value": "70f579480289ebe3d66255f25a50e51641ebf007a6730e6dcd028dec3e4d29c98ec0872ab8b5ab784625b856eb056ee4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144366, "uuid": "857a351e-c185-4999-8cd2-9ed2e709dcb9", "value": "T124646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144366, "uuid": "668b30e9-3c20-4741-a0ee-90a7cbaae593", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144366, "uuid": "dec57fd9-e9db-4943-8a14-435b6ff261ab", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144366, "uuid": "bf0b501a-772a-40e9-8a21-2da581c25b9c", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144366, "uuid": "19ca1817-39df-42ad-b384-4cce5967056e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144366, "uuid": "f07c624c-6cab-47fa-ab9c-e08490b244b3", "value": "14loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8408df18-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144385, "uuid": "fd2c84eb-91ba-4c49-a8df-6c661bc10bbe", "comment": "Malware payload", "value": "03ba722e412ccfa8edbaf6cdf32975ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144385, "uuid": "6560f2c1-95fe-487f-a924-405a00a11c61", "comment": "Malware payload", "value": "4f20d74c56a52caaeffd88bec4132cd83942e567529e49914569ab365d8ebb96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144385, "uuid": "316dc890-9e62-4e22-9e4c-e9bf0d345a06", "comment": "Malware payload", "value": "705a0151459e8eef630df67995de5d268783922c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144385, "uuid": "df5ef051-bcb4-492a-9c53-abef877da058", "comment": "Malware payload", "value": "757c07818bb79690825dd280ea599a22d7b81a95296a2bbb9e6e9e9318a6159764d67b3b2fc519b0aac38856ea848ddc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144385, "uuid": "cef85565-17c0-4534-b5bb-fa84dbfaec0b", "value": "T1AB646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144385, "uuid": "d4aaa762-fef0-4010-9f84-8c22ba9292d9", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144385, "uuid": "84fb5911-b007-4b9c-998e-196210e90dd3", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144385, "uuid": "2c38e4b7-b1e0-4653-9f5b-b8383b30a55d", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144385, "uuid": "fc5f1b55-8c8d-4e5b-847b-77dd1a31bcd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144385, "uuid": "9e5a5db3-d6cd-4978-86cf-f53a5636b301", "value": "17loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afc0231-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137069, "uuid": "f7975808-4c43-447b-b925-d2c66dee8c1f", "comment": "Malware payload", "value": "c0af652e841edf407000a46ceb7452f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137069, "uuid": "5b42258a-b270-45c7-9542-5aacbf90d705", "comment": "Malware payload", "value": "4f6a45265bb636897e80d28cec61e42e34f1b7dfe3093b9458d94708cf54ab9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137069, "uuid": "8d47bd80-5873-4332-b57f-b7af4979694a", "comment": "Malware payload", "value": "21579b389ff57d68f15a85d5049c384c108af778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137069, "uuid": "c2eb1eb3-e1af-43e6-a252-fd86f835e2e7", "comment": "Malware payload", "value": "0e3306fbbe3813611bff1a5b2cab8cb6f8640d2b126ffe902c055cea52d0f256221c7d7ee6fb934f5ba9ad36f5f9ae39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137069, "uuid": "366ab1c5-60bd-475f-904c-728a545df33b", "value": "T1F6247C4A63F03CA7D4B5177054FAC2477A3EBC619B3593AFA285F57A0E33280A531B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137069, "uuid": "9aacc4e9-594d-4db6-af06-c51890777295", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137069, "uuid": "21b433f7-b38a-4981-8cff-b95237afc47b", "value": "3072:kHwrxmMpvDITZg1Sj5vWp1icKAArDZz4N9GhbkENEkgUWRufUuX:7rMZEp0yN90vElUsufU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137069, "uuid": "a4064774-147c-4932-a0b2-d12ba855ee1d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137069, "uuid": "ac00f9a4-862a-4614-866f-15c276f80fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137069, "uuid": "c336e882-bcf4-4eb9-a96f-ff2e901a4fd4", "value": "c0af652e841edf407000a46ceb7452f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16553a8-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144488, "uuid": "7e477de8-969b-4900-bad0-954d237b84f2", "comment": "Malware payload", "value": "586fcc71c0867a16c991f6cd38075a87", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144488, "uuid": "0c734440-99cf-4d8b-a32f-39397d8d148a", "comment": "Malware payload", "value": "4fcb1366bd93159988873c2e4dc846a1ae047dadd382a69527be36d68e2b819a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144488, "uuid": "54c953fb-4110-4a16-becb-8035ea4e0f51", "comment": "Malware payload", "value": "9af7f0651349952c10ad5a46ac6937db107bd953", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144488, "uuid": "99b0017c-9403-43e0-a1c8-3a47d11556a8", "comment": "Malware payload", "value": "e63d7c4610c64520890f440e3c4dcc8cc07c942d420790cd252b56b454df3dc642e8537c97e354370320607a70eed3e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144488, "uuid": "35dc1909-17d0-4143-82c3-07e15ee9bedf", "value": "T122646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144488, "uuid": "c3233c90-896d-4e6a-b930-dada7d4d1466", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144488, "uuid": "915b4c58-90ad-4f20-ad47-dc89159fc364", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144488, "uuid": "6821548c-f0d9-4283-bfd0-4c30f3208482", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144488, "uuid": "d145e226-9c58-484b-9968-173e2d0e73aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144488, "uuid": "3a29e329-9889-4310-887e-45545c936ea9", "value": "32loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c1e159-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144095, "uuid": "e53929f9-2d3b-4819-bd0f-a50b5634a36e", "comment": "Malware payload", "value": "a968d9079cde137ea9c192bf8677b8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144095, "uuid": "2b765aaa-49ee-4ef1-9a05-f37c01d9e873", "comment": "Malware payload", "value": "513ba88b7a361df32abac9a7fa4194cd2a762991200d1efec27e38781fc790e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144095, "uuid": "ce8aa411-7d3e-42fe-923f-cf7710aca111", "comment": "Malware payload", "value": "505ef296230393be38303418b841787b5b80cae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144095, "uuid": "d4114b7d-a16c-4163-9bb2-220598e2676c", "comment": "Malware payload", "value": "93a8fb9c13c53a2caeb8fc1c4f02bd072c5556e89b2ae7cb3353339b6251d82d296f729c3063ada6046f6bb266538678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144095, "uuid": "e3458e74-bc8c-4841-bf58-72bc4b0937ee", "value": "T18B763325D258A728C314B7FB2BA3F2454C49AC12192CAC8D742EF39E54F965DBB11F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144095, "uuid": "f0b9b553-db71-4440-9379-c9547071f564", "value": "196608:sMr5YY0zO/rqHDBa+G8VleF1RqTItyKS3:sMKY0zO/2a58vecTI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144095, "uuid": "1f0387b8-577f-4d24-abec-c81c41651cfc", "value": 7374336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144095, "uuid": "b1376171-669d-4029-a886-a01d9c040428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144095, "uuid": "28a7b005-7113-4b43-9df5-c3b53c5b86ff", "value": "SecuriteInfo.com.Win64.RATX-gen.15266.12081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6692a0c-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155691, "uuid": "84ba6d3c-de5c-49e4-944b-678c0ce20f67", "comment": "Malware payload (Mirai)", "value": "1390511ecb0996932c49b6dcf0c20799", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155691, "uuid": "f6cfc3e2-6f28-41c8-9709-f353ec1d9f86", "comment": "Malware payload (Mirai)", "value": "523306cbc4127391a080f71626f9de21ca691cdf1e99433e3246dc13507a4729", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155691, "uuid": "e7d71af6-e478-4dd7-8c52-e75456f2c236", "comment": "Malware payload (Mirai)", "value": "a1966f953c6e1d6e68d68bfc50a0ab4adb38ff3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155691, "uuid": "5c5b1de2-f393-4390-99f9-f55e9e4ccae4", "comment": "Malware payload (Mirai)", "value": "1605496847696dd90df6e3250a7bc6e944593ac12d6f1ea7b28b586b405854b3097cfe4b9d35b0f1f2647bcdcff8a1b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155691, "uuid": "8f13be24-6b0c-4f19-b98b-d3ab1d8b7acf", "value": "T129B2D1A48BA16707C570B435E3788F525B3B55E4C6F639262A1093BCDB824A632FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155691, "uuid": "176652db-9a7d-4567-a19f-333ba93bd632", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BhihymdGUop5hu7N:4GHKQFH0rs3zWoDDRsjt7LB9U+Bss3UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155691, "uuid": "b88dcc70-06f5-4206-bd75-50d61c263eba", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155691, "uuid": "25a0f756-937f-4cfe-a960-a4a0430ef35c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155691, "uuid": "b1f8a218-591c-43f9-968d-5069c1ccf675", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2116d0f1-170f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688106424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106424, "uuid": "9014542d-7695-440d-9dd3-c4bc51cec36c", "comment": "Malware payload (AgentTesla)", "value": "14108c4b1d09e65fe7437c1827131b45", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106424, "uuid": "29d787b3-b865-4e85-bbe9-4873479231ed", "comment": "Malware payload (AgentTesla)", "value": "527a16bae3563f0c4420ac2437549af3368dffa4e279549e89cf0956d69d53ec", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106424, "uuid": "c3458445-ffe1-4306-b28d-9d6f3610ed2c", "comment": "Malware payload (AgentTesla)", "value": "abc858d20a1a30fb8dfc7a11ead488951f1d371e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688106424, "uuid": "029b5233-82cf-4916-a9e2-eac40c75e1fc", "comment": "Malware payload (AgentTesla)", "value": "3e8b5285ce8e0dfb9ee7cfc5650a0ab233fb3447729a22d7d2dc7c8d6a60e602bcc7513b3782f6a409571306e7dfb63e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106424, "uuid": "9a420ee6-2bba-481c-99c6-8ac878061abb", "value": "T186C42330D89DA631A5FF9900E214BB8D69ECA170B81D137BDEC2CF016988DD42E67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106424, "uuid": "0f359baa-829a-4a80-ada1-053c0c576189", "value": "12288:HL+gNOWy6/3nBY4n9FkoDkmEzVFgzfK/dA+9DRJNjTDwdo:HLtNOWyAnBY49pDk7W8X91JZTOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688106424, "uuid": "fbfd9b58-7fe1-4068-94e6-b743208aefce", "value": 552579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688106424, "uuid": "21b64e79-fd77-4219-b3a7-36a1f7307a4f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688106424, "uuid": "ef0a37d9-5a9e-414c-b456-c0ea7deb1c4c", "value": "Remittance.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271a5e32-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144659, "uuid": "4cb8f89a-2ac0-4eac-a937-7699226b8997", "comment": "Malware payload", "value": "4f2cffde9d74f670d1ef7888dc775227", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144659, "uuid": "d16f8f86-bcfd-41b2-abc5-37f5c698ea2c", "comment": "Malware payload", "value": "52fb4c7a25a034cd5eadbf262271592321252fed598e33572a483957269a55b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144659, "uuid": "ff3e4080-a306-4e33-9ab5-cdf2819b12f7", "comment": "Malware payload", "value": "6ec62326719fa014cdcbfd0c7fc644d33d676aa1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144659, "uuid": "38a54ab4-6f67-4e9e-b3d5-512317933f03", "comment": "Malware payload", "value": "a8be13049f3a8c9e0936293f59fa96af22d55abff6d7af615f060211d0394530d4bf3ac75e6bbcdb636fda760feffe44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144659, "uuid": "6a32db3a-adbb-43d7-a3c7-79896f758279", "value": "T12C646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144659, "uuid": "d36574e5-a036-491a-ae82-9e09c867b0a1", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144659, "uuid": "b05ca076-13c6-4d17-b3d3-405b3f4b717a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144659, "uuid": "33bc1def-e7cc-441e-be30-fdbe4e35dc60", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144659, "uuid": "c23de576-5231-408f-867c-b07e675754ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144659, "uuid": "85eae6cb-6130-485c-90c4-048555d5e2dc", "value": "53loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9796b253-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1688109200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109200, "uuid": "f6eb52c5-a2a7-4f36-9c65-b79429a960f7", "comment": "Malware payload (RemoteManipulator)", "value": "1967a94cdae6996d3f0ca730c0faba87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109200, "uuid": "6a3c8258-f6ec-4f13-a654-5f7cb6ca6c8b", "comment": "Malware payload (RemoteManipulator)", "value": "53755e70aa575f77d5936a1fb3484e5ab48b577ab5621bba47c9887d052bc273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109200, "uuid": "d6fdc2da-4511-4ece-ab1a-5fb1fece379f", "comment": "Malware payload (RemoteManipulator)", "value": "65f5d9b73f65fa1e07463f1c41bee68fc20e061c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109200, "uuid": "42f1399f-a621-40f2-860b-653bb6f1271a", "comment": "Malware payload (RemoteManipulator)", "value": "7673a86341a9f4d68468ea29c664cd66c3dfce99029b12d83f8b1c230a31704cabafcbd4ac2eddaa51b83f11f9aa397a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109200, "uuid": "9e36992d-ec68-47ba-bafa-918f34f31ac7", "value": "T1087633DBC9C714BDE0E143B0646D46135F31A094AA39CEAF08489FE8D9B60C2A57DB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109200, "uuid": "61bc048e-64ea-4738-b966-8e9a01fd84ac", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109200, "uuid": "7d117ca7-1918-4a8e-b590-fd28a7410763", "value": "196608:1728A7QtVicVqv+2/2sgNCwE+Hfo1LdGH+OZwWqG+i:lqQ4Gs0Cw/Hfo15M+OZHB+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109200, "uuid": "13ea9a39-1434-463c-ab11-f890d2561079", "value": 7316992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109200, "uuid": "ffe39915-2ec9-48d9-a97a-a2df690933fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109200, "uuid": "eb2633f3-8b03-404a-af36-6830dd738b62", "value": "1967a94cdae6996d3f0ca730c0faba87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac959e54-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688110953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110953, "uuid": "abe7c09f-48b9-4681-b534-937e919732d3", "comment": "Malware payload (AgentTesla)", "value": "9251138a10858ee756d0a7327c6a0635", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110953, "uuid": "6eb570be-222f-4caf-95ad-e09c076832e5", "comment": "Malware payload (AgentTesla)", "value": "53e575805dc9d69c41f366e65946a7d4adf051f322f463f70e9b2f80d50450cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110953, "uuid": "f48350b4-c4f4-4212-8d2b-dc33c8cc1bd9", "comment": "Malware payload (AgentTesla)", "value": "ee055a79b513a412a2f6c7eee2d8e2b96a9a51d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110953, "uuid": "76ac7c44-0f6a-4f85-8b8f-36943fae2ea6", "comment": "Malware payload (AgentTesla)", "value": "6560c1e3147772acf128afd5bcc64d538529b7471461c13db9097ecbebf73396f81a0fced890ab484daa42b34e2f4c43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110953, "uuid": "e24a429f-b41e-458c-8ef6-daf70ed89efa", "value": "T168D4593C28BD5333C074D7A6CFE1D723B254942B7561AA365DC39BA64796E0229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110953, "uuid": "d23a9af6-1e9b-47dd-8932-bd1eb3e2cc3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110953, "uuid": "b55c3f2e-56ba-4107-a3fd-4fede8e9d25a", "value": "12288:L0zTUAXr+ZTmowVNE02/tmBgZKlwKLQ1Z2Dnf:YzoAi94u02lmC8HQ32r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110953, "uuid": "41b5f99b-1aa1-446b-8af2-2b44835fd406", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110953, "uuid": "24ea8593-c12e-459e-9206-d9598f759221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110953, "uuid": "e31b2341-676e-44b8-806f-3335b0773931", "value": "9251138a10858ee756d0a7327c6a0635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7047076c-1712-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688107845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107845, "uuid": "33a80207-1a71-4865-ace1-8c06d1657441", "comment": "Malware payload (AgentTesla)", "value": "cc09c92e18ee0c7924d47f883ca5514e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107845, "uuid": "1ed69263-0a0e-452e-9e5a-d8c8558c320a", "comment": "Malware payload (AgentTesla)", "value": "54c348ef8f2ff200e4e2d75b7b2f9b40a1152099fdc267e501cf2aca3a0864ed", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107845, "uuid": "0d371a43-3358-457d-a876-c698bd82d1f6", "comment": "Malware payload (AgentTesla)", "value": "64fde182055788034389fb71d69d0b3db140f060", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688107845, "uuid": "9be7108b-73de-4d32-aa0b-d30e98963945", "comment": "Malware payload (AgentTesla)", "value": "50713162e3b526afc3b7170abe5202b557f07fadc730de78571f6b570b559a8708fe88efe5611ca989fd4e8ead0bd12e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107845, "uuid": "d4a3668b-4b46-45b2-b021-9a6de9eab16b", "value": "T16DE4232388A959EF4948F43E46D1699421B55B3E0FA19CCCE14808EE8EE803777FF9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107845, "uuid": "3d8b2b00-7a17-4c74-a18e-e140f37c84d4", "value": "12288:UEyLrIlJHZgUHm/tmdybLtlOqZ5CIxDmiE7IsE72uZFIofHmJvgipRWAy7TbD/e:6rIlhzCmdybJoeNmi+WJMyGJv10AWrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688107845, "uuid": "def51389-e68a-492c-a960-484d1a86a3e6", "value": 690013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688107845, "uuid": "dd54be27-2d0b-4b4e-a859-f5bf6345933e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688107845, "uuid": "e315681e-5f15-40ce-a3a4-2f6482fe9d94", "value": "Purchase Order for SK336.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6135357d-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112544, "uuid": "a590dce7-727b-4973-82a6-6b0d8ba10ea6", "comment": "Malware payload (Mirai)", "value": "7c180a771a5d3a3e9719a4bcaa248b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112544, "uuid": "c1d7e3ec-d9e1-4252-baeb-f587485ea218", "comment": "Malware payload (Mirai)", "value": "5547a2b5dc1d28fbe365fe08f195aca652e90477c5e1f1b0ee547b244c1ed2ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112544, "uuid": "d7233496-b322-482f-9177-07c2c7618780", "comment": "Malware payload (Mirai)", "value": "5575568697ed1f73f9b5993d0120e298d5d0ab8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112544, "uuid": "e89612bd-0cb1-4050-8ec6-2bc08faa2277", "comment": "Malware payload (Mirai)", "value": "1ae506aaa24eade15f0ddd84a812c3eed94b6d70f10c65bb223a7d17ade1d0d6a1b02a8f4bb9cdc3be463ecb93e2879c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112544, "uuid": "f4a77c40-adf4-4bfe-82be-aed29e86f1de", "value": "T1C6F2E175AD413AC6C6CF4AF8F9EE12FD995C7A01324F0FA68B021988DB9091FF562534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112544, "uuid": "c4aaa5be-1b73-45f3-9f53-bf5f2e9f5f52", "value": "768:8k1WGlKAerK1QItQXX5M3rKFo5kU5+C2SmVCRYzMYKWp:8kHAAerK/tQXXiK6qUyFVCRYzMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112544, "uuid": "5d9ee1a0-1efd-42af-abe7-ad01070da15a", "value": 36956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112544, "uuid": "83d6265a-dc18-492d-a4a5-9cc81590fe8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112544, "uuid": "fa884b50-7e46-4af5-82a5-3e61704cf64f", "value": "7c180a771a5d3a3e9719a4bcaa248b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2365c88-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144490, "uuid": "32fde01a-22d0-4032-8723-8e517437fec9", "comment": "Malware payload", "value": "a2d8f487fd3f6973754e5988109aa67b", "object_relation": "md5", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144490, "uuid": "297d30b7-27eb-4b8e-8833-afeb19b1b043", "comment": "Malware payload", "value": "554e71b4e5d2a172707b51edc8e0e22cba40858b69884e75228c12718c47e1ef", "object_relation": "sha256", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144490, "uuid": "55c068e0-4f91-4e9a-aafe-5a142ab7d2c7", "comment": "Malware payload", "value": "bc9c787c193e947e33cb6d6df0441151b03ca368", "object_relation": "sha1", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144490, "uuid": "78499927-a0d6-4538-86fb-105b5c27d480", "comment": "Malware payload", "value": "4aea0d1e9951425ea4060f654752c5d8a267ed76e02851c9d7f66a3233b25d06f18c5e81e80818245da237cf0232b149", "object_relation": "sha3-384", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144490, "uuid": "59ae906f-a1e9-42ac-8f42-78a8a967f5f7", "value": "T156E53302F7A8D122E07F53B4526D61D39A05EE80CA85F7BB5829775C3AB7FD14A02E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144490, "uuid": "8c531af5-5986-4691-8521-4e334a96e107", "value": "49152:9cr7M2hKTPcqI+5jI9hLXcfr7pE53M2nZ4GR8rQqqN7wQTLLoGccJ:9c/M2jqIkOhgj7O58gXSrQzNMKLecJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144490, "uuid": "93369df9-59e4-4168-8723-6f676d21a049", "value": 3132650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144490, "uuid": "f1efbec6-b3f3-4f3b-8f21-6d24cc47dfc0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144490, "uuid": "155acf13-942c-42dc-8a59-83700b48f6d3", "value": "554e71b4e5d2a172707b51edc8e0e22cba40858b69884e75228c12718c47e1ef.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea0c49-1723-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688114963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114963, "uuid": "3d0bcb68-b736-49b8-8aa5-c1ac69c11ec0", "comment": "Malware payload (Tofsee)", "value": "32b58e1cd89fd340645b551025a38064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114963, "uuid": "4ec921bb-5e03-4852-a43c-ac554534018e", "comment": "Malware payload (Tofsee)", "value": "55cb39bdef73e2a161aefbb44166470fa941adb08d3d276947d19593de3e238b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114963, "uuid": "ebe84a37-da5a-4784-b853-4d77285f1a4d", "comment": "Malware payload (Tofsee)", "value": "732171514e663155ef785ae35d674bb886d57769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114963, "uuid": "7d95ff58-a78f-415c-a09b-a6b956853bfd", "comment": "Malware payload (Tofsee)", "value": "6d913519f79c5911792bb98ab6891dd55df29248039b96737d5431257d20f633baf848528648aada1a359ef4b5997c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114963, "uuid": "f5a226ac-ec34-40a5-b56f-27efafee1faf", "value": "T1D9544C0392E17EF4D5368B72BF1FC6E8771DF2548F493B6522589A2F04B80B2E663215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114963, "uuid": "7356570d-7f8c-4ed7-8a59-32d90e6a524c", "value": "fdd8fed97401c5bf665e967df246697a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114963, "uuid": "fcbd47ba-bd87-4937-916a-12f84996040f", "value": "3072:XiUe2VPCMDsJ9OgXL1H21Q4fDuJr5+Gk91h9lmKBR6+MTXJ:lezQsFLdMQ4CJrwn9l6+MTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688114963, "uuid": "ff54800a-4da3-4942-87b7-3f55a22277f8", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688114963, "uuid": "d5a27583-1ba8-43fe-880c-50531905d866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114963, "uuid": "adb63fca-9ad3-4362-b90d-a6ae5855a808", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c70723f-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150708, "uuid": "269a08c9-f00c-4999-9dc6-929a8e23bb33", "comment": "Malware payload", "value": "949248d85b9d7aff13857adb87de9651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150708, "uuid": "5b54825c-eefd-4cf5-ab62-fab43cdd78af", "comment": "Malware payload", "value": "55d889e19574d2b9147bcdd8b4b52d46b623f4e319b62fe37d9b82f668de2b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150708, "uuid": "a901a960-1034-42e9-994d-7588d7358a24", "comment": "Malware payload", "value": "a5cc88c0c304a22f59bea08b16e7cfd9237c002f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150708, "uuid": "670d82a7-b5a6-49a3-877a-f031809d3cfd", "comment": "Malware payload", "value": "e4d04973d647b08123bef5dbb368087ded76f7011186000ebb318c7115542fe628cf9364dbc28494ea3e5b0d5d92fe85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150708, "uuid": "06e38c70-3022-4c77-a268-2a9fec53c257", "value": "T1545633F622968C16C7BADF3A76C390A1A064D6E36B8DD44FF8DE11927C718B97310781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150708, "uuid": "6eff2a5d-82a7-4958-99fb-87f4ab2b42d9", "value": "196608:+k/aOYdKp4+nQDkH/+AKHCH8mymCQ2m9RhJo:3iO2KpTWeKH3myhQ2e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150708, "uuid": "b2856de9-2c46-4210-8f93-0b49db6e850e", "value": 6339584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150708, "uuid": "f5c04d5a-6b85-4160-82cf-180bead897a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150708, "uuid": "ec3f7af4-dec9-4d2a-b163-188b3e2a6e0a", "value": "SecuriteInfo.com.Variant.MSILHeracles.90088.3020.29933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca508cad-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688109285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109285, "uuid": "595f194b-7938-4731-9ca7-1a689e7485de", "comment": "Malware payload", "value": "043dfa1567871c033c9514b544c7fef2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109285, "uuid": "84b1abd8-0fad-4614-8ced-cef8591f270a", "comment": "Malware payload", "value": "55ec807f6f52f3145fc046e64bcf4fa42ed595f10214f22025c07f7c900f3e4b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109285, "uuid": "db01d90a-dc1a-4a70-bbe2-8773a44f0a71", "comment": "Malware payload", "value": "97c9f86276885dcecc0e8108ebe4feef0a231518", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109285, "uuid": "868227b4-9ccc-43d3-a876-f5c48736d9e2", "comment": "Malware payload", "value": "a7cb259e2d2341225c8efb27b0591ab517aed4a1caa91d5b79f43dd8d11ef7eb91ef1bc2ed829ea29d1eadb38fa43de0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109285, "uuid": "2ff335b9-f506-4e8a-b792-d8b69d806779", "value": "T1EC66021A75C7C636E6BE82741A65FB7A30B5BFE007B240EB62D49ADA1D745C002F1E13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109285, "uuid": "d511b1c6-1d3b-4905-b509-75f210fb08cb", "value": "196608:u29Ik7oVQ2CAmYcA13ikoGhE4qLSupNxfTC:u2SMJ25mVA1xvzuLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109285, "uuid": "127696f6-33a0-4112-8475-3073b91d31e6", "value": 6623232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109285, "uuid": "316aea3c-4908-4584-aa21-988cb5491a46", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109285, "uuid": "b113ac9a-0c8d-4aea-bdcd-d6586d1729fe", "value": "formularioimprimibleCLE.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bf2409-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688154377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154377, "uuid": "ad9365ba-4f80-4605-9e37-f75e6dd3e170", "comment": "Malware payload (RedLineStealer)", "value": "7c14ee6efae08f0895d0ab13873887c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154377, "uuid": "5d534c6f-a6ae-415b-a1e5-bd75bdcb786c", "comment": "Malware payload (RedLineStealer)", "value": "56fbfb9403a4d3282857d972079b5c73b8ad5792612da29b7b3c907cab52c670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154377, "uuid": "98ac45f4-bc3b-45fa-ac87-f79889f649a7", "comment": "Malware payload (RedLineStealer)", "value": "53f74c45d252a4130635d96e6afdd87e01516f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154377, "uuid": "88fb41df-398d-4013-bd2f-c64d487d377a", "comment": "Malware payload (RedLineStealer)", "value": "57a5793f9946ec1ec1a0d78f8acecae65e336d4e69fcbe64c8e575fa211987e30462761c9a921579c9df4473619789a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154377, "uuid": "4e1e0a7e-f6cd-4db4-a598-580ea9ac27cc", "value": "T10F46024CF7988A17EA9F07BE9B71505887BDC601A146A78F0E4DE0F69482350DD8DCEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154377, "uuid": "3d555310-85a7-4d0b-be18-061aa0ccc114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154377, "uuid": "cfd29651-9071-4a93-b7c4-4cedbe27aaef", "value": "98304:GbA+Z85mX3PZe6/p03uT6vGOf+ymFtRUUizcHgduLeoYr+:GbLQmvZ3RquevGOsFEZ4gkHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154377, "uuid": "1f5c90ae-159c-49b8-827f-6c5f41c5a537", "value": 5363200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154377, "uuid": "79703b5b-a478-42b6-8d53-51748ba417d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154377, "uuid": "74e61e6e-3a47-4435-859c-dc6abe26f68a", "value": "SecuriteInfo.com.Win32.Malware-gen.22383.16847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3138e6-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150706, "uuid": "c5d154a8-cd61-4b6d-84dc-e803269abe04", "comment": "Malware payload", "value": "5e6307ff0f896a11cb056cdda2d2bbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150706, "uuid": "16d2b521-5df2-4a6d-96c5-1f2eafd8edc0", "comment": "Malware payload", "value": "5732c82b705016d7bf79058f82f45b01d18d2986fbc8454deeb2894da020a519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150706, "uuid": "ea707288-5877-42e5-b25e-a1f12d61ee22", "comment": "Malware payload", "value": "ed7fd7cbeffa04590bb5f2779053ad10a34dcbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150706, "uuid": "0258899b-216c-4ca7-85c7-e217b59f5258", "comment": "Malware payload", "value": "bbe38fac52abd15f23b833496ad5bb6055e9f6d32565e7f797fd49e612607534963aeee4c016529640894070fddd7ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150706, "uuid": "74deaa17-9959-4f25-b9ba-32a2a7ff35ad", "value": "T1A8D6238B6345DF65E64F01BFF011A52E87A6D202E28BF3CD118DD6F039CA355D98A06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150706, "uuid": "5c19b1f4-9301-4470-8ed6-2b5adffe3572", "value": "393216:zitC2QSz3GhdLC3i99uaEktKVA42Qo1SfGGf:zYCvS6hdLQoB36XTQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150706, "uuid": "b0d750a8-0cc4-46c9-8fbf-64368f7c9951", "value": 12738048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150706, "uuid": "d75e0b1e-8b7f-4f08-8c8a-3c11ceefecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150706, "uuid": "0ae672a0-4a4a-4af8-8467-755ffaf26025", "value": "SecuriteInfo.com.Win64.Malware-gen.24224.22565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe189758-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688108512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108512, "uuid": "5f050b21-5ae4-434c-a702-1af652431d75", "comment": "Malware payload (AgentTesla)", "value": "00ec105e5693996ddeacc232ae4fe0b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108512, "uuid": "74f0c2a6-7688-4061-a2b6-50efc418a6fb", "comment": "Malware payload (AgentTesla)", "value": "574febaebd2d121ff74f363e268e4bf652841e284e1db03960d1f26338ea0eea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108512, "uuid": "58c39743-5dc9-43a0-ae8d-1bedb1b509e7", "comment": "Malware payload (AgentTesla)", "value": "cb642f5bd20eb7a47b73d52399993a393e078bd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108512, "uuid": "16d97a60-99fe-4297-a31b-8630411ff292", "comment": "Malware payload (AgentTesla)", "value": "061039f2bfecd7d41d57245350ab7fc7383c8aa3494c549ab28471483c5edaee559c0a2ee4062dfc3c24519a19969021", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108512, "uuid": "7a9a3874-3671-4697-ab3d-a254030dd352", "value": "T12B050221BAC184B1E4B729350EF1B371BB3DBD700B358ECB9B840A2D9B705D19935B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108512, "uuid": "2f383e3d-19fa-40ee-89ef-0503a0945bf2", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108512, "uuid": "74614815-0b4c-4f1f-aec8-eb58ce8aa781", "value": "12288:4jOtvHMm5x6kqP8JUXnoswX0/Lh+OOd0Dz7RQsUa7sMQHjGV5:UOtT5xNcxXnYE9vOQpHUa7aKV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108512, "uuid": "6bea7cfe-f33a-41dc-8803-21ee6ec5a1a8", "value": 847710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108512, "uuid": "75cdd642-a0cf-481a-be17-db35b6a31250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108512, "uuid": "a88ff635-c5b8-4a43-84f8-98dee172bea9", "value": "PO#017.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e7fc5d-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144634, "uuid": "510e46ff-8d34-4cc8-8c4f-9c131dc1a27d", "comment": "Malware payload", "value": "8a834e638514f213c3cca4d75e04ef32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144634, "uuid": "73fcef97-b22a-43d7-be7a-b2d2c7c3d71f", "comment": "Malware payload", "value": "57a12ba5f22ca7fe467955ad492ce22d16ff832c8ed6c5cc5f742eb2130793d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144634, "uuid": "82c6a57c-4627-46ec-bf28-30fa607cd903", "comment": "Malware payload", "value": "d2615c5746fc681d05f1b005ff87c46fec00dcac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144634, "uuid": "d497effc-5912-4922-8008-9767365ffe54", "comment": "Malware payload", "value": "ae0d724d2b7360bc67462141d8b36abdbe26ef97aea1c3ec8405e8c9724afe221243cfd8e744d86f02a62c9ae6823de6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144634, "uuid": "82454a10-7b4b-49b7-b2e5-75df9089c6cf", "value": "T149646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144634, "uuid": "c1ba7c80-51a5-4fe6-abd7-ad5727b559f0", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144634, "uuid": "ebb8b871-77fc-483b-9a4d-f845960cd3b8", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144634, "uuid": "bfa2726b-2957-4295-a91c-9584d653dc61", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144634, "uuid": "319e23de-b02c-421c-8e27-771bc117a20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144634, "uuid": "0478ec3b-ad25-43c4-812b-cb04f2647595", "value": "50loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ad60c3-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688144120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144120, "uuid": "8506c2b3-4288-4498-b2c8-5bbe274f4635", "comment": "Malware payload (RedLineStealer)", "value": "1094f31d651ad081813c69d7fdec7bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144120, "uuid": "fe75a384-426e-460c-97cf-201aa4bd54c1", "comment": "Malware payload (RedLineStealer)", "value": "57e54db0cdc33fc67a654967cc6c6708de33b569e4efcfeaa2d2565a445f20bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144120, "uuid": "9072649d-6060-47d0-aead-48496a54a674", "comment": "Malware payload (RedLineStealer)", "value": "530ec906a0c1ddf1bd4242a034455b489bdd1ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144120, "uuid": "0be95ae6-3cf1-4719-9d49-78d465241d2d", "comment": "Malware payload (RedLineStealer)", "value": "d41d75dad2083bece3002802d853a9a8714d893d08a826cacba86a6a25382c6201854413c1fab09ede350fc986081a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144120, "uuid": "a59a3af0-5750-4d55-9b55-4a3d3cf2c065", "value": "T1905633480360ADC0D66957B2F3944D4A106807432E52D770378BFA351DE2DAF9DBAEEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144120, "uuid": "766ac717-2678-4815-9a01-432a422ee719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144120, "uuid": "127bade9-986c-4bfc-919c-fab02c854f33", "value": "98304:4Q1DGwnixVYj9usqANbTWGLs0EHhcVHgD8knFf/JBpdze/fzKkq:713ixVYAsq0bLYHhcVHgDFt/up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144120, "uuid": "5c60b098-4290-4b4b-bcf6-dd87dd0ed2e9", "value": 6429696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144120, "uuid": "47fb03e8-b959-468c-9637-c9c9306c563d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144120, "uuid": "3ae1cde6-9f14-403c-85e1-73598c29e333", "value": "SecuriteInfo.com.Variant.Lazy.356521.15301.1256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed71e086-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688141985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "6570460a-0f2a-49ed-98f9-8ad8a757e4b2", "comment": "Malware payload", "value": "b1cd4ad695617086dc47abe681b05e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "62ca717b-5478-4a42-bc00-8269b43e4ac8", "comment": "Malware payload", "value": "587c9f9f13e1b91681177a26a2eb21654df390b3c511f21e272d7510e46bae36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "78872192-999d-4256-9d48-29088df816e4", "comment": "Malware payload", "value": "0b68856be7bc694427d6f7f6a6e8eb2d0ef73de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "b3517e3a-9cb2-452c-a3df-3a0463bdaa77", "comment": "Malware payload", "value": "3214f6fd49aaae8be5288ccc50a3a44724b54da5a8f26a5e171d694f2978dd8b062fb3213079dd0a5d25362751af4bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "40f15be0-fe9f-44ac-970d-01949109643d", "value": "T18ED35B1279E04462DA721932F8A889658E7DFCE00F618D973F7446250FB06D1BEF4DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "b0f26172-e069-4dac-ace5-6a001410dbbb", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "73198ca3-1db2-47c7-b571-0971246105d2", "value": "3072:HE/Wn/PfjNxgGR2oV/rB2+Sl2xBw6BwfDi1gGuEQLCA0TlkM5oWRQx2WR3xj:HE/Wn/u2zFWggFMyQdQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688141985, "uuid": "1d4aaeee-f459-4581-a9ef-507e0b470cdb", "value": 138050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688141985, "uuid": "eb32c12b-87fc-4765-a57e-b41bd015034f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "f43e4894-2588-413f-8294-c3c1961c891b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ec1ba2-172a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688118080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118080, "uuid": "a2ccefb6-366c-42f8-a8d3-caee575af393", "comment": "Malware payload (Mirai)", "value": "36ac2aeb4dff76ca32da4c4371aea520", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118080, "uuid": "ba0346b4-0708-44ae-8723-4ca081aeb943", "comment": "Malware payload (Mirai)", "value": "589290d049003785ed310e30aa7ff63b839885e15260405126305050e8978010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118080, "uuid": "568b72ef-e462-4886-aa7f-0308d29ea7bb", "comment": "Malware payload (Mirai)", "value": "b13076e256da21da19ab627329903a07f91c3d32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118080, "uuid": "2d0feb8c-ef1b-41b7-b674-0ffccabac5eb", "comment": "Malware payload (Mirai)", "value": "5610f9b6944e05f21416dac6e2adf92c7fb239e05e5f61c478f794a762a9bbd8d8f18e6e0d934aca84e70f6b3a19b6f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118080, "uuid": "a35794a1-3f2d-4247-bda9-229131402bc1", "value": "T1F0531846B8818A12C5D417BAFD2D018D731263ECE2DEB212DD145FB477C692F0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118080, "uuid": "d13b85c1-2218-419f-84cc-537d4e051c4d", "value": "1536:QdnO1YaLG6KBJGaOQXH7OhJOkphJPLFIsi1qTPKWih1:5fGx7G9QXqhUkgqTPKWih1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688118080, "uuid": "2be58caf-b544-4e8b-80b0-ad9c4ff365f6", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688118080, "uuid": "73d486fe-2689-4060-bebd-72d6eda8b648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118080, "uuid": "644932af-8e63-484b-b606-65aa8c9674d1", "value": "36ac2aeb4dff76ca32da4c4371aea520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3318fca-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159497, "uuid": "bd615cc6-b3ec-4555-8431-ab394cef162b", "comment": "Malware payload (Mirai)", "value": "e8af104715bab4b479f4bf13f4da0e40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159497, "uuid": "4f3f05f8-95a5-4ab5-94c5-cbd063be587c", "comment": "Malware payload (Mirai)", "value": "58cc02b63e46a17aedaef9efdcb2d45a634c546d5f0cbdc2d2308a310de508db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159497, "uuid": "b11c9ceb-059e-43d9-8330-6c8b8909037e", "comment": "Malware payload (Mirai)", "value": "cf73b90807ddea06ec91106ce59bb0623d26df7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159497, "uuid": "354a83e7-962a-4c93-8ac1-7c08fdd11d18", "comment": "Malware payload (Mirai)", "value": "fe543743248f534b4289faebb22df758d7a1aed017327e422c5f310a41f2c0c854bcabea7d632616ea57324d7ea72761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159497, "uuid": "cd7ecc0e-6409-4205-a171-81ad2a8de245", "value": "T1F1C2D044F105DE05DFEB29F43E44DADAFBE06F1E6A628E8166A163C15B1D2A74301DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159497, "uuid": "537f1857-39ed-4d12-9bf4-370f7eedfd1e", "value": "768:wVdafO76jpmNJJKehmA7trpfIX9KeA7P0ge4uVcqgw096:Aam+AnKehPRa9a/e4u+qgw096", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159497, "uuid": "91224ec3-b0ff-4f20-8284-b088802f788c", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159497, "uuid": "8fc5efd1-50f7-4f47-905a-4d39eec42a19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159497, "uuid": "e3b66b5f-5841-44bd-933b-00a688bd5595", "value": "e8af104715bab4b479f4bf13f4da0e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd26e32-179e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688168157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168157, "uuid": "1e5b0649-8539-4362-89b9-fcd60c7ee493", "comment": "Malware payload (GCleaner)", "value": "44c744bc6e1d0c758e238e1c3ef7c4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168157, "uuid": "5e9fa36f-0b2a-423b-ad4f-9d116a9a4d6a", "comment": "Malware payload (GCleaner)", "value": "58d57f768804a9c0594a2f9a2db379788d41fbeaca4936a1fe6a0f8986265a77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168157, "uuid": "73e26b82-e2a0-4591-bb1a-0e90e79c4a7c", "comment": "Malware payload (GCleaner)", "value": "4cea957271054a2b4751cba7465a97bcedade0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168157, "uuid": "c798a932-7d96-4e8d-85ee-57836deb6a5c", "comment": "Malware payload (GCleaner)", "value": "63791d92e477098ef741bdb1b2ea666d1f792bcc48c6441cf452744ac8b2f9eaac631c19b1877575fa94d9ea3e4ae2c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168157, "uuid": "26af104f-2e2d-4a1c-b8bd-d4062d59146e", "value": "T1C9452313BB60A5FAF4739675AD64903A0B763DA10F30102C7EDDBA8EA67F9078917301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168157, "uuid": "a9a5a58b-fdbe-46f6-bfc9-552b673f3dca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168157, "uuid": "2d10b3bf-f658-46b8-9520-521fb4bc6d08", "value": "24576:+fOyJNAZ0rP78QWQLQpKEwTPXsDbjLvl/wFYn8/CUB1rARpJjBBp/D:+G4QQbCKX+XLtYj/12pvBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688168157, "uuid": "5bb61747-4404-4862-9b10-4e48943dedb7", "value": 1246605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688168157, "uuid": "80b75c19-6e80-4f5b-b4e6-d55c7ff4090e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168157, "uuid": "6c92be9f-cae4-4c6c-ab86-faae8f1a0254", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621893ef-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688109539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109539, "uuid": "10b2e809-689d-4b74-be90-f14efd0c78a7", "comment": "Malware payload (Amadey)", "value": "69427aed527896304667d9ebee8fc14d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109539, "uuid": "b27a4c7b-c22f-4862-ba78-8071c3872d3f", "comment": "Malware payload (Amadey)", "value": "594e9aca858758ad7ab8c21f6bc8c0f2db6e86923fe565913fc1e71f8399c8af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109539, "uuid": "1df190cf-84fb-402e-affb-be4bc7bfcd64", "comment": "Malware payload (Amadey)", "value": "2d8691a4180cb78e50404037e874baf7b26c12cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109539, "uuid": "0a9d5007-29ab-4d11-a72e-18ad10a7fd08", "comment": "Malware payload (Amadey)", "value": "ace60bc08691b0ab8bb17eb0936b32596478af47a21471c2c17f29afb2582ef360a4830b777a4debf9211a84fe8b5e77", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109539, "uuid": "9a714a7b-1f9d-4087-9993-826f4a071058", "value": "T1F005125738EC83E5C2EDF533C29EF8268D7ADBF40322298773B455591B70641A2A27C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109539, "uuid": "0e9073cb-bea6-4f63-bb5c-d6dd5f7e3cdd", "value": "ae3313a7e55f2835265780c2d394ac1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109539, "uuid": "af05b0b4-7633-4ce8-a710-7501ae9f4989", "value": "24576:JywQSnt8R5nGrebcQqW+hBMrwTrdnOqYKxD:YwQSI1cQ2nrTrdOEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109539, "uuid": "da097efc-df6c-45e1-9cbb-7cf28476d2ac", "value": 866952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109539, "uuid": "1233a6c2-147a-4eb6-896c-3155ea99d824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109539, "uuid": "0c4ca045-dab5-4676-9bdc-72eeb18dcaa5", "value": "69427aed527896304667d9ebee8fc14d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd7eaeb-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144076, "uuid": "bbe4ba71-d5ce-4299-880f-5828a6b26a2b", "comment": "Malware payload", "value": "46b4020e87599e281b9e63a816a355b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144076, "uuid": "9b99a98d-1b21-4ae8-b46a-9e5c5cd046a3", "comment": "Malware payload", "value": "59810a0c40bd8ee38ce1a40fabf4a03aa67af35753da7c8daf833974f694c65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144076, "uuid": "72b9b902-53fd-4de4-bf07-254338c6480e", "comment": "Malware payload", "value": "9138662893f038ded003fa9abf7b6acc67a69937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144076, "uuid": "54599af9-e30b-42b9-90d5-a8655e75e01e", "comment": "Malware payload", "value": "0194626c31530fdd074912e64a3315326f6c5c6f434932da8a2fdff1d8afbe85bf8aa3c16923833216a5b03f9c34a667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144076, "uuid": "20ae7124-c1be-473f-befd-1ad5d7b6e299", "value": "T19F073350B19D64ABC0C87B7DA4F1B082967AFD3ACD93C9DF414CCA2E1941AD0F63AB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144076, "uuid": "e541f419-fe4a-4e79-a8fe-4b988f0924a4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144076, "uuid": "7cc20e16-1ecc-4617-b9ad-d17e024394f9", "value": "393216:g0eGsPuIY+lJ0gJ9UjT5I/LWyrjtfoQMj+DbAlTBq:g0edGIY+lJ0gJiBqLWySDSDmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144076, "uuid": "9aec6d1b-157f-458e-98aa-6f782207b318", "value": 18227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144076, "uuid": "f63d3657-d786-4539-9b2c-ff9e349f1fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144076, "uuid": "0b9f4acd-d155-462d-862a-fe66e6373481", "value": "SecuriteInfo.com.FileRepMalware.7836.17913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b6f86-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144141, "uuid": "72741982-3fd6-4848-a8fb-f946e066bcd9", "comment": "Malware payload", "value": "a76def66fa9b91fabd93952c9114f3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144141, "uuid": "3e64b88a-0076-4b73-ba05-886ce00c2f1c", "comment": "Malware payload", "value": "59a72e8eaf35b80977d3328440befc3e71127b7020c57b78cb79c8e4aa4e53b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144141, "uuid": "0e9234b3-f67e-45f4-ba08-0ee34d126286", "comment": "Malware payload", "value": "ef50c8737e19e8779c5a2b058e620104d282f354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144141, "uuid": "588dfcae-392e-47ec-bbea-e28c6eb43a3e", "comment": "Malware payload", "value": "6467f0a6a6bc384e8cf4f1f0b2b1503f724b7059f491f3b4a14a0ef709b74eeaa02947bfb1dd076a773e59fd99b9aeef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144141, "uuid": "25394222-64a8-4492-af5d-21e6db9249aa", "value": "T1D3D6339AED0FC5A6C4240339D607244C1697F9C4FA9ADA53B94C135B06B6BB3AF16C0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144141, "uuid": "1557c6ee-1309-4788-b8c6-8ada470173bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144141, "uuid": "84f051c4-5fbf-4bf2-9841-a9ec050139a0", "value": "393216:z1/mqYhKsUo6ISMfUBUK9kwz9TOn2cIK:z1XKl6IZfMUKW4ZTcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144141, "uuid": "5ee1b68e-f608-4041-8c7d-ac660e367964", "value": 13759488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144141, "uuid": "a961837c-e8af-4d8e-8cd2-f5f9c917fddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144141, "uuid": "1f7ced5f-7be3-4c9f-88e7-e06fd8c4fbf9", "value": "SecuriteInfo.com.Trojan.Generic.33990687.3750.18113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39e5bba-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144573, "uuid": "3c7a4a56-05ee-4c2c-b3d5-5b98c4a8db41", "comment": "Malware payload", "value": "23511fe8ec62c9a4662dcce1100adb97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144573, "uuid": "a1608e6b-23e8-44fc-8d96-52551bc91901", "comment": "Malware payload", "value": "59f118177750af93eda1f853f7fe74d3de1c75932d8c247f6137e45c2581c104", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144573, "uuid": "79c1e3de-6412-490e-9f2d-d649409f57f7", "comment": "Malware payload", "value": "797d94304092e90b86ab529e10a4557673347ca5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144573, "uuid": "07df4f3f-0dae-46d9-b490-c4cf49a17048", "comment": "Malware payload", "value": "f959a81c23a280e72925d90f0c040b85f938ca14a9837b3b17aac7d5db4d5602137b51077502fd377998fd3d1b0b43e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144573, "uuid": "5c384942-9c1c-47c8-825c-b55a70aa1f65", "value": "T13D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144573, "uuid": "957912b3-dca0-4880-8f86-52615974e943", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144573, "uuid": "e3e3c793-8f6c-4253-9eb8-55c9b10531a2", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144573, "uuid": "2b29f587-f29c-4a1d-809e-6670492575c6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144573, "uuid": "ddde3e6d-3be4-4691-86b7-e961a6d2a7c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144573, "uuid": "34243a85-653a-48bd-8c03-5480c9b11653", "value": "42loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f31d33-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Zyklon)", "timestamp": 1688163446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163446, "uuid": "ad1f94a8-de9e-4453-b00e-6c9fe2be8a58", "comment": "Malware payload (Zyklon)", "value": "f7df6c7ca937b1fb0be363acd004e102", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163446, "uuid": "2909ea29-f875-4f9b-9a40-3427b2d66cd7", "comment": "Malware payload (Zyklon)", "value": "5bb3cf5fb277a24f609b8603619bb0912c32f8b908dfe48da3f108f7050de79f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163446, "uuid": "e5774e14-7e93-4a2d-83bd-07d99c72bb98", "comment": "Malware payload (Zyklon)", "value": "a2f1fc323829c8322801e3e6a1a8b94dc95222a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163446, "uuid": "c0fb3eff-0921-46a0-9278-4e0c935aa44e", "comment": "Malware payload (Zyklon)", "value": "922dfaf6c86f137d6262602ee737f1360fc9c67e189b0d09a0c56ea31f93eafdbbf214156de929d95dd540c8ce8167fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163446, "uuid": "653ee9ec-d5a8-4a71-bbd9-3992a523322c", "value": "T1E765281A790E9CE2CD6D12F1C0B3070C5AE0C7861719ECAE36D697DAE70D1E7AA4D187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163446, "uuid": "bd2b9791-13a3-45d6-adb3-b1ee85bfad7c", "value": "24576:1I+7pwta7UySJTB4d3mQmTBxqa4sNZzPAAj9+6lKm:C+7av4UcYZPAA0EKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163446, "uuid": "50493f61-5598-478e-a0ee-f7d3c2674577", "value": 1463680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163446, "uuid": "3b8aa81c-1d00-4b28-b359-0ae786ea65e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163446, "uuid": "b491f54f-8fec-4ec0-8c24-f195dd9950ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d45086-171f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688113575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688113575, "uuid": "eae58fea-9b2c-4b07-98e7-307c255bb6b8", "comment": "Malware payload (Formbook)", "value": "feccae6a309bb8f7e8737652a76d0c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688113575, "uuid": "3ff9f26a-0e51-428f-9162-392c67e3b98f", "comment": "Malware payload (Formbook)", "value": "5bbe0096493e0297f0880810ef5141b5905168ce5e5a11f5e16c7c08a3abfa15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688113575, "uuid": "4e69a0db-960d-4c04-95a6-8f6d5cd6bbf0", "comment": "Malware payload (Formbook)", "value": "2dc8e118b255236f538584f2c6b2d98a3c840de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688113575, "uuid": "c94aac69-efc1-4cbb-8c81-98aec4f842e1", "comment": "Malware payload (Formbook)", "value": "441d39128a60af54b4e11cdb5dd51fad3888362f9fec2c9a3d494b59e4e526739623fe57575ab790e6075403d03f0294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688113575, "uuid": "6d98bd52-7ab5-4fa0-a8a0-df3e1addb3a0", "value": "T149D4593D18BD5333C074D6B6CFD2C723B254942B3562AA766DC39B964796E0229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688113575, "uuid": "45141217-d79e-471c-9b1a-4ff84f96dadd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688113575, "uuid": "2baf43d8-c231-4f54-9a81-b2513b1795ef", "value": "12288:hSEzKI6t0t+fmxsfVwGPm2lo6iAboY0vZKf2sRDG3JYECJ:ZNt++Wdwz2loVOQof2y4JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688113575, "uuid": "a74a5f2b-973c-44ed-884e-8e68fec981ee", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688113575, "uuid": "64033d66-343a-4da2-96b3-a85166f63932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688113575, "uuid": "41d56d2c-1cb6-4738-96b7-ea01969d27a2", "value": "scanned001 inv .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf8b7e8-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkVNC)", "timestamp": 1688154385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154385, "uuid": "61a76669-0caa-46f7-a4f2-e656196c3a41", "comment": "Malware payload (DarkVNC)", "value": "0ef4e3af8936e03be74afa2395286301", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154385, "uuid": "f86d8752-4b1b-4a5a-aae9-2461be2cbae6", "comment": "Malware payload (DarkVNC)", "value": "5bf3863bd0b4af59a4cdf9b9080b60c827cc19e368beae60ea3930adf12ddec0", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154385, "uuid": "84fcd94b-b0ba-4a30-9b50-4ad444ea466d", "comment": "Malware payload (DarkVNC)", "value": "273dd0dde838b7878b2870c8a4e2f1fb0d91e6fd", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154385, "uuid": "3aec1abd-12c3-40d9-ace5-b96b0955bdc5", "comment": "Malware payload (DarkVNC)", "value": "114599823ac06810dc46310e52d9d7a50c01e98a088b20a1910fb68e8f271ea2581044f09f25267ce638a3a55b5457a3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154385, "uuid": "afd40f1f-93a2-4c35-b41c-6a52cb30745e", "value": "T18DD6230C7354AA63EACF87BFD76204548BBDC540A24BA78F1A4CE6F45483340D99ED9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154385, "uuid": "c3a9054d-ef90-4f06-8f8a-afb0267f6e69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154385, "uuid": "6fa83fc0-263c-4966-a0de-9f9b476d3892", "value": "393216:nzbN0o5te8ZBAVVrXcC73WQGb7wWHeigBlRaJFLQM:nzhFlBAVVrXcCybM3gLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154385, "uuid": "a15b4429-c47d-4d56-8af8-272cc3f1d855", "value": 12667904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154385, "uuid": "a61300f5-5ba9-4ad6-b2cb-6ee702f10bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154385, "uuid": "f9aff86c-5408-4525-be8a-c873c1932a62", "value": "SecuriteInfo.com.Win32.DropperX-gen.28420.31272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76d7df8-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688108501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108501, "uuid": "b53a7e94-1487-4989-a9fd-3148515003aa", "comment": "Malware payload (AgentTesla)", "value": "9c3611f3909f28c781a6cc3cfd83cb5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108501, "uuid": "7b972308-2859-4798-9c99-591ddea5b3fa", "comment": "Malware payload (AgentTesla)", "value": "5c13af869d589a9083c4103d88b35828adb3abbcc931f5236caf2a83673d7d5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108501, "uuid": "94d25fd9-dd12-4565-928f-7471ba35f6c6", "comment": "Malware payload (AgentTesla)", "value": "5d775e4e765dccf71ea5dd5b0fb64af3c79656b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108501, "uuid": "f54aa903-5604-4e92-b36e-ab326da69d07", "comment": "Malware payload (AgentTesla)", "value": "166a05d3313d4e06347238e40168ac41ed455271927502135737fa64efa50de90081e51b69366ef3679d03d13f0200bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108501, "uuid": "495842ed-7ef2-4e05-bd41-609160bad54a", "value": "T16A650221BAC184B1E4B629350EF1A371BB3DBD301B358EDBBB4C0A2D5B715D09931B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108501, "uuid": "86bff9b4-2977-42b5-b6ca-c9430bda095c", "value": "12288:FjOtvHMm5x6kqP8JUXnoswX0/Lh+OOd0Dz7RQsUa7sMQHjGV:JOtT5xNcxXnYE9vOQpHUa7aKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108501, "uuid": "f954115a-47b1-4695-9460-c924631ff873", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108501, "uuid": "d0499615-4dd7-4bac-89ad-235441692025", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108501, "uuid": "d96f821c-cc06-40d5-a4dd-06cbec34626f", "value": "POX#017.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51ca7f7-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109356, "uuid": "8048d13c-f3eb-4dfb-85e8-9db6c420a77c", "comment": "Malware payload (AgentTesla)", "value": "fe5c78c1470905d2980743e8edca5a09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109356, "uuid": "043d557d-452b-4993-822e-56b582bfa223", "comment": "Malware payload (AgentTesla)", "value": "5c6430f54c8262494149430429bbb1d8ad2b8523beeba63be70dbfbf29dabd98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109356, "uuid": "cc53f244-8584-4621-8f0e-37192ca47815", "comment": "Malware payload (AgentTesla)", "value": "c6edb28e5584c847beeec2a725b8cf2e6d5b74ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109356, "uuid": "5363cd42-5ef6-4858-ae5a-780fe34e6822", "comment": "Malware payload (AgentTesla)", "value": "0e1ccfb107252220dbe52fe06cfab830751a2baf6b2421087e639dc23c2010d760a3ca79a02d07c337b69e6bdc116d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109356, "uuid": "8843d995-86c1-4b69-b704-2882c8681890", "value": "T101E4CF63B7445FA1E425397F4947A60023F1E8CB1160E70B2EF96DA465B33C32EAF649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109356, "uuid": "0542b74f-42b3-4363-9895-11ea0f34f9c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109356, "uuid": "6242edd4-a8c5-452a-a79c-acfb693daa7c", "value": "12288:Tqtlu96FG24mhC7T9NTNJ49/H7agukTsppEbNN0:VBQC7t+v7agMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109356, "uuid": "17a86c0b-47ce-40a4-89e1-341e2b4df8ad", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109356, "uuid": "379b38c0-c7c4-4e14-a44a-49f54efc698a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109356, "uuid": "82e3d974-4d55-4739-bcca-9bd22dd30b07", "value": "EVP9210004338188.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef909d-1718-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Phonk)", "timestamp": 1688110393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110393, "uuid": "f45446ee-401f-4205-95d1-7e060b8b91a5", "comment": "Malware payload (Phonk)", "value": "a05d14aafaec11098f00629a5fcfc8af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110393, "uuid": "22cbc963-22ec-4ce5-86e2-510d4ac12171", "comment": "Malware payload (Phonk)", "value": "5d027c381ddadd04a2394bb9472793cf50bc9722db79419b7d9f2d7fd64a4fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110393, "uuid": "2578e330-46b3-453c-934f-b006f4bae367", "comment": "Malware payload (Phonk)", "value": "c0d07cf180ed045b4252a506fa8eb956455caca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110393, "uuid": "c189a2ab-fbd8-4116-97df-adbc0a6c5bf2", "comment": "Malware payload (Phonk)", "value": "b0ad2e5f4d5d8b1f6d8fd05afbea354c15d6894fa3c63c65076dfabcf9fa5e81a2b6eb0320033f8f1b56012b0707cae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110393, "uuid": "e0101770-c0b0-429d-8e0f-ee467587ea89", "value": "T125256EAD3A571DB3CD4F3DF9C3512A885B20C4DABF2094E62E5245C8B22D157ED8D0AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110393, "uuid": "8b093842-9397-4341-8c58-53f82a395d98", "value": "12288:TnTNTabSHtymnzl2ajb/ZRykVz0RD5TeNIw1Q:TnlaEtzbjb/Lyk10R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110393, "uuid": "9fab2c8a-bfcf-4e55-9a28-c6647cfb3e18", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110393, "uuid": "675a63bf-23d1-4734-9deb-8395c656102a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110393, "uuid": "cf66b023-b99e-4ce5-b1b1-703db34d38c5", "value": "a05d14aafaec11098f00629a5fcfc8af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955b067b-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688120792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120792, "uuid": "a4aa7d73-820e-4862-8bfe-e8b58cec5f0c", "comment": "Malware payload (Mirai)", "value": "bf8dd796b39e5c457de48bc946f0893e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120792, "uuid": "f585d630-1bf3-4583-b571-a226fb33b8cb", "comment": "Malware payload (Mirai)", "value": "5d6e73a7471a046a9dd4e38c1c216c7bdc891c1a00e66373b799bfa786ca8f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120792, "uuid": "e36d54f7-6895-4389-804f-897a415efd70", "comment": "Malware payload (Mirai)", "value": "254cb5875e1b0b599c1140011adb56e3dcf1a919", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120792, "uuid": "04283d49-42e3-48ec-9fbd-1e463f8d972c", "comment": "Malware payload (Mirai)", "value": "208fe059b0838416ca6dcde23ec18c7f8fa2e9026928fc6f62d7203b6cb3694215eac201d82f9145cce51d541191427b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120792, "uuid": "0ed97cca-a951-4239-82a0-c6679e26107c", "value": "T12513F1E0A004798DD58F1ABF649551FAA7F44E8334A28A53E28AF73A2C10D56FB19DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120792, "uuid": "6f6533da-a233-4348-926c-af1a0076232b", "value": "768:Bxua+S6FmBginbfsWwu7vk3Iz0suLlKOPY2MoPXnX/BUY1W4uVcqgw02TWX1:BGS66gibfFwu44w1ZKOw2pXpk4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120792, "uuid": "fde9ac07-7417-4e10-ad81-9ca01481c8d7", "value": 45284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120792, "uuid": "f49f3066-a1b8-41c0-92f4-0e9be94a521e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120792, "uuid": "fca16c6d-0e44-471f-af5f-68f23cbcf31a", "value": "bf8dd796b39e5c457de48bc946f0893e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304f41a8-1748-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1688130931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688130931, "uuid": "f2735961-cf66-4d42-b6f5-d447f699c811", "comment": "Malware payload (STRRAT)", "value": "e4ad69e33c8a71940581922842f97f16", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688130931, "uuid": "bf01de52-4c2f-4834-9d5d-75bada718c30", "comment": "Malware payload (STRRAT)", "value": "5d961526812b44a292824ce31c8ba28937b18be95248d5e50fd39b5b6cacc4c6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688130931, "uuid": "f6f45e16-1d05-4315-9cd1-88d6ae71d1e9", "comment": "Malware payload (STRRAT)", "value": "b253fabf17cb9575ea021d40b9906cec0fa26f42", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688130931, "uuid": "f047f526-230b-47ba-b028-899be0f6eef2", "comment": "Malware payload (STRRAT)", "value": "659ce4c1f8dcaad5c6bc49a519db6b6ffaa433aa9ecd2e7be2cf10e02354559852a01ac89afac040af5510f8b8838440", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688130931, "uuid": "6a255714-41b3-4240-9319-18628fe5f203", "value": "T14F24011FBBB688EED00720361649D522AA5E4969E123E03F04FCC5AD0C7DE1D6B169DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688130931, "uuid": "37e25290-0dc2-4952-a935-5c85dde3fffb", "value": "6144:5Kv+VBdytqB77obEClQPeI8Zm58GuGd8Qb03:tVB+qB/zERZJGv8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688130931, "uuid": "da67c0d9-f7bf-41ca-8d4c-c930eaac53f9", "value": 223879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688130931, "uuid": "19d42ec7-ea7b-41cd-a6b0-878038881fc1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688130931, "uuid": "e1daabb5-6d3e-4bdb-8d2f-021bbbd88542", "value": "Bank\ufffdberweisungsbeleg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8919c4-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109480, "uuid": "82707fbb-2f2e-4fc7-9fff-a9f3d3c50bc7", "comment": "Malware payload (AgentTesla)", "value": "5c486dcf9457e4cf5eadecefa00a3a6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109480, "uuid": "43d3ca7a-ae55-4f39-8233-866c670855e2", "comment": "Malware payload (AgentTesla)", "value": "5ebccb834beb6f0ac7b5dbfc8953da3c6a7466031da905d6716b7127b54b5c45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109480, "uuid": "6ba65b6c-0546-415d-ad79-7e7598f7b82e", "comment": "Malware payload (AgentTesla)", "value": "58424cc473451268db5a783f1744aebdd433e754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109480, "uuid": "029e78a8-9900-49ff-8d06-22979536364a", "comment": "Malware payload (AgentTesla)", "value": "353bd186f91d164b06a7ad21a1faee1bbc3b4aa37fabf83454fb205daff2779f7d03bacfda54a2fc15225c9091790cad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109480, "uuid": "fcee483b-cf08-4ce2-9553-072576f584a7", "value": "T1B43539993BD5DF72EA9F12FFA037461E83F1C01A9696FB8D1A88DDE424427129E4C143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109480, "uuid": "07f56f9a-28f7-4ff3-a87d-81296e815d4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109480, "uuid": "1bbfad62-543e-417e-ba76-d82c98bcc66b", "value": "12288:tmnACt3RHAmn/QekK/r9qhl2h1NNN9LAKXLytvG6I0RmRu12:Ept9/QekK/r845N9kKXouV0RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109480, "uuid": "a1a929b1-b7f5-4e0f-a98f-d85cc9ff1986", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109480, "uuid": "255b9627-450a-4c79-ba37-e2bbf13ba981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109480, "uuid": "2b497969-0b50-463a-86b3-ae496047cc35", "value": "Gsmvurqzav.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aeb8577-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1688135753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135753, "uuid": "fc8ffe43-dce3-43ef-bea3-4f4b95738126", "comment": "Malware payload (Gh0stRAT)", "value": "f3b6406de9b3a90e95b4bd515f24023e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135753, "uuid": "068c0c66-e73e-43d8-892e-9276bef47a4f", "comment": "Malware payload (Gh0stRAT)", "value": "5f834272e427b3bdb003e3a8dc953103615a8758cf2f05ce0b13b176f0abda2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135753, "uuid": "9150d4ea-1bb4-4453-a37f-20cb4bb0fbf5", "comment": "Malware payload (Gh0stRAT)", "value": "47d793a4215435cc0faecaf88c7fce49d3442c87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135753, "uuid": "862b4652-0c53-4b00-b151-167fd95c5750", "comment": "Malware payload (Gh0stRAT)", "value": "15be4dbd4ed183d8218123a7fb341de72f7a6dc083916fd594899e0fc1587e78cbe8a72714afdaf656628bcd4f5529f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135753, "uuid": "b67f338e-b490-4a62-a716-24219c3190a1", "value": "T1C9958D317AA0C077C9632130965E9779B6ADBD700B3946F75A902E3D2E344D3A93C36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135753, "uuid": "99503963-20cc-4d3d-a527-4131635679bc", "value": "b43f4c6f075a44e40744b0a95b7471e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135753, "uuid": "2b4f60dc-7ef1-4e91-9e06-8241dc03bcf9", "value": "49152:+GbuZ4y9+vKcGhpNZoKdswMmG+1Zjawx+e9wSQyfbg+Yz9qcgVrwkMGL:duZd4KcGhpNZozwMmG+1Zjawx+eaStLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135753, "uuid": "2be1a1a6-d40e-4b76-a7d5-9ea83d35fd50", "value": 2045952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135753, "uuid": "663eff19-6d85-45e2-8331-3fe9af436c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135753, "uuid": "6cb2ddb0-1f2b-4129-a272-cd1b0dd3ad02", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u8bed\u8a00\u5305 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42c01e9-16d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1688083504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083504, "uuid": "fbb1422f-5f2c-4930-8b52-103fb2c4ee67", "comment": "Malware payload (RaccoonStealer)", "value": "175ac1e037521a1d29bffe5abe0d9d92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083504, "uuid": "6551b92f-9458-4a1b-9824-2adee4243c06", "comment": "Malware payload (RaccoonStealer)", "value": "5ff52ab9349cd6d7a7fc0d2596c3423cdfb5df668b363fb93bd686f9ab198910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083504, "uuid": "2911df63-1b25-43df-ae6d-737838643095", "comment": "Malware payload (RaccoonStealer)", "value": "4a1f499e862abb46bd9f3e21f80186704e441df5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083504, "uuid": "b86f8fb0-5ace-4f92-81ae-4d2286158972", "comment": "Malware payload (RaccoonStealer)", "value": "fcd695ca12a3bb9656d631ab986aae4c6531454021583134afa5757bf9d71987fd7d80040553cfa121edbeff49412a9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083504, "uuid": "c19268bd-585a-43bf-8702-b98b65e71de7", "value": "T18933A1D1EB8DE833DA930478377C9C26AF9B5C1324D4F4876B4E876792E45814A1E32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083504, "uuid": "27de8070-dd73-444b-a363-2884373ed76b", "value": "8293f3c89c8bdc2a5d082fbe7d24c76c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083504, "uuid": "ea0832f5-d330-4fbc-972f-4dfa9fb970af", "value": "768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688083504, "uuid": "3f540122-6d82-4138-9378-5d98c999fb9d", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688083504, "uuid": "c3c5160b-9a0a-4c0d-b311-20b8e0060154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083504, "uuid": "7dc39e79-ba0a-48c0-8a66-c81d4b9fb129", "value": "175ac1e037521a1d29bffe5abe0d9d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168fcdcc-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109413, "uuid": "740dd7be-253d-47df-aab9-59dd56a1ad63", "comment": "Malware payload (AgentTesla)", "value": "761a8f1a031798a2912a2fc2ccd33ea3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109413, "uuid": "c7ce1f8b-7a71-41ca-813b-f08b8d8dad59", "comment": "Malware payload (AgentTesla)", "value": "612f3aecb33df03a30f2c2a09ce41160d90a2388cbaf75f1f4e3fb2ee218e178", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109413, "uuid": "1909b191-4ec5-4ed6-8876-5b5f3acc1f32", "comment": "Malware payload (AgentTesla)", "value": "37a2a91c93a0f9c1d90476e3cbf52155bb154d65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109413, "uuid": "3a96e365-cbda-42aa-a6df-99ab3f41ab1f", "comment": "Malware payload (AgentTesla)", "value": "96980762cbd35ca754eb889c62bde322d3cabb06453de20d3c7c765493f60fea40e5c390f8fbb5d89b2d0162df52fe86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109413, "uuid": "d7c01a08-1e8e-462a-b903-4d5d171fa70f", "value": "T17EE47A3C18BD2A37C134DAB98FE5C463F554D53B3922AA3264C797A44746EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109413, "uuid": "7ce1ba8f-6fac-4e58-9bda-3c47f870a131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109413, "uuid": "4a35f7e0-68ea-4c1a-940b-e86632a3c669", "value": "12288:Scxb3RhVajstYyf4b8sTBeOMn821E3z/7J:dbLAwtQAs1FMvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109413, "uuid": "b6e0773e-d288-4c6a-9e3d-7e3fb6d11a53", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109413, "uuid": "a3ee66aa-d0ce-43d4-a3d7-8e4b1e2d8958", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109413, "uuid": "bc4d7c6b-7a23-4639-9313-3ef99d38fef9", "value": "27.6.2023 bbq 9w 300pc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da330263-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155697, "uuid": "6ac4f0b3-43e6-400c-9bc2-34556f33942c", "comment": "Malware payload (Mirai)", "value": "3b78ae82c5e7c32fc331092d833d1a32", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155697, "uuid": "cb78bfef-16ee-4b73-b2cd-83b2f9464934", "comment": "Malware payload (Mirai)", "value": "62f71b5a6c703a139cf5cf39913828d0fe0cbc5db722cf4d6f87395c4fd94265", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155697, "uuid": "4538c61c-f973-43ab-b7b0-7dca5b634b6f", "comment": "Malware payload (Mirai)", "value": "2bb2f9945f41259eaf6a3a1b0b7c700734dccc0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155697, "uuid": "a7b45719-8a0e-4642-ae58-20cd30f13928", "comment": "Malware payload (Mirai)", "value": "d7b41c715128a9eb5efa77aafacfe1a8120f2b4ab4b65b14825a5749071cb7201c00b1323a1c8acc911b975437ebb4ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155697, "uuid": "f9597568-3dc7-4643-ba15-b4c8102ff176", "value": "T1E2E2F197D371A452DD782FB2F96DC5CA277D8BACC67B30A3051156282A5A0835F3C8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155697, "uuid": "26f972d0-685c-407d-85ef-2516d1618753", "value": "768:1oiWiO031vpAPbrVWZK3XVGxm9XYnyD9q3UEL5Io:1orm1vpALgUJ3CLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155697, "uuid": "9a6681b1-0437-4286-bd77-b1e17ec0a38e", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155697, "uuid": "1b05c6fb-6e19-4cf4-905c-27848f4d2b5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155697, "uuid": "a554d065-83ed-497f-9e03-11816a4c8bec", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db68573f-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155699, "uuid": "46acfbbe-0d67-44c7-94ab-697272c8e2b8", "comment": "Malware payload (Mirai)", "value": "105cf95fca3e3d73fe40431b0d998353", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155699, "uuid": "cbe45d70-c131-4cad-8645-2e5935258de3", "comment": "Malware payload (Mirai)", "value": "63f106b99d044260eaaabb245c1dd1eeb5fefb72a5ba4112436722424470931e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155699, "uuid": "b284e5c5-5db5-4474-8147-f1a2719c5572", "comment": "Malware payload (Mirai)", "value": "09a482dbc4c1860083223f27b303df8019af051c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155699, "uuid": "e1e5238a-f48c-4968-b505-dfa2426f0d34", "comment": "Malware payload (Mirai)", "value": "a88b5f111d7918d3b72f75577874fd6564c58ae9e8088da61169ec38e9ab7fb018bc281ffabd45a0205c24a6eac2a8b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155699, "uuid": "f01644be-961d-40b8-9ff4-20fff442c565", "value": "T165C2D130A3FD1CB1C7600532E7B856C5BE634F7DEAFE388012418AAA794295569E98C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155699, "uuid": "11077719-f343-4f27-a064-ee9f35404dd0", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEoDk+bhymdGUop5hg:ERsoTAZ3alkXLvFh8nNEoIEs3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155699, "uuid": "6b02d511-f082-4c35-b3fa-725e428abe4f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155699, "uuid": "ac95e375-a381-4f3b-bf96-772042765e33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155699, "uuid": "9dd5a40b-96c8-426f-bd74-3abb1cfcbb74", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cfd39d-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144543, "uuid": "a4b80603-136c-4d69-89d9-375828bb72d8", "comment": "Malware payload", "value": "38a3066b96f15368f80f48ca5728633a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144543, "uuid": "ee431636-5ed2-4787-8b80-d78b13a79121", "comment": "Malware payload", "value": "6417a7541360161ee288bfe657d1b9d5e171831f3586c188d25b550b9d7b9a02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144543, "uuid": "b9049065-1158-41de-8ec8-116d4f68cc2f", "comment": "Malware payload", "value": "a688a3038e521bf5deaa472dbf2fe0a2396425ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144543, "uuid": "a0355d20-9c4b-4929-bcd7-7231bffa5520", "comment": "Malware payload", "value": "0b4b5bc678c048e619f2ae139f7461aa503d0231c95628e0aba23c1947641e7d341d23a1700735fc1e0535a77499a0da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144543, "uuid": "d8b62630-3b85-420c-8570-c0b51ed96a9c", "value": "T1A6646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144543, "uuid": "41f464cc-e7a2-43d3-967a-f0370783097c", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144543, "uuid": "f90ef004-3f4f-4970-a1d0-4ba2a6140641", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144543, "uuid": "8ae200f1-a4f9-4198-8f26-f4732c049900", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144543, "uuid": "23d5c204-51b6-4fd7-84d5-8d277e564bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144543, "uuid": "294aa143-f144-4915-b740-79011c6e9e68", "value": "39loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9a0d4e-179b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688166918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166918, "uuid": "50f0fd14-84a9-49f5-8fe8-f095e572005c", "comment": "Malware payload (RedLineStealer)", "value": "b9dbddba63e0ab925c21c4e9e7aecdc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166918, "uuid": "3f7037b1-1ce7-4b28-aaed-04d78398688a", "comment": "Malware payload (RedLineStealer)", "value": "64365156896ff3b41790a7b0dd38bf1efb985a4e5e35135883b34ea69a85b508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166918, "uuid": "4fb79fe8-031c-4fe2-9d2b-0e3052c9fdb2", "comment": "Malware payload (RedLineStealer)", "value": "13724bfbb505f85693606280dafe3ff749372ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166918, "uuid": "4e636f46-6da5-42d7-a1a1-439ebfba51ad", "comment": "Malware payload (RedLineStealer)", "value": "34ab0ee37d73925f40e8cb89ce130c785983b08dfa4c3e6e552502cdc1d7b925f35169d8c4938899700681e96d21f88a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166918, "uuid": "5d57f8b0-2971-464e-84d6-381ecabfd338", "value": "T134848D0392A17EF4D5358B72BF1FDAE8360DF5558E493B7622189E2F00B81B2D663721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166918, "uuid": "40642256-1307-4118-b679-d4e2e9b111ee", "value": "c1f59b5b7783d7b87e622c768d615c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166918, "uuid": "af8d4048-c1d6-4699-bbef-6e05eeb852c5", "value": "6144:qWXVGmfa9s2Kk0hxeQQBr865/i/X3L6PyT:BFGmfa9nVw6l23L6PC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688166918, "uuid": "fceca4ad-703d-4234-9be9-ab36d896abf2", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688166918, "uuid": "29d34d9a-66e5-416f-97a2-c37fed4e1cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166918, "uuid": "7193d833-5d2b-4118-a1b0-93c91d10cd00", "value": "b9dbddba63e0ab925c21c4e9e7aecdc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee5ced9-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154363, "uuid": "14acffc5-0b77-43ca-b065-626e3be19b98", "comment": "Malware payload", "value": "2ef1069452a387f84a89a6cb4e1cae11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154363, "uuid": "35ad7a52-4075-48e4-8155-f593377d1169", "comment": "Malware payload", "value": "663064253d950f0bf09872b96f7ae51b34d146a38a09501e0bf69e0ab1a9410b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154363, "uuid": "f5eeba89-bd9a-4181-81b8-23e6f90f885d", "comment": "Malware payload", "value": "41eb3526ba3dc4737630e055a8f105783b5db504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154363, "uuid": "006f77b0-5bb8-4933-9add-81076267040a", "comment": "Malware payload", "value": "c84c7eca3f442215fee4bb7507e3277ae506377bcd7a8e56fc7be6ef435797a52dab4c73838660a504577afb12a5d0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154363, "uuid": "5d1695d3-b10a-449e-909e-4d53d42f3a20", "value": "T14C56021833449F6FF6DF07BE92225514C7BECA01D346AB8F0A99D0F96442780D86EDA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154363, "uuid": "bba1ee49-9cdc-47c2-a766-11029df128e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154363, "uuid": "3cb2cf82-e00f-4e06-a522-b7ffd3d4543f", "value": "196608:8Vba9SX645MLB9mQvPARuWZOAYp+/b5O7VLzj:2bWSX644B9P0yAJbE7pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154363, "uuid": "1cfc492a-532d-4627-a89e-f7ae50923991", "value": 6339072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154363, "uuid": "08876cf2-9265-47d5-add7-67731443e128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154363, "uuid": "231a8b3d-f07d-4eb4-9210-16700e947538", "value": "SecuriteInfo.com.Trojan.MSIL.Seraph.AACV.MTB.30062.19409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3043016-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688111420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "ba0094fb-cb98-4867-afa4-340037a955ac", "comment": "Malware payload (Mirai)", "value": "0e9575dba9bc2aa4b928149ae0fff45f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "c4a2f681-0513-4332-80b0-3bafb6fabad2", "comment": "Malware payload (Mirai)", "value": "663fdb4b4b7bdf723e3f1892292200f31a45dc2b9b55a4cddd8801692ee05ec6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "2010f9c1-1530-4ec5-a7f6-ce6da67b4448", "comment": "Malware payload (Mirai)", "value": "26c64a8234218a1bd1e02e7904ae174715d77e68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111420, "uuid": "3240c4b9-ad1d-4f2d-a59e-ab8496ba9c1b", "comment": "Malware payload (Mirai)", "value": "a44fccb2bcde998415f87afcf9aac88fdf0a2e81ae1a976a5c73421d8df2863c86566686bee1a944b94fe9a40833866b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "11f0084a-ac67-4aad-b7be-bed8937f2e08", "value": "T146E2F1419B95AF62DE304039E7668A5867EE2F3491F032754E940F74BE411233FB26DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "d5a791fc-bd45-4ed7-907a-81d4c4b1c112", "value": "768:0pmWXseLWQdnsAt3eV+tyIQbu+THiWjtlbCelKs3UozQ:0pmqse9t3++tyVumz9JHzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111420, "uuid": "e6e47243-3f10-4039-9aca-8ff8a02f0288", "value": 34056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111420, "uuid": "2473a710-0152-482d-a0cd-791d0a2c44a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111420, "uuid": "0fcbdfa9-5163-47ab-950d-71e89a4dface", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3994bdf6-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688150703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150703, "uuid": "d3730c34-fe41-479e-9705-edf170278b0c", "comment": "Malware payload (RedLineStealer)", "value": "848d0f3c0dcbd91e7dbcce5eb5f39cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150703, "uuid": "5dee8153-c963-4685-bc5b-08808d633688", "comment": "Malware payload (RedLineStealer)", "value": "66ec3c9fb1339c6925fb508c17190aa7869e24b149abcedd771aa53ea9de27fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150703, "uuid": "7107a971-7468-463a-90af-baeae3a4525d", "comment": "Malware payload (RedLineStealer)", "value": "de2c33623c20a02c574f31cf32ecbdf2335cd4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150703, "uuid": "27df400b-f2dd-4b49-85b4-6862eab589ea", "comment": "Malware payload (RedLineStealer)", "value": "31b2d43e2fb8356baa0262c06e22973b1a5ee364cb3fadf65edf74bf8e45b72b788a849401b563405446ac78b118678a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150703, "uuid": "339a3afe-123e-48b0-94af-dbe6981b8a0f", "value": "T153C6334DB754B080ED7A29F413B083F3A132B3A36A2647774ACED7A64517D0772BAE05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150703, "uuid": "1b35538c-0062-4dfa-9841-08b65e66d16d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150703, "uuid": "cb8005ea-428a-4972-ac8f-efd394d7cc58", "value": "196608:yEGwviZaq+LGzHcUUsPh/QJ/sZ0tbQ+rlFs5RShu0PNid8comVWTBT6K:ItMGzHcNRJ/sibrk5QhF1igmVWTB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150703, "uuid": "c87be057-282c-43ac-8ced-86268694c3fa", "value": 12133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150703, "uuid": "8218e35c-72ec-4b03-b588-ccfa23132eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150703, "uuid": "0d03aec5-d7e5-49b4-8d4d-5e4058cd89ae", "value": "SecuriteInfo.com.Win32.SpywareX-gen.7963.25701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bb12e6-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144902, "uuid": "ee034860-fc5b-49f9-9b70-fdb5896fd565", "comment": "Malware payload", "value": "a358f7a99be7fe37f93b4edc4d62ddd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144902, "uuid": "27c3bcbc-f264-4331-b0a0-936e49b0690f", "comment": "Malware payload", "value": "681cf85923d279e415f451cd0282a1abfa579526551add7d6b4554dfa62759d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144902, "uuid": "0253b527-f980-4233-8bb7-1d9b867f5983", "comment": "Malware payload", "value": "85a46862534618376740e2e23d31a5a945c4e264", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144902, "uuid": "ec9b9146-9f26-4dd3-91f6-ef46d8b2e993", "comment": "Malware payload", "value": "82ed39fc8a6cf65ca323569354438a580f8534b9096040e4f3eeabfd4476a024067a45cacdb218e7a7a41b8355a4963b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144902, "uuid": "098e9525-52ea-4636-9cd0-bdae79066ee8", "value": "T1DB646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144902, "uuid": "91a343aa-0647-474a-9c8b-9db28b522084", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144902, "uuid": "d899b780-a9ac-4f55-a651-806c0f6048da", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144902, "uuid": "d6b0d324-5ccb-4880-a40d-70f545a7f283", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144902, "uuid": "edbe1b49-4629-44e7-8111-0a670bb3db42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144902, "uuid": "c3f67a31-f61c-4bee-a59c-8ecfabd25dcc", "value": "83loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f54ba6-1714-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688108655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108655, "uuid": "4d8899e6-fb10-4fd4-be10-81c7260e154b", "comment": "Malware payload (RedLineStealer)", "value": "b8b4d3b9df88305e08b20b0b9a8e3c69", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108655, "uuid": "c8b6f946-6654-4873-8b24-7d786a35c389", "comment": "Malware payload (RedLineStealer)", "value": "6841476edb4b21299c791faa6a415abe907c6d3c6c4b5b3a622519b4f1c734db", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108655, "uuid": "804fd9e6-87f8-4600-9208-5f8e05f29837", "comment": "Malware payload (RedLineStealer)", "value": "6cccbea5fdf54a1edf5aeb21736661301fca55f4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108655, "uuid": "38b22d73-92fa-4c9f-bc7a-883f886c96db", "comment": "Malware payload (RedLineStealer)", "value": "085598c21812b8098c56cc17ea937a1b12e54e8f8c0888a0e9cb3310b1398fa2432cc29630dd528ee9cfef0adab92256", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108655, "uuid": "86a1d6f7-7ace-4902-9a0c-18056394c41b", "value": "T1BC2512217690C572D973923140E6DD78AE3671754BF881CB7A8C27B66F122E1B3363CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108655, "uuid": "06289fd0-d403-4b03-bf7a-d79cba7f50ef", "value": "24576:ek70TrcD00Cqn22LLJUj+MoIAGAT2ysplxVw8z6/P:ekQTAD00H2MdUKqAzyVHz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108655, "uuid": "4c5dd609-dd15-4f7a-a04c-5a0ccfef5599", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108655, "uuid": "23defc6d-41fd-466b-9689-d7651f3bfd62", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108655, "uuid": "92516f2d-0e96-439a-ab07-42499e60916e", "value": "433713_Quotation,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d93b65-1731-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688121090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121090, "uuid": "c1dc3858-2f15-45d2-8bfb-9d60bd7f1e91", "comment": "Malware payload (Mirai)", "value": "542257e660e467b012f528e5a23e73fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121090, "uuid": "29fabc3d-5de5-4ac4-ae6a-9a33eb7cebd1", "comment": "Malware payload (Mirai)", "value": "688558e964de1ebcf81f186d7bac28fe05ecdf181494373227bbfcb49783ff50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121090, "uuid": "02dc623d-4b8d-4799-ad25-8133ec5ea469", "comment": "Malware payload (Mirai)", "value": "4327cd3f600d4d79662111f43af52e4c9f5e3fbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121090, "uuid": "90310f87-ffd4-4f80-b327-74e49b59ffe9", "comment": "Malware payload (Mirai)", "value": "ea97e12e588efc2be7865b2553883ef9d4b0d4ed26a73e9e7cac7af6681f0fc00f01db42f5f856efbd61eca2e291591a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121090, "uuid": "58420af2-2a63-4e6d-857e-c7b976c99165", "value": "T16EE31EA2684CC6CBD0266279A4DD8F3FEE3E72C62B05CE117DD120369A55FDB291BC41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121090, "uuid": "8031f0ea-1d6b-4b98-945d-0a2585366081", "value": "1536:7yWVlXGJJt/sBO6LiKVBbGPFuBV8luHPnOTgSeElQAfCuNJ9z5k0eN1UtEM8Lt3L:7XP33+tXsEJMeyTldc8BCBT/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121090, "uuid": "0e688b12-2bb3-4ab8-9393-b7752e96c40e", "value": 147684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121090, "uuid": "39318843-c8dc-418d-a7e5-555fcd20052f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121090, "uuid": "2d9a3444-c9eb-4c4c-99c1-6d2c3ba6f22b", "value": "542257e660e467b012f528e5a23e73fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb368e69-1792-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688163054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163054, "uuid": "c9444cb4-0f13-4942-907c-b57f567f16c8", "comment": "Malware payload (RedLineStealer)", "value": "70f331abf74c5b4351e71a45d834ada1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163054, "uuid": "75a83f27-55f4-4f22-9009-fd4842fed181", "comment": "Malware payload (RedLineStealer)", "value": "68af9af3506c7a35ef60026b6662cbc1fda0b36007a6eb48a974e4d7574db21f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163054, "uuid": "f2eccba5-e481-4890-8a48-12191b0a1369", "comment": "Malware payload (RedLineStealer)", "value": "e828bd4f00d8f63c4205a9be7c6da1239e21e707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163054, "uuid": "a0f73f73-9262-419e-ad9f-cc9e9583b6ef", "comment": "Malware payload (RedLineStealer)", "value": "cff5eaead91010412e28023cf271fd33eca563005d6f259bd89dd901b6c4da2bdf4f63d564d863649fc77765190394c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163054, "uuid": "a2ac4684-9492-41c8-a0ab-061ffdec2ad1", "value": "T1FEB425529734685DBB374E259AEEF9A8C047FD93BD01CEF8801599937C463C3E4A207A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163054, "uuid": "53de3ec7-2563-49cf-8598-3aa8a53b26b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163054, "uuid": "8b5159e6-4165-49a2-ac1c-403c309ec489", "value": "6144:Iyv496N16r+vkN9SUWcSVVKoxxfWf4qa9wR4uPH20nfoaNAQftrDdpiDKGASKGkP:bvLK+mSUWZXKojWf4+RVHhAlASKGk19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163054, "uuid": "bad719fd-82c8-4008-b41f-e08539175c96", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163054, "uuid": "7e284634-4d2c-447f-98f8-8256a742ff55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163054, "uuid": "2091570b-f633-4f78-884f-32ae6da73c00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13ba0eb-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155709, "uuid": "4bf089a7-dd75-4a72-8636-53d8bccb813d", "comment": "Malware payload (Mirai)", "value": "d4316ae1dc0f1e4f25deaf3182e4a9ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155709, "uuid": "7ed95de8-c24e-4ec7-bb9e-4dd31b4ede5d", "comment": "Malware payload (Mirai)", "value": "6917bbf9f8fc9dac24d75fa075f3b573597f0f545516a73ebf0bc3dfd1545d94", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155709, "uuid": "4ab983d3-d0db-4aca-8e18-882ac9abb127", "comment": "Malware payload (Mirai)", "value": "963b115c5b9a92406fc20513271f39583a1c88d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155709, "uuid": "a3c4d32b-ec84-448c-9c64-64d18e089238", "comment": "Malware payload (Mirai)", "value": "2f03ad981e15dff31dc2222cc836451946f65006ea63e75e2cbfcda02187949a18d2173a104199d0783db69c6c26618a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155709, "uuid": "4fde012a-64d1-4005-9fc0-6b732ac66bf5", "value": "T1B2D2D0B91A0B4BDEDEABC8F5C3E413A019650E126903FD4A70ACD7436B675C0A54BEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155709, "uuid": "e09115ca-78a5-4601-a5b7-b7630378c994", "value": "768:3xMWBhAHuLegF1aF4NscfOl8liV/JgGlzDpbuR1Jo:3xdBGuLea19acfjliLVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155709, "uuid": "2f89df7a-36f9-4f94-a76c-c029057c4a90", "value": 29420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155709, "uuid": "4294fc3b-2ee5-49c9-890d-2c31084cbab9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155709, "uuid": "69a7079b-dbdf-465e-b1f0-d695c124d1eb", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13423696-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163094, "uuid": "4a3fad7b-1d42-4791-9236-aec1d9198038", "comment": "Malware payload (Mirai)", "value": "67bb73fa217407ba1e86eeb3eedbece0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163094, "uuid": "ecdfd6bf-b84e-4181-b346-ca675e3303be", "comment": "Malware payload (Mirai)", "value": "694ff75762e4e82cf89e3ff0d01573c49825e5c210516a173138a93eeeed90c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163094, "uuid": "cc0012f6-1049-4334-bdbc-b0cb7f881797", "comment": "Malware payload (Mirai)", "value": "d3fba831e6a68b50b3db461e877a47b1f1679696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163094, "uuid": "3e3401aa-416c-49c2-92dd-c4ac12faaf66", "comment": "Malware payload (Mirai)", "value": "bb8748042b5f63c01d9559168259b9db9a9c0595432cf5a5492577022450726516138865bed98250d89d1795b00cbc6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163094, "uuid": "34e89752-da51-4888-b3e2-83edfc5d05f6", "value": "T1F6D2E020E575A03DC6302D7AED7A1482ED56CAF9D457F9B20E400AC86EDB106AEDD4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163094, "uuid": "de23b384-12e0-407c-a5fa-72e6312e3369", "value": "768:mnoG7RwZE1V0+kzSDV8dEnl/1xCR2aOdBh1fJ9q3UEL6f+:GoG7RwZ0seDV7vLamB0Ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163094, "uuid": "411f18d6-ed33-4beb-ba3c-8cd22d9a15af", "value": 29528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163094, "uuid": "91ad6141-8315-461b-b565-015ae5efbb78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163094, "uuid": "22708ba6-39bd-457a-a5d8-ae6f542603b4", "value": "67bb73fa217407ba1e86eeb3eedbece0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0637f84f-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144174, "uuid": "b0e15583-3c65-4a3d-9fb3-49b0ceee8243", "comment": "Malware payload", "value": "b3efc0874d6e18a616b74d88e5cb0f1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144174, "uuid": "890918e6-f866-4e9c-8a2c-d03b15bcd1d2", "comment": "Malware payload", "value": "69bd99945ffb33dd1921501221bd86c130541557ed12b24a4ab2c66897a3e05f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144174, "uuid": "94bcd139-f91c-432a-a0f0-b757d72e965e", "comment": "Malware payload", "value": "34211166b627403a10805278350cbae96b9b91d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144174, "uuid": "dc7f3a94-dffd-4bec-ab40-506f58c0709b", "comment": "Malware payload", "value": "0e8c8cef6da6b9692a01c23d7d1f756bbecfa3968e33e5c3d0d607e546ad5a2d8e88ac42a4c9dc5b7c44b0d2557d65f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144174, "uuid": "3db03665-0738-42ee-b2f4-eb2e951a149a", "value": "T1B576337248B10532D6714BF01EAE47D66A713DA1BE13E39F5B10D67F8E324C10A727AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144174, "uuid": "e3391d98-e6c6-44fc-a031-a5bc11bf1f15", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144174, "uuid": "ebda71c0-7a42-460f-acec-1103e6729964", "value": "196608:20Z2s/JlGi0I4hz0eadDDhxd5gFZ2/LMRf701C:2cH/JlGi05h9adD9r5gv2IRjCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144174, "uuid": "356bf70c-6b09-4424-b707-75ebd3bbacb7", "value": 7756288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144174, "uuid": "4c51db40-b510-4ead-b5b6-fad1d0744579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144174, "uuid": "906827a4-d82c-4682-87ea-92f9942d05cb", "value": "SecuriteInfo.com.Trojan.GenericKD.67699723.23083.32003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f405e7dc-176b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688146291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146291, "uuid": "d52dd32c-c65e-4807-818d-f11a0c03d1bd", "comment": "Malware payload", "value": "d18f20439976a638961db9bb0ce84516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146291, "uuid": "c36dbe3e-6669-41fb-96a8-65f0dc464a66", "comment": "Malware payload", "value": "6a5445de9eddfa80d6d66ad7a8fc543a6518dfb5de75da609c9ea375a7f4ebcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146291, "uuid": "6e734026-2335-4d8e-b545-84094043363b", "comment": "Malware payload", "value": "7c099edc4ae27a55359eafb0cb2eb6352c07287c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146291, "uuid": "35d1ec66-baae-4467-a815-24519f2bd331", "comment": "Malware payload", "value": "5d8d829369c164f49d6e21a3b2f42e5c4b6b43cded51df418e442f0b953984ccd0b65612c7504bfca9b4a2aad0cd5dd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146291, "uuid": "5192b297-ceb7-4452-833e-ebc5ae9aa4ea", "value": "T1B083C509BF910FBBD86FDD3706A90B4635CC555722A43B3A7A74C828F65A24F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146291, "uuid": "88f6ec03-b95c-4d3d-a146-b5dfa81e6233", "value": "1536:f3Vmmt2EXVImiuo80KBC/7sfqzJryFVqSaMq8gZFKfnsq:tm2IlH3tr2oMFfnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688146291, "uuid": "625393e3-1acc-4ab8-b542-ecffbc250e61", "value": 88680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688146291, "uuid": "f084ccaf-1a03-41bc-84e0-6c37d80d9e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146291, "uuid": "321a574c-f21f-4e91-b8eb-ddb0b1664547", "value": "d18f20439976a638961db9bb0ce84516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd1cf13-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101155, "uuid": "6a9974ce-c48c-4317-b515-dd091238efe1", "comment": "Malware payload (Mirai)", "value": "b0d174c767c4832ff2d0508fada0a1bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101155, "uuid": "14801732-0fae-475a-876b-d39ab9066e70", "comment": "Malware payload (Mirai)", "value": "6aac0e067c4527e2da2415cd9de15d0d1dc415f6928a0fd3e6b1a170a5e0c339", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101155, "uuid": "b4e9a3b2-8343-4f4c-84e5-15d3e6426f2a", "comment": "Malware payload (Mirai)", "value": "7ebf1eeeca436943f6f51613f5aa2d7b7afc279d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101155, "uuid": "fb72ef6c-b62e-420d-b872-0524c4ea0b8f", "comment": "Malware payload (Mirai)", "value": "823bb679703df9c35ffe6878911ce1be91db8dd4bb6facddbad8df42fe1ffdb0a91877ba4866564a73eb7edc01fe1279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101155, "uuid": "390bd623-661a-4374-a7e2-28f5984ede75", "value": "T15D63E656B8D29A2AC6E063BEFAAE119E332163E8D1CB3217CC105B1577C941F0D77B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101155, "uuid": "a2ca959a-554a-4130-bb67-ed2da23527e3", "value": "1536:2y0b3QR4u9Gs5SXLoUczVom3B81fpS0MHRNWGCNi9opoDvt5zUF:2yoq4e5SXelCIwSvboF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101155, "uuid": "bdc1c092-4019-4842-a4e4-4ef0a239c478", "value": 68616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101155, "uuid": "630028b8-c027-48ef-a125-4a4041a9ee7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101155, "uuid": "ebe6158f-c9d9-475b-9ee1-e7322abc296c", "value": "b0d174c767c4832ff2d0508fada0a1bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5344d539-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112521, "uuid": "b707c1d7-b78d-4202-a237-33b1d73e7929", "comment": "Malware payload (Mirai)", "value": "8df1109cd48e4c2fca71143129f0309e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112521, "uuid": "b3d8d45e-abc3-4d5a-be06-c06f084dfbeb", "comment": "Malware payload (Mirai)", "value": "6b5d55b754ef854304ee5c844a2bd060d2fb9c4bcfc83ddf33c26b0da914aa87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112521, "uuid": "688553c7-6b5f-4e42-bf17-3b638e644136", "comment": "Malware payload (Mirai)", "value": "e546a8cbceafa326296f61f63376bc48c5d398cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112521, "uuid": "a28d11e6-d9b5-42f0-b77a-c960d9a433fc", "comment": "Malware payload (Mirai)", "value": "a973e1a0cba3c82a7b44b65b92154e24514437f9f1c1c37b51565dc85a3cf0f02e9972aa32dcea61475940ae29f39603", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112521, "uuid": "cebfd374-6ba8-46bf-9f1b-b69dc4e737b3", "value": "T1C1C2D0E0B726FA31C520AC3DE52B4D8A3A51067C90FF393764194D398FC1A5B67B84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112521, "uuid": "67c66ba6-2f6e-4940-aca6-a62f0a05f641", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrJA9q3UELuR:NKy4qfqoeJdXWgTL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112521, "uuid": "d40dff4f-06bc-49da-8cb0-bf59b2fa5aa6", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112521, "uuid": "6fef97fe-a56a-46fd-88f5-be28748950c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112521, "uuid": "93aaf123-8099-4f71-b9a5-287b7d6752f3", "value": "8df1109cd48e4c2fca71143129f0309e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d50af40-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163084, "uuid": "dcf8db8c-35ae-400a-8547-b1679057bf54", "comment": "Malware payload (Mirai)", "value": "e4d63666c72cbe0a38c9a795633286bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163084, "uuid": "fc53b68b-1448-4245-9c58-58851a025fd9", "comment": "Malware payload (Mirai)", "value": "6c5a5ef8c1105ce6fc9de7f686e02a47fb092aebeb5961b7898dd2f4eaf405d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163084, "uuid": "5f4f6a0d-9fe0-418e-9c84-442bc1730d06", "comment": "Malware payload (Mirai)", "value": "f6d10e6bd12c1d9c818660ba49b5f798ff7fa5dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163084, "uuid": "e2bed9ef-62f2-428b-8eb5-2a01d8f4ef0e", "comment": "Malware payload (Mirai)", "value": "0332ad05cae4e0dff92c599f8077c5223bcf7472b6a53c9603819a28882aa76b02de593e23ffca0009ae00a4ba4590b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163084, "uuid": "d383dca7-9f04-405c-be71-d5783f7d59d5", "value": "T1CD432925AD792E26C0D8B57E21F78724F2E2620E25B8C51E7C721E4EFF04B4065537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163084, "uuid": "c2ce50ac-dd54-4d64-9206-f538d2e33680", "value": "768:SEodzPAq9Ta/dK+I1KgPxP0a6Ws7WRJsydwXaNYETO+7JdDrF6:SEizPASTa/dK+I1VPJ0a6v7rInzF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163084, "uuid": "b1dcff49-707a-4c9f-a0b5-e82b540db42a", "value": 60524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163084, "uuid": "a45e8c72-c166-4713-91a3-abeabbce8fba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163084, "uuid": "35765434-5251-4914-964f-e05b2f4be517", "value": "e4d63666c72cbe0a38c9a795633286bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90f0b3b-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154380, "uuid": "e3ce1db7-665c-4cb1-85f1-acc3ab8bd3d2", "comment": "Malware payload", "value": "5dbd662bf2a7fadeca6bbba5898bb8d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154380, "uuid": "5dac8b13-85f5-495f-a4ca-0486c551e23a", "comment": "Malware payload", "value": "6d01ffff31ad0cb763b02e84a7c859f4dc93fe7dd4de0ffc85be2b224ac274e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154380, "uuid": "4dca8aac-cf06-4c51-840b-2a7f64b6b48b", "comment": "Malware payload", "value": "44d889bb3410e9349f3b29db898570afed81e15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154380, "uuid": "8f581c71-974d-49c8-8f3b-ed704ebc71f0", "comment": "Malware payload", "value": "f1a6936d16a58e6360669d8e0628647e2a8cf1a4406ac71002076333250a4bf2cfa5b02d4b6f47b9c0b7d459eec8da3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154380, "uuid": "2739a0c1-6c25-4b0b-924e-191bb3505033", "value": "T13756339B97DC96D1D07C1734396B7633E7B698CE3F2D91E12C60BA4600ACF02E165A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154380, "uuid": "3d5184c0-098c-4e85-9116-c6193e941bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154380, "uuid": "56ecb48a-6738-4b23-9c0c-5d3449d3b366", "value": "196608:yujq6slR93VL+8fpeBjXTUy6/hKsMmDk:yujFordeBnp6/4sMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154380, "uuid": "9da91261-5d07-42cb-9f4a-3326777bec18", "value": 6349312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154380, "uuid": "4431787a-5e87-4a8d-bf8c-57bfa02760d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154380, "uuid": "3673d49f-bf87-461f-a6e5-714733e38a54", "value": "SecuriteInfo.com.Variant.Marsilia.44798.17998.31831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f37ec3-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144494, "uuid": "a379efeb-f9ec-4cb8-8fdd-8c931a50b1c1", "comment": "Malware payload", "value": "b2a6dc11c741cf579bc7d51c23da2897", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144494, "uuid": "be6e88aa-b96f-44e7-825e-a8d20d56fa45", "comment": "Malware payload", "value": "6d82a937b7fae3d7d105dc8ee39b7ccd4a6b43219d798c19ac53a102c966629b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144494, "uuid": "63d360fc-e419-49ed-8f2a-c74884d1e7f4", "comment": "Malware payload", "value": "54692317a33830784f878a5273609fc01209cf8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144494, "uuid": "e605f451-2cfa-4584-a304-6e62522158b1", "comment": "Malware payload", "value": "7f7bb2891a8c0a37a61887d5386ab56a18dd007424e8eafd29e6a914ea08dd51185b5f97b81b208c5e6ae64596a341fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144494, "uuid": "01c9ef5d-36b1-4377-89d3-a282c6427b32", "value": "T189646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144494, "uuid": "50e150e6-baa7-45d1-a404-e397e637d899", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144494, "uuid": "754c7c97-e2ce-426b-ac69-b507d4b77bf1", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144494, "uuid": "f5da6759-014a-406e-a568-826548143337", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144494, "uuid": "fa2a1997-645a-44a5-a48d-2dfd0f377993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144494, "uuid": "f92b7e69-2452-4915-a4ef-221f27f6d28e", "value": "33loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a142658c-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144434, "uuid": "e9806775-2f41-42b7-822e-f825d73b68a1", "comment": "Malware payload", "value": "3b66c45286bf0dd1cb5fe8eeef65323c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144434, "uuid": "007b6797-675d-4d7e-aa35-89b0b8a33dae", "comment": "Malware payload", "value": "6dee514ad18ff911de6ada437a620897fb98c0f7f843466656b946ba0d55d7c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144434, "uuid": "d7002644-4024-4ee8-8356-b8b9655d9f0a", "comment": "Malware payload", "value": "9d028af8264847fe07c5e79a10bd819631b8e880", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144434, "uuid": "191cb4bc-32ce-449a-b802-d5a59056953b", "comment": "Malware payload", "value": "bbe0cb1e45fd90565fde5e5b317d4726af2bc6df6037f462e3cdc9c61ff43b099633242c3256afebd9e5f2b1550bd2d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144434, "uuid": "d74bc6cd-db6e-4f69-abeb-7850c3641320", "value": "T186646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144434, "uuid": "789c86f5-cb93-4c73-bf13-6d07f14b7895", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144434, "uuid": "33650d22-78cd-401e-8495-68c6f34ccd08", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144434, "uuid": "ed6a3ccf-099e-453d-b457-fa86048cd19a", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144434, "uuid": "45e6277d-189d-4e60-b2be-51864d3e2f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144434, "uuid": "a8a3fc76-bee9-4a4b-be58-47d662972251", "value": "24loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39471ce6-172a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688118061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118061, "uuid": "9e92dead-b3d1-46c6-8ea9-7698fb7754eb", "comment": "Malware payload (Mirai)", "value": "d611807c4fc43c10eec3287e6bbd1b89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118061, "uuid": "d4063a82-a0f2-4b89-b24c-649dfb06878d", "comment": "Malware payload (Mirai)", "value": "6eb125cc9d01335aedad5cbca353318143bb51eb21f52acfdbb52f73e63f2f89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118061, "uuid": "fa02c442-3716-4730-b17e-ae76b5fa0319", "comment": "Malware payload (Mirai)", "value": "1d795d2cd7e3e5b0fc2045592f6c9da9c6fd6c4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118061, "uuid": "3166ddfb-ae87-43cb-b1e9-df1b0610c438", "comment": "Malware payload (Mirai)", "value": "7ffc9f7fb998ba341d4fc4e3a10b026e726ea4b93a9b3056c6974daf5c52478e7228d7805aa763d42a10781f69251f4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118061, "uuid": "93ba97ec-15ea-41a2-ae77-7af6d88e8da3", "value": "T164334A4332280A07F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73188AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118061, "uuid": "eb25c4d3-a0a7-4964-8098-76c9f7723b13", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiSyAmOz:mZLx13THMqfpT9mDWkGRuXqx1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688118061, "uuid": "90411122-09fe-4e3b-bacc-3d4e32edb5e5", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688118061, "uuid": "6b4c6bf6-9c4c-423f-bbe2-bc351ec4400b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118061, "uuid": "aae5ccbd-e420-4a86-88e4-0b08f4214f7c", "value": "d611807c4fc43c10eec3287e6bbd1b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea632af7-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144987, "uuid": "33b9731c-c758-4f3b-b645-f03ee2f37dac", "comment": "Malware payload", "value": "2874ddb41da6cbdeb6dc64d3ea32aeaf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144987, "uuid": "a81174d9-75cd-4ffb-baa8-17d7bc4fe0c1", "comment": "Malware payload", "value": "6ece7e6b04f4066bc72249c5b7016337131d147e97042f0da9af1017d1cd2c41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144987, "uuid": "396b4a9b-4045-4058-b51f-6a1909e46ffa", "comment": "Malware payload", "value": "b90dbd5e8c420af584fb7544a3507595f6f01fd5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144987, "uuid": "8ae2590f-4858-4f6a-a301-da70fe5b6960", "comment": "Malware payload", "value": "105d69e8a2bb1eb927c915aece8c6b8211e454e33a85351c1d07b76673bc985abae8645e5117e3a6af66deab0c9436df", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144987, "uuid": "d0c526f2-992a-4b94-93ad-d54d65b1a0a1", "value": "T1DE646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144987, "uuid": "129d72dd-c661-4691-b97d-003e61fe5ffc", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144987, "uuid": "f25d4caf-8de4-43bc-82e2-407bf9c33185", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144987, "uuid": "00896e2d-558e-43c8-9d44-0ce1e15feaf9", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144987, "uuid": "7fa758ff-b5a4-4b15-b30b-6c722d33278e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144987, "uuid": "c218a7bf-2d2f-4666-a66d-0926bb804a21", "value": "97loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442c582a-178d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688160599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688160599, "uuid": "1d4e08da-4649-4460-b427-819ae9991501", "comment": "Malware payload (GCleaner)", "value": "21b8f99ca3832a204fd8d08065e1599e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688160599, "uuid": "3f4b4d11-a36b-4521-a842-5dc131b17835", "comment": "Malware payload (GCleaner)", "value": "6fb4866ca3fa5e2e0c9926fee2fad2fc3324ef0177ff7b43e1f3990b05f4bd90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688160599, "uuid": "aa885d84-fb03-442b-9664-2743e47c5a9e", "comment": "Malware payload (GCleaner)", "value": "6a5c3cb76b85e1323f9cb2f364f31cf6bb591a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688160599, "uuid": "ce41f431-8f2b-417c-9458-41d2f1bfdae6", "comment": "Malware payload (GCleaner)", "value": "48c7a0accf132ab71dba814fc54f09b73589ac3eef6faa050bed8a38f264b6846351cab882a2e7d6809e8d6d2818958b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688160599, "uuid": "3e504ad8-ac8c-4c97-8126-1bdda4179bb8", "value": "T14F552323FA6195B8C6728E752E28D874097EBEC11A700D2E789E3E4C1F776068937753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688160599, "uuid": "45e09bf9-ca0b-4344-8e50-168e08dbfc99", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688160599, "uuid": "4908302b-192c-4e80-8a86-5a819e3a1cb4", "value": "24576:+fOyskQT9YsemOMi+XShulmLIrPfJL1rARpJjBBp/D:+GfkQT9YsVXQPLYPBJ2pvBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688160599, "uuid": "7b048f74-e786-4e40-9bf2-0cf398551bf0", "value": 1282979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688160599, "uuid": "868be646-2d43-43aa-a961-3d3835dcae2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688160599, "uuid": "20e7e2bf-011b-43a4-ad71-00a39fb6a459", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca41027-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144534, "uuid": "56f9d69d-2c3a-4a8c-a9c2-99ab1b69d3e9", "comment": "Malware payload", "value": "a27c6cab82049ab97d762b2dea67a619", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144534, "uuid": "5e3b13ca-d346-4eca-9dd6-eb23f70553f3", "comment": "Malware payload", "value": "70303460ec87077880c981eb2bf5394c33abea0483129abaecb82f26cc0e86df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144534, "uuid": "a32c87cd-98e0-4c82-a1fd-31936c0ff54d", "comment": "Malware payload", "value": "e0e29b988889bcbc037edc19ac5810e6862164b4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144534, "uuid": "8dbc5778-7fd6-429b-9176-26d88998c420", "comment": "Malware payload", "value": "054053d1006c30efcc75d11ec81af018a6d897eb636f9140b8cc5f2e85ee3e0490312a60ddc33cdf0e4d0d89dd9fbf10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144534, "uuid": "fbc3587e-a0d5-450c-b7a2-ec4c36ec0abc", "value": "T165646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144534, "uuid": "c4d6c609-110f-4709-a2d1-0a0a08851bcc", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144534, "uuid": "ac5cf202-9b11-4679-a6dc-4df31beefccd", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144534, "uuid": "33be7f04-fe19-4a83-9959-98e9755207fa", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144534, "uuid": "1e924e99-8f26-4a69-8784-3f63873eddba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144534, "uuid": "a7e31329-90a9-45e4-b016-4c6c76543a3f", "value": "38loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308eae2-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688145001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145001, "uuid": "2da4a2b8-88b1-42ce-8947-0c152df9d012", "comment": "Malware payload", "value": "e7f496c35c22fe2bf13f356b6786f3e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145001, "uuid": "461ee4f3-cc7b-4023-a03d-573f54c62dc3", "comment": "Malware payload", "value": "71c8b76567984979ba0015005cf8eff5160b976755550122b0a65b946d73dd97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145001, "uuid": "7945ae84-48fb-4e58-96c7-b41870cb5430", "comment": "Malware payload", "value": "38569485f0cf74ae471c0064f30f080359b42ade", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145001, "uuid": "f92b42e9-feec-4adc-8172-98afe978d6cc", "comment": "Malware payload", "value": "8856eafd064d5813e728cccff527ee8deaf025fb422eb7fe8db38f94f8b2aaf066fb78f7ecbf5546721876c6780f3158", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145001, "uuid": "343bc883-3225-40b3-aeb6-6da8f1257b9b", "value": "T185646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145001, "uuid": "05283fae-3e3d-40c0-8c6f-e9650051ae73", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145001, "uuid": "4b672aa2-1ebc-48e7-bc43-9aa6e2b2629d", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688145001, "uuid": "f4ab765c-7b9b-4fd9-91d3-380d8236dd12", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688145001, "uuid": "f30eed8e-f529-4d6d-8ee9-4f3d7e5506c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145001, "uuid": "00f913da-1293-4f20-b2ea-7990074bd708", "value": "99loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc61041-1736-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688123544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123544, "uuid": "493de333-8471-429a-8adc-2ea84324fc1a", "comment": "Malware payload", "value": "3a397a15289c1446c062a01b3e0d3c27", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123544, "uuid": "e3add713-e450-4b4e-af50-3c4a07cb7b02", "comment": "Malware payload", "value": "734f92f49ae836c2451930311cb57d94107395f1a9e4cc23a0f73b55cd8c2673", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123544, "uuid": "efd8126c-f14d-4ded-a6e5-b293e210157f", "comment": "Malware payload", "value": "c2171fe09351693408f58ed12ebbeb5dee279178", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123544, "uuid": "bd02d853-b82b-45da-bbbc-f8db3e15f466", "comment": "Malware payload", "value": "ae5cc5f5c60aaabbcfeefcc4be17ea2f26437684973b98c7cd342ecc964bbb84d44f58244181d6bd98cae90cd917db62", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123544, "uuid": "66ebcb1f-bf09-4aa5-9159-13d54e25fc69", "value": "T1D0111EF553360E7AC8B603B1CC30AD0C99F58CB30A8ED1AED9133945C5356911FC4759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123544, "uuid": "6899f978-c751-4871-a096-8106ecd51017", "value": "12:8D28OByN6/rfMSoGY0GeeaTASIVIxVUaVuRDVIz87KZIxgMdIKtE7YnqfFDC:8FN4wLGIoTf9oa8440uFIuE77JC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688123544, "uuid": "efba7afe-78a5-44d1-9f29-c5d65da00883", "value": 1029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688123544, "uuid": "1856ef70-0363-40fb-97fd-63e3c42ca785", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123544, "uuid": "ec601620-86e9-418e-a402-19d6e8d412a3", "value": "massive_ape.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add81be4-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688109237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109237, "uuid": "a6b3b58c-4199-45f7-9974-ad0a2a4505ae", "comment": "Malware payload (RedLineStealer)", "value": "4f96ba8b6fd78d8dc4023c50e581a318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109237, "uuid": "1033cdd6-88df-4691-a756-0e81d0b02617", "comment": "Malware payload (RedLineStealer)", "value": "7458785f0dc0847a0abf3329e7b6cb5380a32d711b14d63aa99ade54586f4b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109237, "uuid": "9035471f-d013-4f66-80c7-b6b6f3246729", "comment": "Malware payload (RedLineStealer)", "value": "869606b32532e0b6798d79fa6d3270a4e70e0c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109237, "uuid": "775bd21c-5b0f-4d7c-8a35-2e7352614751", "comment": "Malware payload (RedLineStealer)", "value": "d71051e25deb75691ebe984aff2abb0eeff3e23bf00573e2fcda462b651108f4825142c0cb6c3846c69622fd1f5433a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109237, "uuid": "2c99545c-e9a2-4f63-b3d0-e3aac7ff5006", "value": "T155853391BD9CDB41CF1688387177B0F50333F7BA4468E6B4378527F49D38A1A2AA901E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109237, "uuid": "f1941c5a-a2c3-45f3-9888-dcbd0e7d3900", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109237, "uuid": "47e539c8-3cd3-4535-ac24-d25699db2cee", "value": "24576:BDz/j77cPxGNL+TzUExon0SjdPeMn1YrbS+VP5fSyoWH+i+f0Ee0UBMe6334Tp:ljBl+Tzl6n0AG7ZZSyoWei+sJ0UBMeXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109237, "uuid": "6cfdafe5-4866-40ed-94a0-9bd13bac92f0", "value": 1840640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109237, "uuid": "a939276f-500f-48e8-b4bc-f096c15b5ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109237, "uuid": "347cf52e-b80d-43fe-ae42-18e5ed905676", "value": "4f96ba8b6fd78d8dc4023c50e581a318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfcaace-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144667, "uuid": "61fddece-8a32-4fba-838d-6834363c2f6d", "comment": "Malware payload", "value": "f3a362821cefa6ba32aaa99e8883f93b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144667, "uuid": "d3f5ecc3-ebbe-4d73-a2c4-ffa7fd3956c1", "comment": "Malware payload", "value": "7510263fc5aa5fdacd280d6c01d94f5182755fc4aeb46c1a6e4f5ee033cf504f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144667, "uuid": "496a0c56-bcf2-4575-8e61-0c013aa60c6f", "comment": "Malware payload", "value": "8bd4038b99df594fe79cd59f35f3df64d7782a52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144667, "uuid": "4b88bd5d-d00e-455d-bcf4-aa0f6de059c7", "comment": "Malware payload", "value": "8bc3285e3ccab9596d4e624ec892adaefc44db5d842d6b7c6e464a3ef604fbf74c0159ceb1f69fa11b67df3419808f8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144667, "uuid": "1ae27bae-03ee-4dcf-92c4-3cb580932c7a", "value": "T1D7646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144667, "uuid": "505ccc11-d2bc-4091-b1da-980136f1d226", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144667, "uuid": "85b1a0d4-e9a9-4ef3-99f7-7385d20b224c", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144667, "uuid": "c0b8ba4c-2931-413a-8352-c248085a80ce", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144667, "uuid": "ddd89bbb-5c15-413c-b832-c997a0b00fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144667, "uuid": "c6553f1e-12ca-447d-9219-061ce8cefb33", "value": "54loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2614cd3-1794-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688163791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163791, "uuid": "ae7ab190-7542-4701-af84-2f31550fbed5", "comment": "Malware payload (RedLineStealer)", "value": "5b10f06b69e3afe8ca90c1e7b6d1672d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163791, "uuid": "966eabaa-316f-4f18-9239-fcd1e3cabdf2", "comment": "Malware payload (RedLineStealer)", "value": "7540132d0c3c53402cc1b0028694f6fdf1da0d0a90b90aeac348e7376667dbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163791, "uuid": "b7785fe9-ce90-4f26-8092-94e0f1618dcd", "comment": "Malware payload (RedLineStealer)", "value": "3ad7f029022da305597e06ae23407c903e8db7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163791, "uuid": "e88d1ae3-9535-4769-896a-811f8f0053e2", "comment": "Malware payload (RedLineStealer)", "value": "f8c99edcdec1e3beecb714bc0ce27e957bf9f4a829c6088dd861ad47fc87134857cb8c3112c789dab3cb9235c0cc5423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163791, "uuid": "5ed5ff5b-8d87-4c06-9ed9-f697830597ef", "value": "T193156BE37CC0817BDDF223FA02ECBDE1002DA5FC07255AC756C9CAEAD2641D16A3655A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163791, "uuid": "65f488c7-b4e1-4f99-b76b-23da89b4f68c", "value": "0c2767651579865fc388772609a1d6d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163791, "uuid": "2fe80663-4fcc-48d6-86a1-adbc08c7c670", "value": "12288:4qExEqEnVG0PmTh+kAUMV5+QiuNpKNtt7Shq/:klh+kfXQyNP7Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163791, "uuid": "f92d24c9-6833-468f-8f62-19a4984fea4f", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163791, "uuid": "eec4c177-8785-40c3-bf0a-b9b9bcfd88e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163791, "uuid": "8f2e6825-e2b5-4bf4-b193-5f85b309d123", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9f5f2e-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155701, "uuid": "a711eb3b-9d0e-4ab4-b305-c10b4bd5f034", "comment": "Malware payload (Mirai)", "value": "493f9dccc9a55f12002c0704f797ce96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155701, "uuid": "b0daf8d8-f83d-4bde-9f2a-a33f26d9c2f9", "comment": "Malware payload (Mirai)", "value": "756bc28abd1f56c3d32b2f42eed1581bbec40f54aba6a03293e00d22876edfb8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155701, "uuid": "abe6f961-7dfe-4371-855e-bd056c55351a", "comment": "Malware payload (Mirai)", "value": "b6feb9b141517e71004b71e31c7d77fb732dd91e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155701, "uuid": "9d96d171-33f2-4d1b-87d1-926a892749f2", "comment": "Malware payload (Mirai)", "value": "70a45882fc004787092782b0b2931f7a1b35201757e1185b233478ba1c611f9caf296799e14e6d790d137375cdecd028", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155701, "uuid": "615dce0b-7b52-421c-8825-4a207ea133ba", "value": "T1FCD2E16CC89D7D45C6AD3EB990CE96B5388874C1A36DE98E13224458F627B87BC070F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155701, "uuid": "951e549c-6e86-4fa1-a226-be393d2f1a0b", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNwJbUWU3:kbDs06t4BEub4sU/MbUwY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155701, "uuid": "c238d304-8e96-46ae-a5c0-271e21a5d42f", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155701, "uuid": "0eafce86-743b-4771-add7-9c5a9d9d6faa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155701, "uuid": "a8d41095-cf05-4629-8c81-ea7141984ebc", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7813351b-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688108288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108288, "uuid": "e305c6ee-26d8-48e8-8266-04dcc9ca9f6c", "comment": "Malware payload (RedLineStealer)", "value": "5dcb8b3343b9274c345206432fd89980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108288, "uuid": "feea671a-6561-44c9-8f34-aef57511a398", "comment": "Malware payload (RedLineStealer)", "value": "75ae798473d4f1a4025f1a07e44fa307a0a317903a42b7e93a9a63b543efa255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108288, "uuid": "fe044add-3988-437e-8e3e-d524876052f6", "comment": "Malware payload (RedLineStealer)", "value": "7b7eeb70483df3ddd894a3d9545ed45fb6128e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108288, "uuid": "ef7b909e-5eb3-438e-8e30-8b6f4efb9b2d", "comment": "Malware payload (RedLineStealer)", "value": "3bb3037e27312ee54f53fe7f49f42230331f20b8f8d93df1b2097a3e019a065be0f6b41d1908ae70f1d406e87fb11cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108288, "uuid": "24b8b9fb-b59e-482c-9ff0-dcbda0d40b65", "value": "T1FA551202B9C148B3C9721C335A785B20593DBD601F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108288, "uuid": "8d13eab6-63c4-4c0e-9fa1-bc51c5f38cbf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108288, "uuid": "18db39d9-0aee-4026-9562-8af42e05408b", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnA9:IBJctgBhc6Kus+9gO0qnA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108288, "uuid": "0385e1ef-fbd2-4785-9a3d-8581af11cb1d", "value": 1354533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108288, "uuid": "2c00725c-5c50-414c-9c8d-dd9981f88a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108288, "uuid": "d4af4fa8-2d6d-41f0-9cdb-590be6992126", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37d64d3-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688101193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101193, "uuid": "8a31ab76-b5bd-4373-9269-a7e30bea21f9", "comment": "Malware payload (njrat)", "value": "56f10385f411be078b84b42560ddea61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101193, "uuid": "3d13dd39-0789-486c-9c1a-954ee35e25f1", "comment": "Malware payload (njrat)", "value": "75bbb15f174d663eed7f4f52cb936a92ab9c73f1f6d4b915f0d2f4521989e541", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101193, "uuid": "3f2b0ac8-ceb7-4e5d-8bd8-e3ea2802e0f3", "comment": "Malware payload (njrat)", "value": "8fe2a0dcc897150b561a3a6680f904e93ed10470", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101193, "uuid": "b7e33e08-36d6-48c8-b82a-b4a8c215185d", "comment": "Malware payload (njrat)", "value": "f6cfa33a76cc0518d98bfb9288491b933f677d02b4f35010681fb8cd922e3da4de69ede405df0acd9e3a312c0c470a70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101193, "uuid": "4b313dab-09ee-4cd2-a045-a05fde8f3b53", "value": "T178033A4D7FE18168C5FD067706B2D41207BAE14B6E23DD0E8EE664AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101193, "uuid": "190d16a4-d66d-409f-86d8-5328d5a2e772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101193, "uuid": "020e2f31-8d80-44d5-b79c-7700d419dd93", "value": "384:bAI1t/CiMx3jBVbJsy8PrWbAox3Nd7pQyGpRrAF+rMRTyN/0L+EcoinblneHQM38:M40bJP8PrGA2HNtGnrM+rMRa8Nu2it", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101193, "uuid": "029e46c2-deb0-48f1-8593-44dfec0d1cf3", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101193, "uuid": "c05fe400-b9e1-418f-ae43-5c87d50a8e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101193, "uuid": "0586fd08-8581-498e-b8eb-30c652fc02cd", "value": "56f10385f411be078b84b42560ddea61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e750f89-174f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688134068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134068, "uuid": "512dce12-dc07-4f72-9e08-9c95fe05f28a", "comment": "Malware payload (Mirai)", "value": "6d7b7cebc113d0be7de11ff819c5be7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134068, "uuid": "f098ae18-6e99-499a-ac72-129554e950bb", "comment": "Malware payload (Mirai)", "value": "766818663f4364438e29505e77703f523326b7e7b1a7e023f0e39e127e789763", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134068, "uuid": "44abb83b-3a63-427b-a5e6-051168dc1307", "comment": "Malware payload (Mirai)", "value": "d6c2f413e2227e1e4250263f2c898aa209ab4b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134068, "uuid": "fc06b8fc-48c8-4c17-8b70-3d8e58e0cd9f", "comment": "Malware payload (Mirai)", "value": "aae1a020f831709ce43487eefde2f53b540fff6eb836b4c39d1435c045f49d91addd1ced13ea6984f1ed5aac87bea25b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134068, "uuid": "edd851db-77b3-42c9-b9ef-9ae5182509dd", "value": "T1BB63D551B8825A2AC6E0637EF9BE558D336063E992CF7127CD211B257BC641F0DA3F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134068, "uuid": "3443ff93-f777-44e1-a21d-1d9c4add90f6", "value": "1536:nZgPkG3bapPEYcwxkOpNjtBYICSElgnfwq8jslryFX:nZgP5WzwanoPSryFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688134068, "uuid": "7e98e4d5-d9e8-45ee-98e5-45bf1f32dbf0", "value": 73260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688134068, "uuid": "e1ff90dd-d5d0-4442-9346-4fd5b116e6ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134068, "uuid": "91734a23-cf10-4505-a4fb-082cc9a119b6", "value": "6d7b7cebc113d0be7de11ff819c5be7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79bdded-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688155693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155693, "uuid": "25da2675-77bc-492d-b74d-dcded05c2961", "comment": "Malware payload (Mirai)", "value": "229b3721fdeb185ccf1986f2afa636f0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155693, "uuid": "1518858a-7a40-4951-81b8-0e910e807601", "comment": "Malware payload (Mirai)", "value": "76eec006eb2f335a18f6dfe668b0cd3bf1c1effdbaa7959ee4477cad62774d47", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155693, "uuid": "ab1dd3e9-6eea-4a38-b4f5-f5784c406672", "comment": "Malware payload (Mirai)", "value": "fdd61d5f2ec473825971984f5314999d7be16c48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155693, "uuid": "fc711cfe-77f7-410e-9616-396375ff34d8", "comment": "Malware payload (Mirai)", "value": "8735c0b749e69a256d723e733e191aa26dd3d6339476600667e1392f178f95a00bb461924e9d0f7595e5d3b18c9ff6b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155693, "uuid": "e2051fc1-0005-4b58-9c91-d7848adbd5d7", "value": "T118C2E0E63E773A5BDF25003935ADCE369274F022C7AEA713A2409249200717DBB769DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155693, "uuid": "9beb1e7c-a9fa-4b68-b827-73dd986e9bd8", "value": "384:MG1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Q/Gy6JUNyV:HMwKDZOFbBy6sSHRYfeAxdd8mGV/0Nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155693, "uuid": "eab960eb-2861-4a57-a76c-7dc9ef335e66", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155693, "uuid": "f8e768ee-d77c-4809-921d-dde0531a9ac3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155693, "uuid": "290f7c04-7653-497a-b7de-f471edc659af", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f82586-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688142006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142006, "uuid": "fbb9eac3-0019-444f-8150-0b6ba5fef5eb", "comment": "Malware payload (RedLineStealer)", "value": "ae935cda1e1db321d41cdd7e6431d1af", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142006, "uuid": "5ffb10d9-3dd0-4d41-9833-42b26e2922d1", "comment": "Malware payload (RedLineStealer)", "value": "77279199e6df6ccb5c1e1b1c0a94f8ecf518db2223b9c737a0af564a41cf27cb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142006, "uuid": "1f718e5f-96ff-454c-98fe-52e28f5c3d02", "comment": "Malware payload (RedLineStealer)", "value": "c4add0fda0132399ca9618cdaf0a6088a5715112", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142006, "uuid": "afe7070f-d7a3-4352-b3d8-08d730f836f4", "comment": "Malware payload (RedLineStealer)", "value": "c84897836bc1bea0ecf2fbb3983d4ab2489fb09b082246b73551b1b980ace24ff42ff3e4768e39c7297f21dfa07b86e5", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142006, "uuid": "fbce894a-140f-4f79-92e8-63fed48eac33", "value": "T14C55C06A7DFBA6E5C0949C39D37645AC82F4856F1031F3B325F516F5CB8858E282B0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142006, "uuid": "6884825b-00d7-4cda-85fd-2692f2d4e8ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142006, "uuid": "3ea284fc-e8b7-4733-96eb-61716b7f08cf", "value": "12288:1BvQdL9pBjzyHjDkU8BC6vxfU9Zz5HPhL9+Sl/FK2lpeuy:E8/9+AFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142006, "uuid": "87903f27-2e6d-473e-8669-236bbd011fd4", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142006, "uuid": "1fd5f2be-37ec-4502-b627-0896dff9eefe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142006, "uuid": "3c97374c-9345-4f8d-ad17-146ffd3c4cc4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94668db-1772-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688149199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688149199, "uuid": "6e340866-51ad-444b-a93c-1787e7ff34db", "comment": "Malware payload (RedLineStealer)", "value": "e2ae5ae3318f8ae3111188f4ed7770a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688149199, "uuid": "936beddd-ecd9-4a49-b132-912859ae1949", "comment": "Malware payload (RedLineStealer)", "value": "78e6e1afe3460aa957bf8ea1764b0efc1acc1117178aa892bb69016a816394eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688149199, "uuid": "a4e3a89d-7b25-4a22-8c2f-612becb17ce4", "comment": "Malware payload (RedLineStealer)", "value": "ea13af448160345df94975af4e0fa362442923ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688149199, "uuid": "4068db87-0352-4f67-a483-909faeeef15f", "comment": "Malware payload (RedLineStealer)", "value": "388adcc3236b9100762bab6bd1ae8dd5e459745bf99dc3377784ef826cbc0c140cf1c91c44e03d1ce4ab71d06133ffd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688149199, "uuid": "165befd3-bdd7-4ce6-a844-2c15a44238fc", "value": "T11BA35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688149199, "uuid": "0ee7d21f-b158-4a78-bd82-41046fb4245e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688149199, "uuid": "ded2f94c-00c9-40d4-9553-f7a174d8c71c", "value": "1536:lqsORqgIlbG6jejoigIv43Ywzi0Zb78ivombfexv0ujXyyed2BtmulgS6pB:j+HoYv+zi0ZbYe1g0ujyzdBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688149199, "uuid": "9d021cd0-1cd4-4570-9e96-b3b628e579ac", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688149199, "uuid": "9f30b6b6-5f49-476e-99f4-33894221d542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688149199, "uuid": "77308a6e-1058-4216-8ffa-9651fc32d789", "value": "e2ae5ae3318f8ae3111188f4ed7770a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa06f57-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144083, "uuid": "2748affb-170a-46fa-b7d0-68d314c00802", "comment": "Malware payload", "value": "5702af25553cd37724c6693c7b78f9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144083, "uuid": "22bae65f-b96b-4ff0-8dfe-41a700fb86c2", "comment": "Malware payload", "value": "798e6bf333fa4f1d85f4d0c77e886f83eeed8638cf585138bbcc4fcf26aef7ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144083, "uuid": "336352ff-8080-4a8e-a799-478348a18a14", "comment": "Malware payload", "value": "35dcb48015998fe21294ad763d1a2fbc067df264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144083, "uuid": "da887778-7d4c-46c0-a6eb-0759e6b8a792", "comment": "Malware payload", "value": "52950f57769eb9b4ad7b1684f519fb139b21ce457323098ab59fad58f66a4d65d471112232cb4228bc5da1459807885d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144083, "uuid": "187293cf-1dbf-402b-9131-2e87ef5e2cd7", "value": "T153463396180B93E4DBB51B39E50B416040FAF58BE223E86E7FB212E7C682FDC455146F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144083, "uuid": "59863a18-2c2b-44f9-a888-b22996a73d5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144083, "uuid": "73e16097-998f-49c6-9f40-2ac341391b13", "value": "98304:UeY2G01bHDVbzVVLI9Wf6Yg+urm+at6BXMXVtoHGiqANlEz:QIDVvzIig+urhe69MX4HGcEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144083, "uuid": "b0117bc2-04be-4d99-a60c-6dff400bc087", "value": 5412864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144083, "uuid": "1414206b-8a4b-4b43-8801-19074e60eb61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144083, "uuid": "279b09d6-ae1c-4b73-a0b8-18c2bd61d68e", "value": "SecuriteInfo.com.Trojan.GenericKD.67699700.18350.7120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8278e8bf-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688131498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131498, "uuid": "204f72e7-b796-4a3c-907f-5712c93b2ec4", "comment": "Malware payload (DarkTortilla)", "value": "631944f74d7790c0b59fab238b4ee6a9", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131498, "uuid": "af55d633-41e0-43f6-ba3d-61c5db7df350", "comment": "Malware payload (DarkTortilla)", "value": "7cc618ba1158402f02943cc603316f6fb1a643b16269a6d06965c39f8665ae9f", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131498, "uuid": "c61ad7e8-7c66-4533-9dda-ed2d0f19f3a9", "comment": "Malware payload (DarkTortilla)", "value": "7cc91a24e848ebb7edd69f1b69532010d7fd2ce8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131498, "uuid": "83f1de34-e941-4ff7-b2e0-771d49c9bfc2", "comment": "Malware payload (DarkTortilla)", "value": "b80c85e88695170189bcb762f891aada151a0435f7c761e7deb4b62480f78334bff6b083c8ff8cd853ac1d88e60c0d15", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131498, "uuid": "aede7b37-b16f-432e-9792-b7f0bdf3166d", "value": "T13AD4AF17EB885FD2C2623B7F4287AE0527F0E4C72260FB575EE958E44697BC11E6E204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131498, "uuid": "27347b12-6ad8-45bf-9d16-6ca83b285741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131498, "uuid": "d143c3cb-551d-42ea-b424-e18125c2bbd5", "value": "12288:+1udh9TVmdkv2ho35r/cMUoscx1z80Z9b:+1uXjmdk6ol/z8W9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131498, "uuid": "815085f1-c689-4696-9c52-da6e236a868d", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131498, "uuid": "851f4412-5dd5-4639-a418-2c6672a32fc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131498, "uuid": "aec6048c-9241-4ddc-8bc2-15c3910630bc", "value": "z13Payment_advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d95c434-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109639, "uuid": "b8332518-6397-4e65-9259-cfaeac6e8b67", "comment": "Malware payload (AgentTesla)", "value": "783bc33207042a9901218b42773a6cd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109639, "uuid": "431b5247-e4cf-4482-89c5-e991fbc36d64", "comment": "Malware payload (AgentTesla)", "value": "7ccd7d9ddd2d7fac9a00165b430c3e64b411e57fc7853c23b9938ad8df725b48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109639, "uuid": "6d95dfea-d84b-4bd2-9ad8-09498a58afd2", "comment": "Malware payload (AgentTesla)", "value": "ef802f9609520e71a73cd451080a5146dc3f04c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109639, "uuid": "001ddb2e-03be-4a7a-a1cf-9b3e8eedcc8f", "comment": "Malware payload (AgentTesla)", "value": "bd538e001990fcf08f98e238cf0d31a09c0a28691535f79289dd11ee8d1a8658f9c159ba897aae3f5ed9e5d74924e897", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109639, "uuid": "ff46ee48-4472-4acc-a105-f576c260c67d", "value": "T175C42333D05216643E73FDAD9CBA2A5B4924B655C81D87CEBC3B1E8408D1C48FDA2DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109639, "uuid": "fa8457c0-cf23-4eba-8ec8-7b7848d13099", "value": "12288:5b52nCQRvYf/N/lzeRReLk7DImXZFVzwRyVQDcboSKvJhAj:BOCAvG1/Re8k7DIA/2ReQDjJhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109639, "uuid": "a5ca7eac-f8ca-4a86-a50b-8a77bb233a2c", "value": 582830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109639, "uuid": "141c3ef0-400c-4a65-8ead-ea29f784ad2d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109639, "uuid": "19ed89ac-cdce-4c23-88fd-8df1d336b583", "value": "Inv. & SOA.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255c59e2-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109008, "uuid": "4cd66f97-c32c-4a38-b857-01452097711c", "comment": "Malware payload (AgentTesla)", "value": "617615c0a578a8b541a6cb40a52031b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109008, "uuid": "e86a3295-82bb-40a1-ade7-2e62bfa0234b", "comment": "Malware payload (AgentTesla)", "value": "7d41acea98d4d6fcf0f2b213363211dd92645ef2694fdce56e61e81db5b2ba94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109008, "uuid": "699d1a7e-526c-47c7-bcf0-ec0d7a5115e1", "comment": "Malware payload (AgentTesla)", "value": "a405279447c2589b7689051febb2d712d9e40ba4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109008, "uuid": "547a9cad-bf3d-45c1-af0e-69fb99560161", "comment": "Malware payload (AgentTesla)", "value": "7171647ba2cc34d0d11bd41649c88f510516abd600b04526ffc5f2a4a1129a29a4d21063e5063cdd57193dcd996793e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109008, "uuid": "dc98c562-5937-4165-89cf-2e3a20defe4d", "value": "T120F42838287D0B62C178C7F98ED18163F3A4953F3429EA2A5CD367DA0656F9215C362F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109008, "uuid": "cdb93d3a-de4c-4de7-b033-49f5c41e6bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109008, "uuid": "2ccd27f4-bf08-46a3-a207-ec85fc450ac0", "value": "12288:XNzyKerj3hc5Cdc/WgNJY+e6WIqfJ+9KI2iBd:XFyKerj36YK+iW+eKEJCv20d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109008, "uuid": "dc1a8938-8c75-4775-88c4-f9df21aafc88", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109008, "uuid": "59e5cc6b-044c-4f8a-b351-1c10d8bd376d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109008, "uuid": "4ac7d896-b06e-48be-a5f7-4172e3c89e5e", "value": "PO# VN 00680723 JULY - Scanned.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7d8dc4-1762-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688142173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142173, "uuid": "0a54d19c-0d42-4294-81ce-2a7a956c023b", "comment": "Malware payload (AgentTesla)", "value": "740c49df75b0e6920ff267ef3e917ed4", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142173, "uuid": "29aefb30-ce6f-430e-946f-a82887f00181", "comment": "Malware payload (AgentTesla)", "value": "7d544b59bf7b7ca12e4a1b27617caba4d020774a2d09fe3e8db9870a5a9b8943", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142173, "uuid": "1f31f204-c4e5-4613-8a77-4d3fb34393cd", "comment": "Malware payload (AgentTesla)", "value": "ddecad114655fb9551bfc83f10b0b2a367b7a542", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142173, "uuid": "1d6e8779-41c1-4f64-80d6-c6053fc6a398", "comment": "Malware payload (AgentTesla)", "value": "3d8ea68ff1ba0acd051e70fe6e99bb23e7ae05d4b57a4f3c0c54f9199b3c392011133c46ee3c1c7967d73d2495fb7aa3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142173, "uuid": "4542c9b3-9aef-49ee-92db-0d4f262b7ded", "value": "T15C25C724997E0912C074C3BDD6C1E32FAA9D4D9724209B321CC27FCE5F7AA06159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142173, "uuid": "fa9f0ad1-fbe3-4608-a884-7f98f4f22a43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142173, "uuid": "809d94a6-7c28-47f1-8412-0ecf6429d740", "value": "12288:CyBk76yZ6ECTQwySM/Ik9IGBtpntPUHXmA2lwM8z+h/Qp9:CyuLFLSM/rpUHalwqhYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142173, "uuid": "c3e8d267-e049-47da-941a-84a2ab20327f", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142173, "uuid": "53481ddc-075f-472d-9b19-01fd64aed46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142173, "uuid": "7b59ad34-8cac-4cba-aa58-12760becaeff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d3b9e4-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1688141993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141993, "uuid": "8ef86b36-6c21-4c57-ad2a-64ae30e49bef", "comment": "Malware payload (TeamBot)", "value": "f853a340905e434c326392fba6e020a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141993, "uuid": "d4ade6c3-6309-4f3a-bf77-b80d05a64ab3", "comment": "Malware payload (TeamBot)", "value": "7df44a6dee1ee8a85d4b3e569ed28059cf20613c49bb02dca62419441278072b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141993, "uuid": "041177a7-46dc-4c05-bac3-a9d4d97aec75", "comment": "Malware payload (TeamBot)", "value": "7f2289a97403d034bb6fd0bf848775a2376f2523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141993, "uuid": "64a9ea5f-07d9-4dfa-b9e6-05c641c6c4f4", "comment": "Malware payload (TeamBot)", "value": "51cc7ac427c736318a3a968eb2c7ce2001fb72e74a4a72b1f1381f8468113f226816f65af2de8d26b5e435d7b0de9b28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141993, "uuid": "f5e2d2d1-d2c2-4193-83de-b4d3610c2f32", "value": "T1FB542A0396E13EF4E53ECA72AF1FCAE8762DF5548F49776511289A2F04B80B2C663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141993, "uuid": "81e39ccf-61a0-4f55-a9a3-3f2ea1393b1e", "value": "1ff66a1ed7eed59bc0ffd84293a8bb71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141993, "uuid": "dc777c2f-8f47-4c84-8d54-3671b2cf7cf1", "value": "3072:c9oRv/wFqKfQhjx7fBnN83oM7iq3g5zyVJHM:uy4FqV3CYMmPyVJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688141993, "uuid": "b21a33ff-164c-446d-aa85-38540d2dd63b", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688141993, "uuid": "0153ccdf-5098-492a-9921-f6da8cb2234a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141993, "uuid": "29f804f1-9f58-48fe-890d-3271acc60150", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7429c31-175d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140203, "uuid": "8be2d0be-a90b-4061-91fa-f278e0c323be", "comment": "Malware payload (Mirai)", "value": "7397a3e2a16e4190b76a72dce3cd3db4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140203, "uuid": "a2e07c09-e547-4b00-bb11-fa180a09dd80", "comment": "Malware payload (Mirai)", "value": "7f5a83d4d72dae423154f76fb04b45f49e4c41bfe6788d02e81b99e241d4e7c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140203, "uuid": "4873f39f-f116-4faa-bf2f-4eba1f2c90c2", "comment": "Malware payload (Mirai)", "value": "3e75accac1d19614c23a104886dbbad6b57177b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140203, "uuid": "6b40c078-4ce0-4a12-9b82-5042b4a7325a", "comment": "Malware payload (Mirai)", "value": "5670c212b57f4918d9d01a96091ac903c25a5d57c9ce646c35e2477a8eeb366007bd2e8cd384da5650b5614b6051632f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140203, "uuid": "d1bd064c-9adc-4e1c-b2cf-f0c7709d5a73", "value": "T10AC2E1FDBDB71E4BD903113BA56CAC33C2B4E0A4E35C72862784511264032F99676ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140203, "uuid": "7e1e97c4-0616-4d18-b6d5-180f10c6044c", "value": "768:qMwaDZqFbBy6g4021ZTTq1l5eTR7aL0N+:qekX/T/Dk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140203, "uuid": "8329ce42-8a7b-46e7-8d3c-f396e0787ab0", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140203, "uuid": "b18bfc76-ebd0-456d-8780-7c5356c855d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140203, "uuid": "3878f99d-1fc7-4b89-ab95-553a816723a5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc9d5ae-1759-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688138359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688138359, "uuid": "803e3892-0e7b-4314-abfc-c303b60e1c86", "comment": "Malware payload", "value": "ead3f75f178d4e13601d86c62e314cf1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688138359, "uuid": "8e82604a-09ee-4ae4-872a-ca101c7f272e", "comment": "Malware payload", "value": "811df46a5000efbdb09dcc116fdbe34201f96379c9d0ea4a1c3d4d445fb429e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688138359, "uuid": "585e7220-9059-4289-a1d8-4f721f5e70c7", "comment": "Malware payload", "value": "fe950f50f63d02bd86db1847c9d7ee79984399f5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688138359, "uuid": "b4a9125b-12ee-48d2-880c-9a47cefed9f3", "comment": "Malware payload", "value": "85d5e4994bd8295a20feb1f61df567ea05ccba42bb37c7d7e0762982ddb05de4a0f344c378b34655aca9e6a73291d16e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688138359, "uuid": "af56610c-e0bf-43fb-8e37-ba7a6836aee2", "value": "T1B5C63382D9C3CE57E30E15AB0464BE27DD37EA3AF2154F19E2B425FB00B325D4056AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688138359, "uuid": "b0bf88e9-c878-42f3-9bc6-a9397d42b135", "value": "196608:UFPlJeCA+too7lqDVsUW6vQaKW1VevAIcCdwRx8y3Xje9WGvfPwtw08KK/1KG:UF9JLtb7YDVPYaKW1efP+txGvJl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688138359, "uuid": "f4bc8b70-f391-4e53-ab66-1f7737624546", "value": 11813309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688138359, "uuid": "ffff9031-f364-43f8-85cb-638ac78799e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688138359, "uuid": "c063c6b6-a5c7-4280-ba96-48ac7085dbd8", "value": "ead3f75f178d4e13601d86c62e314cf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce3a77f-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144078, "uuid": "2c9f17d5-83b3-41ef-8e07-fc6e977dc44f", "comment": "Malware payload", "value": "61125bf5a46dc2fab501882a0357f012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144078, "uuid": "090b9254-0627-41e4-9d25-6d0f4a164c56", "comment": "Malware payload", "value": "8124c8e53f0ce2d1de966255843760dcfa20462d381600c810c7260c1fa5f46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144078, "uuid": "3881a0a8-8683-4b94-b329-73a72e666211", "comment": "Malware payload", "value": "caf5043be996ebfdda6a87abb498c59bb6973f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144078, "uuid": "31ff33b3-2eea-4046-8ef2-1895bc9101fc", "comment": "Malware payload", "value": "685d73e61a0890b7a6661e83eb9148702577f9d368463b12f0771614a5e65b50fe6fce30b1268ee153ec525fef5d6adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144078, "uuid": "9816ad38-d3a2-49ae-a482-d55559f9b74d", "value": "T14F463317730EA4A1C698E77AC71B8090D6A1DE42FE2BD9177A0D736905323FEED42607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144078, "uuid": "d65c28d9-3095-4bc6-b90a-8599b6703130", "value": "98304:6QE+yKPQvVDzcSkhRtSD/dFBYpZ0i8H0j9BWrl7/kgv2Yc6r2:9I9Dw7FSpgpFW0Z01pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144078, "uuid": "617253b1-a732-4760-b4c0-e827f022ac65", "value": 5635584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144078, "uuid": "6a83ae9b-9d90-41c0-bfcf-8da74446856c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144078, "uuid": "2e2e2d19-b2f2-4b66-8613-a4982a299928", "value": "SecuriteInfo.com.Trojan.GenericKD.67723288.11017.17297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2da6d1-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688151026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688151026, "uuid": "94579653-7755-431e-bd49-79524fb0ee91", "comment": "Malware payload (RedLineStealer)", "value": "30246d49327ccd4f09793af5ee267b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688151026, "uuid": "ed652e84-f9ae-4f0c-b633-fd6851877b8a", "comment": "Malware payload (RedLineStealer)", "value": "812843d966c6dd2bfe033b7d45fc3e9dddd1f363f7c472014e5dfc3c699c8691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688151026, "uuid": "e28c6854-733e-4c71-be89-7b4a4d5d8e90", "comment": "Malware payload (RedLineStealer)", "value": "dbad398edd22315f33cf99802cc98ed7ad625ff0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688151026, "uuid": "0ee2578c-66ba-4e8e-8f6f-1ffb67226478", "comment": "Malware payload (RedLineStealer)", "value": "1da6b7f645b13621370f2a3cb5f507226fe537d40f1461e2da4fac664954c37d29930df26e4588ea93716088e830f5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688151026, "uuid": "0ee7e7bb-d6d8-4a06-aab0-d43f4d5122aa", "value": "T13DF40141B6D14492D7222E32A9A4C9435DBDECE05F6406633F3C53264FF62D0AEF4DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688151026, "uuid": "5bb3efe7-fb2b-4a37-915a-f11ae15ed885", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688151026, "uuid": "15fd14ac-c453-486a-88d2-063cd9a9bad3", "value": "12288:4rGSyC9hJ6UaS5MYBgAcGEUUDth4ITfsRipTVmoTMSNv+Mxt7DTdPBdBWioaQdQZ:wG6LdN5VGAEnJh/xBTMAv+Mxt7Dxg5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688151026, "uuid": "1cad1b5b-5494-4b76-9f98-8a85a4a9abc8", "value": 754496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688151026, "uuid": "c7d71828-f1e9-4aae-a154-2ab8ed64d7e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688151026, "uuid": "2eacd0d8-2774-413e-817d-42a90ac0ad10", "value": "30246d49327ccd4f09793af5ee267b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae66b7c-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109473, "uuid": "ddfbe7bd-a093-4148-8040-8b617ca21dd0", "comment": "Malware payload (AgentTesla)", "value": "e0fdade7a0f8771cf5f752676ad716d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109473, "uuid": "c13bca14-3201-4c5b-a43a-0e87a9da9b4f", "comment": "Malware payload (AgentTesla)", "value": "829710dc5a353f3825574b9ddfac77df6bdc47c9d0286c21f0a02a5d800186ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109473, "uuid": "bb7d3bc0-8865-4054-8a29-a42f5e14f9d3", "comment": "Malware payload (AgentTesla)", "value": "4119fd6a65ec53d765b3c87f7bc508f031b172db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109473, "uuid": "c037fd95-b0fa-4989-becd-968cccbbfc88", "comment": "Malware payload (AgentTesla)", "value": "5413ab55f93eaeb2123f8bacb43d7d1115a84e04f4426bea4e752f2989a33b36f97add1d054628fe05190d9f70d25b57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109473, "uuid": "1707b98f-5ceb-4ae8-ab69-242526698a4c", "value": "T16B353A993BD5DF72EA9F12FFA037461E83F1C01A9696FB8D2A88DDE425423125E4C143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109473, "uuid": "112f4569-3196-4919-a555-eff1b504c932", "value": "12288:bmnACt3RHAmn/QekK/r9qhl2h1NNN9LAKXLytvG6I0RmRu12:ipt9/QekK/r845N9kKXouV0RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109473, "uuid": "14a8ddde-2c12-47f5-a1ef-390e77e90a95", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109473, "uuid": "a4552b99-16fa-4ca2-a821-f9cea98bef81", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109473, "uuid": "92f89451-7da4-4d47-a72b-0cd85285bfad", "value": "ACP-UIC DN 2nd Jun 2023.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93efa427-1701-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688100603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100603, "uuid": "c8924318-b02e-4691-afa6-64427c07a03e", "comment": "Malware payload (Mirai)", "value": "f1fdf8b488193f82dac74235bd4440a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100603, "uuid": "5418d6cd-e0c0-4712-8224-bc3d41909121", "comment": "Malware payload (Mirai)", "value": "82c2a0083197211652ff2bae93178f180623743413db984620c9cabee7bcb9aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100603, "uuid": "fe81beb0-8c54-461e-9385-8d860e5c7933", "comment": "Malware payload (Mirai)", "value": "de9fbce8138dcd03a0142d90ea47220ad27ad531", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688100603, "uuid": "5823604d-ef2d-41df-b267-8f04b783ff86", "comment": "Malware payload (Mirai)", "value": "89f7ed5a98c628c078ab2e46a8e9cc6e55186775b3b2627ea1dfb9ddc183f4f7823ae768d8bfceff98666a0a94bb6843", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100603, "uuid": "40d9d3b0-7659-4811-80c3-5c69970a3e54", "value": "T179636CC5A553D8F8DC180A352177FB374676E53F2028FA9BE39DAB63AD42601D80729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100603, "uuid": "b80e28fc-f02c-47ef-afb0-4eb83ac82212", "value": "1536:uCaVXjxEZYluXs9xU4l/AAG+TNFKcFnDQWo8bgdXHqMqMZ5gg7Wg8ggggggggggR:7atjx0YluXs9Jo4TNFFnDQW9bgNKMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688100603, "uuid": "7a1eebd5-d068-48e2-8c2d-0e4b98204bc0", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688100603, "uuid": "47d97fa1-b19c-40ad-8c61-8c30d95efee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688100603, "uuid": "d529b3b7-2d15-40f2-84a5-e2fcb829fe39", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f658b6d-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144351, "uuid": "db51e2ec-eb16-4b01-9e6d-a78531ae5b75", "comment": "Malware payload", "value": "4e6c659a935c3bbf8201e976088cfe58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144351, "uuid": "748e0437-cc33-4976-9340-d893720751a1", "comment": "Malware payload", "value": "8381eccb9599bdb60c70025928b03688cc9ee3368e79700f353a5c76e190215a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144351, "uuid": "5a1a7415-ab4d-4070-8f09-66adbc8d8522", "comment": "Malware payload", "value": "1a54c7f6b447806b35f47e5db91f29d08b21f76d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144351, "uuid": "6a9267d0-ae23-4ab5-8d5a-b964faa6f9bc", "comment": "Malware payload", "value": "cbca6114082062751a9ccd1dafba2784a5df2fa5d57233d15fd7d9178a0714ea0221654dccda4296e80a3d26ab4ed30e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144351, "uuid": "a5c78922-7008-4a84-a23f-2fb098d3f458", "value": "T18E646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144351, "uuid": "10bd08ce-3fd2-42cf-8fe7-8c23364bc621", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144351, "uuid": "67e81a1b-b2d0-4500-9d3a-7a69225d7593", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144351, "uuid": "8bf540a1-8c16-4777-bdf9-ee1cc724286c", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144351, "uuid": "8ab67f47-d19c-48c8-a104-c75265d6af9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144351, "uuid": "fb03d715-145b-4e2a-ab6d-3da7ed9c560f", "value": "12loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d15b0b3-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150736, "uuid": "eac35207-cb80-4be2-b795-74cbf165e385", "comment": "Malware payload", "value": "e2da34cb47de3f45818a0039bf624285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150736, "uuid": "681a5ebf-51e9-4385-8716-efa7bd4a35ea", "comment": "Malware payload", "value": "8386ebd7127516e59de23ab5dbda5f16f8b73faca9c8eff0fbf76a583c9ad86a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150736, "uuid": "ee538a45-2ad7-41da-912d-8e6b23862013", "comment": "Malware payload", "value": "ebd75101d4c6d5d4bc67f0bd9636ab79e4bff646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150736, "uuid": "9ef388d7-348f-40a4-998f-69d5701bd9f7", "comment": "Malware payload", "value": "fc7e87eedd00761ef65585b799c1323978a3e5fb13acc45af9d9fdacef6609624e668549ca2e09b942e3a4db86e31a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150736, "uuid": "1a2e7f03-fe5a-46dc-9d77-a3f9aa4fbba1", "value": "T1E0D633111BFE4A72E7AD2FFAF071105446A6F991F5B1DBCD0C0C28DC910A3A0A9D6A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150736, "uuid": "7566c258-be9d-4c1a-a60c-23b6a2ed2e3a", "value": "393216:nhmrgr56fEw2Oa5jKi4m+QZga6IacjgAHI5yhvhU:nhmrgr7DOa5jKzzawYgAoou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150736, "uuid": "e1f9f636-2ae7-47d7-a4a3-403ace63e535", "value": 12874752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150736, "uuid": "2882a30e-51bf-4106-891a-9eb5b81d8970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150736, "uuid": "c7129f97-efdc-4d70-9c32-7fd5a040c76d", "value": "SecuriteInfo.com.Win64.RansomX-gen.10932.2963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd821ad9-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688154387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154387, "uuid": "bd1425bd-3749-4756-848a-a0a8aa640a3c", "comment": "Malware payload (DCRat)", "value": "9408dbf31fb6ddfe18d79a832ae2e920", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154387, "uuid": "a0d7ae1d-ca37-4fa9-884a-a28fef24809c", "comment": "Malware payload (DCRat)", "value": "851f06a5ea70130dc3f9427d37c7ad8922a1a3a853ae5711784a272b014c95d5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154387, "uuid": "8b74016d-0094-446a-abde-adb31aa3901d", "comment": "Malware payload (DCRat)", "value": "8064e5ac475345203d1f26a976a0e5b78d747472", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154387, "uuid": "df76e290-e60f-474c-9d8b-d2721f462f3b", "comment": "Malware payload (DCRat)", "value": "5972cd21cc77661b46411c5c93d5c2ead33f14bad8cc3d6537c94d18c2890bd205fb68f0a5a8a01741e512185f96dc33", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154387, "uuid": "d937e522-aa5b-4f62-98cd-54d2967d118c", "value": "T10BB6334482005279C4A98FB448D2A6478BB176B35E085BBF3F50F91A36537F3D1BA72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154387, "uuid": "b0dc1795-57b6-493e-b2de-fbbe938466bb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154387, "uuid": "72074b04-b8e4-47cc-8b59-ed41ad20d6c0", "value": "196608:AdfC44USVqHQByI3vir41nlDQjYZ/ByO72Qd2CFaGDNCpmueGcH5wN96yPmMCeKY:A044UShBysBbQmBP7Ddh4T3ngyayeM/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154387, "uuid": "4c38be19-1f45-40a0-a68d-1242e9f4f0a3", "value": 11230208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154387, "uuid": "499df266-18c5-410a-bb94-373acd867488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154387, "uuid": "934179e2-cdb7-4d6c-a2ae-62d25dce7352", "value": "SecuriteInfo.com.Win64.Malware-gen.9396.2959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666d4c0-1748-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688131048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131048, "uuid": "c4ce987b-c44c-41bb-bca6-1c6b267b6ee2", "comment": "Malware payload (AgentTesla)", "value": "ae897a07a2eeaca8e6224245de8fd76a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131048, "uuid": "d239a31d-603e-4f39-98b1-6bc077eef513", "comment": "Malware payload (AgentTesla)", "value": "85516b5e6517acd4dc26d67b6ae16d9f8373eed6e33e858c0842dc2545eaa2fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131048, "uuid": "2d7ee7d3-6742-4b42-8aba-21f37927060d", "comment": "Malware payload (AgentTesla)", "value": "734c16367c1eaa31670723cc5c09e67a44f7d0ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131048, "uuid": "ca855289-b8d3-4b7e-a644-51bc31610c31", "comment": "Malware payload (AgentTesla)", "value": "6cd0d8a8ed00a6a9ddbc4b96fc7ae55cb21fc9f11f91a1a39e5ba0d32a1cc28a7833ba6631785667bc8a6cdf4bb34878", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131048, "uuid": "1e35d8a7-8cdd-4093-b1b5-e41b5a915d7c", "value": "T16425C724997E0913C064C3BDD6C1E32FAA9D4C9724209B361CC27FCE5F7AA06159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131048, "uuid": "750e2678-7764-45ff-b059-f05ca7c418f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131048, "uuid": "5a29fdd3-016b-4ee0-b886-667c2ec9dad2", "value": "12288:GLBk76EipYyCKHeFizG40ewzuZVTi1Gc4DLOACy+S:GLupiBCAeFU0zeV+1GDmACy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131048, "uuid": "5a538de2-c137-444c-a127-188fd659466b", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131048, "uuid": "4f204729-1028-4400-8e91-2b50ce6dbe84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131048, "uuid": "eaf7b322-cc72-4f3f-85b4-8499d2b2e3ac", "value": "SALE ORDER_30062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a418f22-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135672, "uuid": "49e31293-3097-4e61-8754-25a37557113b", "comment": "Malware payload", "value": "d5c19b28c7c9487111c4bc108bda0dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135672, "uuid": "2b0d86ef-9360-45a1-922e-400451c2301b", "comment": "Malware payload", "value": "85a316697e10cef3ddc400e2ba0173c3b2a3180355762acebeabf920f2acb5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135672, "uuid": "71581e59-2ae3-48d1-9787-65562a2c9bfa", "comment": "Malware payload", "value": "3323cf81f476d8862d1b7db74bab6aec943efefe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135672, "uuid": "f710785c-60ac-4de2-bb58-42b713868182", "comment": "Malware payload", "value": "ed9eaa1854b04668caa5b05c2dff8e05ffa520d50e8c0288a3f0335f1bc44cb68a310b4dfd61650c3a132a3782a8b42c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135672, "uuid": "caad8421-1cc8-4b0b-b527-0292431dc160", "value": "T16AB633A5567108EACC65C23CD092CD30BB71FCAB07B4D68F13E446A72F63295B877A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135672, "uuid": "534f69b3-ef98-41b8-b120-3e930310ab0a", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135672, "uuid": "00e6c537-1212-4af0-b0fd-559180e1881c", "value": "196608:4fHau7axzed71ibP5FxbAQ5VwejuJDUX47dwdW0LB6FwtYPZ1hzAx:BxzKcPbxTaUX47d4iA83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135672, "uuid": "447f19ca-02d5-4760-bb35-1378d631732a", "value": 10762164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135672, "uuid": "7897f684-b38d-42ef-a861-f229a5e32d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135672, "uuid": "cdba9be1-111d-4c34-84b5-90c856838d9a", "value": "vignette.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed097a26-173d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688126523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688126523, "uuid": "915f0981-92c6-4ee0-bd63-3131195f4937", "comment": "Malware payload (Tofsee)", "value": "c5491856b9d83ee28f923b8db8ee88a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688126523, "uuid": "81ca093e-d272-4111-91b5-9252060320d5", "comment": "Malware payload (Tofsee)", "value": "85a5c8115415410e6b9f4ac3aada58bbf42c0e3df205da9457c9d7def20c00b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688126523, "uuid": "544a1a35-9166-4df7-ba8e-8bb5ad5c1c26", "comment": "Malware payload (Tofsee)", "value": "f793476586ce9a01193f46beb54f027043dc8d92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688126523, "uuid": "195f11f0-36b7-4e72-8759-e9f161f9d215", "comment": "Malware payload (Tofsee)", "value": "1950cd988262bb2fb7f6bd9d043f34cdc68d86b937cc4ef453c54489d97cdea65236f778c8848517c2039c24a7116800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688126523, "uuid": "34f26ff6-9a55-44ac-add9-98c8c1e0570e", "value": "T17A543B4392E13EF4E5364B72AF1FCAE8760DF1548F4A7B6552188A2F00BA0B2D5E3715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688126523, "uuid": "cf2d178f-95d7-4b7e-b98d-1af9c21b8d71", "value": "724f2113bd8cf2467f60e8a645acf4e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688126523, "uuid": "ee9338e8-b1f7-45ed-850f-4002a420cb48", "value": "3072:HPDP3TIg75K1sgQkNqiKYWb1BzvVHzxRaF2NtW:vD0qM8k16bxHOF2N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688126523, "uuid": "116710bf-4868-4888-a4b7-52dacd0e47e9", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688126523, "uuid": "e617be61-d62c-4bc8-a3d9-66ea0dbbd9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688126523, "uuid": "b631cd97-b796-484d-abcd-f5f58b39de64", "value": "c5491856b9d83ee28f923b8db8ee88a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d5efe5-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Phonk)", "timestamp": 1688109633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109633, "uuid": "4976a486-841a-4b6a-8643-6e1182263b3b", "comment": "Malware payload (Phonk)", "value": "d65f5542509366672c1224cc31adfbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109633, "uuid": "ea3e5923-373c-400b-9f33-7de4fbf8c623", "comment": "Malware payload (Phonk)", "value": "85c5a9b53be051fef06d1082abb950a731ffb452e68cc9aafa907251e2d6bd72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109633, "uuid": "959aad0d-bf03-482e-8f7e-a7bba70dafb2", "comment": "Malware payload (Phonk)", "value": "b23844901a5cec793cece737f3357f8c8793d542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109633, "uuid": "f21081bd-ccac-4a9a-97d6-2cbd6d4d75a6", "comment": "Malware payload (Phonk)", "value": "acd0e56c9daf26d0b7ade424d858292265ed2a69b38a4b44f71ae11f7bd50bcad418e37223371e5750796294fe3f5f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109633, "uuid": "052314ce-6684-42ef-ba85-a6a2cd485ca5", "value": "T17C1551AD7A372EBECD4E41F2C3513A895F24C4969B00D0EA165199CEBA0DD429D4FCCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109633, "uuid": "fbbbfb86-0d8a-4ef7-af9d-208352fd4ed4", "value": "12288:TDX6EUtFA+RLxx6aLm05opfN+0gr3FMWrMZXAzz77xQaoS:TbDUtm+hxx6aLo5snaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109633, "uuid": "8f095a19-dd37-4046-8c3b-965331415a12", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109633, "uuid": "a065205b-f449-4791-8068-f7dd640930aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109633, "uuid": "186fc3cb-f7bc-4487-83b0-d9c4ac5c8e68", "value": "d65f5542509366672c1224cc31adfbf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1108723c-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163090, "uuid": "b888bbd2-fdc7-41cf-b957-9c364f55e302", "comment": "Malware payload (Mirai)", "value": "cbe302b3c898824778f64551a54f1157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163090, "uuid": "e112c8a5-a13d-4b82-89ff-ae3fb851ac2c", "comment": "Malware payload (Mirai)", "value": "8800a09108bb706a377ba6a8efa94ab691a23fccddc109caadd3299cde4f888b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163090, "uuid": "cb72da9a-73fb-42f2-b131-cc0cd3fa476c", "comment": "Malware payload (Mirai)", "value": "61adee1b0adb386e642587e773b279ad550f9b1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163090, "uuid": "f4961d28-9bc7-4c68-9f11-68886c8691f7", "comment": "Malware payload (Mirai)", "value": "98242a868495e6ba828da8676dbd96c73141058bc983a0d386e1f7249da1444199a9cbef20e6fb851ec6938effbd062c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163090, "uuid": "3742e36c-b6af-4b2c-ba1c-bbae7464b94d", "value": "T1A6B2D034AF1FA920CF71083ED9B7C65693844FF881DBF73259282BE68B8605215F8652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163090, "uuid": "808419bd-bd1a-47f1-92ad-57abf9fc566f", "value": "384:QTAXG5UOnCO6KNjQP3C+wN+5wDa7IoDe7bWj2c6wtkCIhW9ARAbEFqhymdGUop5t:eA2tCO6KNLVjaZe7bMBtG7jos3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163090, "uuid": "42c72b77-43e8-409e-8133-731781a2645e", "value": 25056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163090, "uuid": "eddeab5b-ccb7-46f3-a7f3-658609ff776f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163090, "uuid": "ad202677-dc83-4226-a01a-36d302edc316", "value": "cbe302b3c898824778f64551a54f1157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442ae38d-1731-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688121085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121085, "uuid": "be799354-8728-4053-90ba-6492eedf5c1c", "comment": "Malware payload (Mirai)", "value": "6d0168581872d53058e35c6d174c9d1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121085, "uuid": "dc850f85-91ab-43bf-9902-7d8d0abcac15", "comment": "Malware payload (Mirai)", "value": "883cb44e10f976e4eb026ef911cda4c5101a2a5c3025be9196676b062921abd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121085, "uuid": "4e234dcb-ffe0-4cdc-a10a-bbd969a68970", "comment": "Malware payload (Mirai)", "value": "a87764b9e7e8f846e6e204f228a140b436d8504c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121085, "uuid": "a8af54e0-5a31-4e55-8050-d26f2743e09d", "comment": "Malware payload (Mirai)", "value": "323c394c47187799dd77d57545932af426d82647b51152769876ad2706abc5b56df68098bb6700f4f4955fbbb5093a9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121085, "uuid": "618b704c-e40a-4b2a-8944-ea59ac9a6116", "value": "T11C43382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121085, "uuid": "1e379188-6ea5-42d3-b044-3cd33b627550", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpBVA2y:BZ8GT9zOSyaf7luDBKf4H9gpJVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121085, "uuid": "d98517cc-d2f9-41ef-9ee9-9bceb8088b27", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121085, "uuid": "a48b17d6-3112-4240-8105-5fcd81e535de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121085, "uuid": "f34c15b8-45dc-420d-b628-86fa4eae1587", "value": "6d0168581872d53058e35c6d174c9d1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcc9258-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144855, "uuid": "4441a2e3-d2b5-43c1-8bd6-659682681de5", "comment": "Malware payload", "value": "72597098796f394f5e80bfa761830fd4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144855, "uuid": "3aefb986-e19d-4e53-9972-682f404095c2", "comment": "Malware payload", "value": "8874254489d3093b83f8d5ab1ccaed7613e8b30983200360084c62dc3311ec94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144855, "uuid": "1abd809e-a1ad-47f6-b5bb-36bada590e56", "comment": "Malware payload", "value": "164865cb0bc20c3ca510d55e1cb2dbbc8cc4a4c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144855, "uuid": "a31d8ccf-081f-4863-a09f-04327802b69a", "comment": "Malware payload", "value": "23cfa00d4af221307a54b9683b83b7e1c308a49e6e197118e8b8b26c41edb5059a1c0fbba6008ee0acce50a5a4ba8a18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144855, "uuid": "b4cbc3f4-483c-4011-a70f-73d22231b39f", "value": "T184646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144855, "uuid": "4792dae6-7b18-4c1e-a7d8-f6714df868d4", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144855, "uuid": "c1c66d9b-e623-4f9d-99ed-79519cdb2b33", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144855, "uuid": "f6084422-2606-4f26-a55d-d92a4e1f02c1", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144855, "uuid": "cad8f619-b582-4dc6-8946-942d2740fbcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144855, "uuid": "65d1e71e-4167-4a26-8bf6-47685dc205bb", "value": "76loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1311225-1729-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688117806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688117806, "uuid": "b4988f6a-abdb-403d-b899-b2162a70a234", "comment": "Malware payload (GCleaner)", "value": "3da1d781c5d4941823009b17a0fd6219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688117806, "uuid": "2dee1c49-a5e9-4845-bf38-7b25037eb443", "comment": "Malware payload (GCleaner)", "value": "88a1526188f551a5666d7314ffe9a7bdde4cd5f438d78aafe8883c609cefe911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688117806, "uuid": "515e1939-9986-46b8-9106-86a0d5fb59cc", "comment": "Malware payload (GCleaner)", "value": "62050a514c18c51d50397dc1bc38e178ff52fe17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688117806, "uuid": "d49921db-95f9-4264-844c-ef2ba94f8538", "comment": "Malware payload (GCleaner)", "value": "5d78c576649a15131bcd1b45ff705ca80384fdbc750b003a5cd9974bb9309eaa8b2a6ca256e3892cfaf58f5b62c3cdb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688117806, "uuid": "ac52fe53-abde-40f5-930d-2275a6facd8d", "value": "T194849E0396E03EF4E9354B32BF2FC6E8720EF6548E497B6521289E1B05B50B2D673752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688117806, "uuid": "70eb68af-f450-4e9e-a5c4-e7387352cead", "value": "fdd8fed97401c5bf665e967df246697a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688117806, "uuid": "503cbc85-38f8-4e48-bee1-4977eeb597e9", "value": "6144:RbE8ADiFCdwEIXBh3vRBsxbIDq49V6KeAHAX5PH:BymwdwEEz35o5AH8BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688117806, "uuid": "61ad1aa3-9516-4616-b5ea-27d35289f014", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688117806, "uuid": "39d2f862-97e4-4657-aba0-a3a48ef6c8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688117806, "uuid": "e1b89afd-09cf-4e54-b374-31e1b12604ce", "value": "3da1d781c5d4941823009b17a0fd6219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47eee20-1731-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688121381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121381, "uuid": "c0619f6a-9aa8-477c-bc3e-28eaa2b337d7", "comment": "Malware payload (AgentTesla)", "value": "b1cdc19c56bf45ef099686adcaffa8f2", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121381, "uuid": "2768622a-eb9d-4cf5-8b94-ec3fe9473b97", "comment": "Malware payload (AgentTesla)", "value": "88e8fbee997edebf9b423158c7e1ef4b8e7c82d7eb26c8a09cdee95afaf4de50", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121381, "uuid": "1594dcd2-6024-4882-a124-0d2620c4de61", "comment": "Malware payload (AgentTesla)", "value": "703dcbc181bf1aad38d0d99e9839ebe09178c832", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121381, "uuid": "f6805b0d-0acd-4245-92eb-6addaaef6e14", "comment": "Malware payload (AgentTesla)", "value": "6039feda3780994a3c466b1b3cc10c4e40aa014c966c3f293ba9c43ef774b187f7eaeae04cd17d094fd95ed61c4493a0", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121381, "uuid": "1943c132-00dc-4023-8ebd-a4fef78a427a", "value": "T13CC423CF76BA733E398025C85C72C0529E7C1D5AFA74C8251D66EB8170E4CC9A7E688D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121381, "uuid": "282df6dc-88b8-439a-b000-5b46694e0f36", "value": "12288:xii3R+MTw0EvzTwFrhbf7GUTY3QqWsn7MkAXUxMu//XU7Gm1:Fcmbf7GUTYfQUyu//8Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121381, "uuid": "b3a3a845-c984-4ce1-ba48-9e5e7f2d9e13", "value": 562286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121381, "uuid": "7ba75075-beb2-4e3e-a0d9-b130bb76e575", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121381, "uuid": "6f7117fa-4cd2-43f5-a992-cbc9e9eaff4e", "value": "INVOICE PAYMENT COPY pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23baceb5-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1688108146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108146, "uuid": "3f37ea53-6bc6-4c93-98f7-65f22042e54e", "comment": "Malware payload (Rhadamanthys)", "value": "45970e5aeb953867acf81b1c4e0ea648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108146, "uuid": "a2408946-8248-4bfb-bd64-8086fade5bae", "comment": "Malware payload (Rhadamanthys)", "value": "8901337ec638f63c3f53ce95234b11d50c78144d88ac226cbe2a4e54a598b4c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108146, "uuid": "9249cbdc-ecdf-4bdb-bc67-274a71645d9e", "comment": "Malware payload (Rhadamanthys)", "value": "3ac04ee201714a2c2e9065db4073329f3363400d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108146, "uuid": "498573ca-c5ea-454c-87da-2a386dbf3d4f", "comment": "Malware payload (Rhadamanthys)", "value": "9fbfd0d61bc7acafdf6e3c3e4a698a3cf6069b7c83a00a1b836e1446c6ffccff66bf8e9cc517d2b6ba6cfdc153e5475d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108146, "uuid": "1104683e-333b-4a9f-84f7-d9007119bc20", "value": "T15E8639E17509B6CFD49F5779EA57CE42A85D07F842240813EC6DB4BE7EA3C8521CAC28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108146, "uuid": "bb96a32d-a64d-4e13-8099-74f1d583ca8e", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108146, "uuid": "d049b944-5df4-446d-96c5-a0187027c040", "value": "98304:HlLudZox5Lxv5/+cwZLEBPcV+8/7NahLd8IPVYbL78SaNoAJYh/Ew6qmppXTnD4j:XJs+Z0aNoAJ1RqKjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108146, "uuid": "3cefa80d-dd75-40fc-8db4-a5b8a2084989", "value": 7876648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108146, "uuid": "8709d676-8ffe-43a9-afae-20d47befad94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108146, "uuid": "a80d47b1-e895-4f06-b560-d9a4292509a2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3beff05e-1751-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688134816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134816, "uuid": "de2178c4-480e-44c2-add0-0a6377d2ef49", "comment": "Malware payload (Stealc)", "value": "65631a8b5bd4ea52ec98fb56b0486886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134816, "uuid": "4a52b3ea-7fa7-4ec5-bff8-6ddc27931673", "comment": "Malware payload (Stealc)", "value": "8a380fa827cd51a13bb3f3d00984d69a62f3c8bb272e72d2e58d9830098e5be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134816, "uuid": "2081aab2-3ec0-49d5-81fa-fe80a61ab45f", "comment": "Malware payload (Stealc)", "value": "0f4d86cb05d4bf2243971ee06d9adbf23bade68e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134816, "uuid": "d5a0f58e-9d45-48c7-9bed-9b7c6333506b", "comment": "Malware payload (Stealc)", "value": "0e840b8964e77b1a1c9b850024b4e46cc3b0c87c0906322e20b6766a6b7704395887e132a1c85a35cb9d02c03d7bc35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134816, "uuid": "b4a6b20e-3a41-4ed2-8ef0-17b635bf5c0f", "value": "T1E63633E26FF97654C3D344F003B50140A361DB7A97366B7947FA88580BE6A207F8627E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134816, "uuid": "e38e9c09-a46a-4729-92b5-84f454600327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134816, "uuid": "77647189-d0be-44b8-b86d-64be4432be88", "value": "98304:V7+aSe8lBO2MLgJSuOeIzZt1YuwkPrOMe7RJvgc4Nowxt1YUISajRV6:xStA2MLgJjIFt1xwynYG3NPuQw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688134816, "uuid": "51f0365c-0aa7-4e97-ac70-77e23297eea1", "value": 5304832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688134816, "uuid": "3c64d1c8-bd80-4cec-806b-e9c48593c6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134816, "uuid": "7878563b-7a95-4fa9-a22f-d8cd1421f4fc", "value": "ortraining.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5f1602-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144081, "uuid": "5cd80b5a-16c0-425b-b0ec-90b2cd1ef9f9", "comment": "Malware payload", "value": "8e3be34570968d75b90f105e1263e0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144081, "uuid": "9627c022-e736-4745-80b4-c77f9f6b96ee", "comment": "Malware payload", "value": "8a79d2f7f8fdca9319776ee6a7e0dc39ea24205b8558c1fc6c1272b9b9ce17a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144081, "uuid": "3be4d313-918f-472e-94df-c3cb66dc6a74", "comment": "Malware payload", "value": "a84e48593ba4ae6fedcefce113e68d9b6f3f93eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144081, "uuid": "03a91971-41af-46a8-ab69-5d9105ce6dba", "comment": "Malware payload", "value": "c553ce5d45d26e87f52af8a169fb93f4565a955270ef04e4f9dbb3633827ccf20c92268fd236bc653bc3fd83f336d1fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144081, "uuid": "4a5dd5f6-6e6e-40f6-b3e2-433d8569c817", "value": "T1ABD63335007A3422D9B4E7F41E1D46D6B9617A22F863E6DF4B25D13E89312E48EE2733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144081, "uuid": "417f9959-b553-4b98-85cf-00872dee13ee", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144081, "uuid": "8fb648c7-868c-4bc0-8d0e-53d921211b52", "value": "393216:skZPBeyp5bra26e3XJLdUdOY/xaq2xuGXt:tPB7p5l6edAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144081, "uuid": "249baec7-08ba-4044-b863-6b72fbedfce5", "value": 13392384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144081, "uuid": "df007c20-6750-4d02-ab86-fcbe83f23d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144081, "uuid": "0dd50ee2-bda1-469f-847e-544940f0b7ad", "value": "SecuriteInfo.com.Trojan.Generic.33993151.21170.22854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba9bd8b-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144586, "uuid": "d9e2b093-377a-4dc1-bf04-58ed688f8563", "comment": "Malware payload", "value": "87bc659f2fd5504f6c2e16f8f19b7978", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144586, "uuid": "52d47a35-7295-4238-affd-30f847ff57b7", "comment": "Malware payload", "value": "8b4b993fd462a52d3c09b553bab58f58f7959c3c2c304e07604303625d3c173b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144586, "uuid": "81f819eb-b450-4ecb-90e0-7c3d2a474903", "comment": "Malware payload", "value": "fd75b99ceda0083f5f62380a698f13764f9f4e99", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144586, "uuid": "f6c896f5-4dc2-4905-b61e-516084dcede1", "comment": "Malware payload", "value": "87f3ca934ca6b3332ed02c40dff8f3e858905b26b23c7f463b3fd668e4361f27a6d9e7252b40cb195feb330179ce8806", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144586, "uuid": "c897dd3c-31b4-40ca-8196-b2fe74340347", "value": "T1A8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144586, "uuid": "18049c7b-ab15-43a6-99fa-bef227a33367", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144586, "uuid": "a118ad55-f66e-44f3-8448-01710566b660", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144586, "uuid": "0e24a98d-fdbc-4e4c-b0a9-48724d09ed90", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144586, "uuid": "dab80f98-c6c6-46f2-a153-73f4ca9d01be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144586, "uuid": "1fc1ef1c-395e-48c6-b36c-c009075273df", "value": "44loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7c4aa-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144824, "uuid": "b9b46fa9-2e88-412b-8c4a-c0aef274c215", "comment": "Malware payload", "value": "dcfba6c79c24943e45be33527ca6e9bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144824, "uuid": "042d8165-d781-4e46-8ef5-7c450b141b23", "comment": "Malware payload", "value": "8b9f4c13c4ff5b7622b1353b3ab3bbe586d3e5d14bb6e14886657f5d2dc619b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144824, "uuid": "599dc507-4f0f-4d4d-8bb2-24bfbdae1ca8", "comment": "Malware payload", "value": "03b1888da0dec114b04e8fc493be2d72568219ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144824, "uuid": "18aa426c-eed1-4dcd-9de7-11fa03ff05bc", "comment": "Malware payload", "value": "b4655d1632e0fc00bf6d7bc1f015eafc855d94b502922181d03fb3b38b8c0dcdd571a741b42b0bb85ee7e8a227b55d58", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144824, "uuid": "59b1bae6-93d2-4617-8ae3-bda05806a0f8", "value": "T192646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144824, "uuid": "4fdf9f04-da53-4d02-8add-1b6f9dd37adf", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144824, "uuid": "eff23385-3dee-4cff-8d48-c9360cb21a31", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144824, "uuid": "31d442a8-36a9-4acb-9184-5a17f4fdf411", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144824, "uuid": "9e043e13-d520-417e-bb99-c81f9c3b7bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144824, "uuid": "d94f3556-4758-4ab7-8999-535f7bb4147d", "value": "72loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adc368f-1732-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688121499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121499, "uuid": "14ee4227-ecc2-4c7a-9920-06302ab98a44", "comment": "Malware payload (AgentTesla)", "value": "330fd19c447380bba81ca5e4777f5cc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121499, "uuid": "0eec904b-5bdd-4e41-9ea5-1f3c15e8c7bf", "comment": "Malware payload (AgentTesla)", "value": "8b9f81726b668683a48e5c3617774687bab1b6735ced0afecae847d2316dc08f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121499, "uuid": "3130abeb-7e36-47d8-8f5c-7a3e87700832", "comment": "Malware payload (AgentTesla)", "value": "09ae915d9f15cec28055efb50a16114727db544f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121499, "uuid": "b6fe5903-0e5a-488c-9699-08e6a1b52aaf", "comment": "Malware payload (AgentTesla)", "value": "587bd57596a6569e28aa3ed579e307896910866e3867d574c5c75bb88fba58966fd2f4a657f6b0c06b5fbb0f25e4ee20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121499, "uuid": "f1052a36-b3ee-4c68-b3d4-57e80649aa17", "value": "T192944B0C3B8E6613E77F97B6B0628F840679CD576152D7CF298AB9E01FB63C1540A1B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121499, "uuid": "e15037f6-f1b3-4e62-a02a-9cfdc965ddcc", "value": "6144:GYZ+Y7UVm2PB6NoNP+OQjnTggEHGtx4bazCSOd0WPXokAg:GYZ26NoNWOQjkG2azCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121499, "uuid": "ca6c3631-ddc4-4769-9268-51e4c27853d7", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121499, "uuid": "e65cbf0c-01af-41cb-99e2-cc81dad045d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121499, "uuid": "42b3adf5-bcfb-4286-9673-43d352a6589a", "value": "Proforma Invoice_0796823pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a891f2f-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144396, "uuid": "5937b56d-640d-4b68-b6a1-cfa724245e0c", "comment": "Malware payload", "value": "51a47673efb28013f20f9d1c0d56f64e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144396, "uuid": "3efab521-2c07-4222-aa9a-3e76b95790da", "comment": "Malware payload", "value": "8bf13230d7d6f0a477c5cb3a16a243109506d10ea85e617fe497cb8608e6067e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144396, "uuid": "19250ca2-0c72-4ed2-ba98-b0fe98299c93", "comment": "Malware payload", "value": "cd9fb5047b8c54458702b85818170f5001a8c757", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144396, "uuid": "a3d83d93-1b06-4e47-a74f-3e62a7acbc64", "comment": "Malware payload", "value": "623973f8c4bbc5ade9263958c974e9b566d39714af5c99b3d134227c2bf4bf8ef2b373e7dc1f941474e3c2f86271dcd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144396, "uuid": "ab98a91f-4b8f-456d-b4e2-69481ba5e6ba", "value": "T1F1646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144396, "uuid": "b8f286f0-fff8-40aa-931e-1840a5480da3", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144396, "uuid": "772c1608-bf4c-453d-b438-df2d110d89ce", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144396, "uuid": "81c6c45d-4419-451a-b2f2-3fb68fbec67e", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144396, "uuid": "143cc05b-1c1f-4cbd-8ebb-ecf33b5ddb0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144396, "uuid": "e031f907-3933-43ad-844a-8b8e37497645", "value": "19loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe636e0-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1688135889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135889, "uuid": "d49eb1a9-6583-4d3f-afce-e299963873b3", "comment": "Malware payload (Cobalt Strike)", "value": "88ab0a73a7d5f2728d69a10a3e2499c6", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135889, "uuid": "db198681-901a-4eef-9d1c-54be9d01c07c", "comment": "Malware payload (Cobalt Strike)", "value": "8c48f2cb31f934bd88fa7755cc61da8ea9a824fd851a1fcde45511f2be46e9bb", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135889, "uuid": "9ab01682-c8fd-465c-9e1b-da9b80b04b30", "comment": "Malware payload (Cobalt Strike)", "value": "297ac7667bbdeee63c30a27a0bc7e5bcad69dad1", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135889, "uuid": "b303218d-34c3-4152-a3d3-07f663778138", "comment": "Malware payload (Cobalt Strike)", "value": "2aebc3e68e8d67c12cc011bd3a5d0fd6cf95cc45ce64f5bb5ecec461a762173dfed256ae9bf5d2f05c891acd4b37ecb7", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135889, "uuid": "910938fb-6bb0-4c4e-afda-cf056f348634", "value": "T1B1A5D90BFBB611D1E5BAC13C9553222AFC7138A5833897D79285AE0A1771BE4ED3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135889, "uuid": "ff7c2245-ee6d-4e5d-9b63-82a3ad27e642", "value": "be988ec726a04c53537469ace6592ef0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135889, "uuid": "94789081-0bdd-49e9-850b-dc5aa724e959", "value": "24576:jpHi5vsYQQoGr9EyU+DbLSXf3uULUtmCjvp:jV+Q69EyU+zsf3ZUbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135889, "uuid": "dd8073eb-2003-4506-9c4f-60015b8d5c4f", "value": 2096128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135889, "uuid": "f6b5e2fa-2157-4543-8ebf-9097c3d2fee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135889, "uuid": "2740877a-4eee-42de-989c-53b9b2ba244c", "value": "talking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babbc8bd-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688109688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109688, "uuid": "c78b38b3-3afe-4b8e-80d2-5a9416c926e0", "comment": "Malware payload (Smoke Loader)", "value": "1b1585b75da5b080a1bd0b95014a0f4c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109688, "uuid": "82cf31e4-5b9a-4951-811a-f256a0ecbc78", "comment": "Malware payload (Smoke Loader)", "value": "8d2638cc317a553b409601c6b8c34d6a7a6c0cfe9f470812978560d47bede0e8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109688, "uuid": "19e3c985-7028-4697-96a8-50dfb3bdb44c", "comment": "Malware payload (Smoke Loader)", "value": "e215cc1c758b667a803b617ba5c1c99063d7d620", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109688, "uuid": "fc198e5c-6948-4f81-9bd6-64db8d726894", "comment": "Malware payload (Smoke Loader)", "value": "c9d3dbc2b41e2b58f006282b8aeaf28c57b6ff02daa1dee0a824a8410e60d9b8bbd6bfa81262f98f52a731c5473de85a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109688, "uuid": "f770348a-2634-46a3-bcb9-48dc660d9ffa", "value": "T16A543A0386E17EF4ED364B72AF1FCAE87A0DF2548F49776522088A2F44B8176E563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109688, "uuid": "358e7c91-0c16-4495-aaad-704d55bdd61b", "value": "fdd8fed97401c5bf665e967df246697a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109688, "uuid": "d8ef497a-4dac-4619-a25b-815559dc4526", "value": "6144:BSkM314SETRX2mPKR3W2waMqfe+XwQZi:4kMF4ZRXlPKRmnqbX9Zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109688, "uuid": "482d7360-05a3-4c68-8fc8-c3c1f42a9958", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109688, "uuid": "92dd8f16-85d5-488e-8782-d547f6ad9a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109688, "uuid": "1c2f7e38-b66c-4b18-97b5-9ccc5e49eed2", "value": "1b1585b75da5b080a1bd0b95014a0f4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c382cf23-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688109273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109273, "uuid": "af230e4d-d8fe-40a5-9662-b9ff6085c056", "comment": "Malware payload (DarkTortilla)", "value": "f6d1fe298909420346199684c4b5a455", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109273, "uuid": "8fcd1a47-e77c-498c-a6a8-29230219c647", "comment": "Malware payload (DarkTortilla)", "value": "8d2bc8b215b2e9e25600bd55fcd1652bb884926e08ecabf1192fc3fcb0c3ae20", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109273, "uuid": "240070eb-af28-43b9-8c48-af261bdefc62", "comment": "Malware payload (DarkTortilla)", "value": "765adafd25a913738901f26de9c48f0beac81ea9", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109273, "uuid": "fc338433-db44-40b5-a191-2f1e0a8d3e9a", "comment": "Malware payload (DarkTortilla)", "value": "23102a868b7cd06833cba657bc548c0077d89de5b9a73d47965465e919249bb7266d43729563b2631dacb28e07ba34fd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109273, "uuid": "3f293d39-71cf-44a9-a3e0-7e20abee62e1", "value": "T186B4122B7BA16F75E04C0CB3CA57A28413F58A67E47AF76B28CC35F4C82BDC95196424", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109273, "uuid": "ce380ad4-98a7-4dbd-b155-363b7ad0cd3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109273, "uuid": "b4914ddb-0d3c-4d08-a28e-4f35999ed640", "value": "12288:uqtlu96FG24mhC7K+PGacM4oscx1z80Z9v:SBQC7K+Oan8W9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109273, "uuid": "3d529781-4a51-4eea-9dcf-f59c12c1fb7c", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109273, "uuid": "ae6b61bd-9ecf-49bc-a9d9-9e9f032218db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109273, "uuid": "496a278f-9e1f-4e30-9157-3c3da9b0a1f8", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2965173-174d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688133297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133297, "uuid": "2334c800-a36e-432f-8974-0d882f2c185a", "comment": "Malware payload (Mirai)", "value": "91438d82bbc363d1286afc0c2fbdcbac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133297, "uuid": "0c7bbf3f-542b-4521-80a7-fb17f56205fe", "comment": "Malware payload (Mirai)", "value": "8e55050dd84bfce59434a0e10a45b3d89c97c335d5ce11c6376a2968bffb9ec8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133297, "uuid": "305f86aa-8935-43c2-934a-ad0f6b3ca589", "comment": "Malware payload (Mirai)", "value": "c6ab06eb1ab307710a9201dfb5a4d2df6f4716bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133297, "uuid": "81f54daa-0784-405d-92d0-9592b89d1917", "comment": "Malware payload (Mirai)", "value": "41ff90b548b9677bcd7056a117d998487b67503064c81394e5233fe1e243ec22cc54f148e18b16ae402f57d69cc33495", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133297, "uuid": "33fa0b42-a258-4ea9-9c1e-3b7cd6e27f90", "value": "T13983C71A6E55CF7CF786863547B6CE229A4C33C73BA1DA46E15CC6012E7064E340BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133297, "uuid": "5fb6a38c-8e8d-4a98-bef1-67341bdaf387", "value": "1536:BpiOrv+b7x+riGW1w2VmzAGMM4PbDctLcX2x7iY/lWQnV:uE2btmZ6lPPUcX2x7iY9WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133297, "uuid": "dd784785-40c8-482a-b3da-0a50e3dfe72b", "value": 85568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133297, "uuid": "72bad236-9db4-4151-9625-06b6e2d0a3bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133297, "uuid": "44dd39c9-f878-4daf-a2d5-575a19924483", "value": "91438d82bbc363d1286afc0c2fbdcbac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6baa1ef-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144551, "uuid": "bdd13448-276b-450d-bfe4-7417b2fdb24a", "comment": "Malware payload", "value": "1426fc9e26717b9d4ad3972e4995cf91", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144551, "uuid": "19176b24-6174-43b6-8551-ae5a15b0bc4c", "comment": "Malware payload", "value": "8e59b7278e3774daf5c66ed4faa0a6433cbc9183812c53df646b62ec57cf2e6b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144551, "uuid": "58d9aed6-5c9e-4612-9e3d-faaaa8175f69", "comment": "Malware payload", "value": "0c21d7d04cf5e69c0592793b6d16a6abf455553a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144551, "uuid": "1d1059ca-0dad-4b59-a178-efc8393e11cc", "comment": "Malware payload", "value": "88c1f227f851eeac8a3b791d5a80f00269a7f31150a3ee65fc0145085ff9403a354fd66e3aae2e3c891ed6aa8ebe1adc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144551, "uuid": "5a514f5c-4736-4dc1-9992-d9b96a00e0a8", "value": "T1CF646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144551, "uuid": "3eca1013-73f5-4f7f-be3b-67cbabf48704", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144551, "uuid": "9ee62483-e097-4c42-bf63-01a639b0b3a2", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144551, "uuid": "411ec12b-a87b-4d7a-9f62-c011077f7349", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144551, "uuid": "fa292185-1a8b-42b6-a50a-fce892b5e951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144551, "uuid": "eec1827d-d3fa-4154-9cfc-5eda90cba909", "value": "3loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85526ec7-174c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132791, "uuid": "56371a5f-4d63-4e04-845a-13586b137e13", "comment": "Malware payload (Mirai)", "value": "4472b368a61125a3ac8a580bcfbd58bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132791, "uuid": "d457d61d-8049-4897-9d3a-be844afd6a75", "comment": "Malware payload (Mirai)", "value": "8f5a95e62636a5bc938aee48c9e7c0a4f5684a8959029629eb5f25d0616a3cd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132791, "uuid": "7353cd1f-67b9-4561-a28e-bcb352e38f15", "comment": "Malware payload (Mirai)", "value": "52e19f61c119624cd63b03eaac4dee1aa33d7b07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132791, "uuid": "d4d35d86-3ebe-4532-b5d6-b464bcc85549", "comment": "Malware payload (Mirai)", "value": "226fc23b7c4d2b189e7e0f0eae61ac702405ea65d889c355b12c568265175d7f98809a6a4a1534a0b94423be0ac5e2ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132791, "uuid": "58b8b3ec-c728-4a6e-b0d6-3866e6e34e53", "value": "T151637D79E01AFA94C4854134B8E5CE781F53B08983B72DBB9FD142B618479B8F908FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132791, "uuid": "605ded40-d033-4659-a395-706c99fd7fa1", "value": "1536:3anguwtXYex/lVCLtQmQaBDdWxG0n9t4G4:3NuI9VCLtCayGk9t45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132791, "uuid": "857718c5-0612-4464-8860-8d94f678739c", "value": 69260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132791, "uuid": "0db0c6ac-1ee1-4bc3-bf0b-00ca6ad369b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132791, "uuid": "bc789846-bb41-4eee-9694-af1fac4f1278", "value": "4472b368a61125a3ac8a580bcfbd58bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e0b5d8-16d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688083239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083239, "uuid": "f9f5bdeb-eaa4-4955-9498-92970f739a7a", "comment": "Malware payload (Stealc)", "value": "aad4e93ed8ac18154f9336fb60ba6e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083239, "uuid": "344a9af4-5a66-4764-a05d-0bcf45f075b5", "comment": "Malware payload (Stealc)", "value": "8f5fe05071f727d898072268357c3898232d1e67ed1df92f68cfbe83c5c740e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083239, "uuid": "7cb7a619-cee3-41af-82ca-e3d7f47b7a37", "comment": "Malware payload (Stealc)", "value": "dd1070bd2ffc33eef5227a605c4223b6c7aab69d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688083239, "uuid": "4ee64c01-4791-4824-8c2b-47c21a423eac", "comment": "Malware payload (Stealc)", "value": "b028ec31b8f345fe0fcf72383c7141d4d6e2586eae2bbc46aee8b5d850ece633a132eeafb48101648481d083fea6add0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083239, "uuid": "42da30ad-2110-48b8-aeb4-eda6760571b9", "value": "T1E5E68D70FA44121ADE8313BBAC6253926B7CDD1153021268EAAE039D5B474DCD37EB7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083239, "uuid": "3dd258c8-357d-4bba-ac3f-7989f4e8f6e6", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083239, "uuid": "5262b68f-7ab1-4ac2-91b4-728a97bcc654", "value": "98304:EsYL2991YnADbfnLTccGEE7kc7EFnGQYy+9r:fY2991OIDtQIc7EFGQYNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688083239, "uuid": "4bccd64c-8e62-422d-9335-53a668531f24", "value": 13926957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688083239, "uuid": "e78a75d9-653a-4535-9d2c-14dcde76ce6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688083239, "uuid": "271fa366-a23d-4dcc-8991-3b3c87f775bd", "value": "aad4e93ed8ac18154f9336fb60ba6e9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3864e37c-170c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688105174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105174, "uuid": "2f6c9d7f-8993-4adf-a25c-4dd1b649f5dd", "comment": "Malware payload (AveMariaRAT)", "value": "c81b8de84fed6d100b2e258933070dbb", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105174, "uuid": "dd47976f-7c57-4498-ba03-e50a4526285c", "comment": "Malware payload (AveMariaRAT)", "value": "8fefbc16f996feb000bec4abd37516cded8828a67ff7fabd13cf22be048c65f6", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105174, "uuid": "25aab74b-65f6-4973-8860-cf0f4dcda2d6", "comment": "Malware payload (AveMariaRAT)", "value": "99ac045267c33f6c499b8728fa06903d6ea56dda", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105174, "uuid": "4f7422bd-5126-4ee2-b8c4-fc2f59cf5798", "comment": "Malware payload (AveMariaRAT)", "value": "0c4c89940f881420793cbbc2ba62d0b679717d38c96eed0071c3a946c5ae3ecb504d6e4ceeaff79f52b7addf56529a20", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105174, "uuid": "e0180355-5e1a-4f41-908e-742ec277e6e7", "value": "T18EB4330C4FFABB79FB54606ACAF3A93B9E1B34D27C5243DA1D6AB0541241C7B1A351C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105174, "uuid": "3b817d57-7e4a-4111-bb6c-32dfd39d1da2", "value": "12288:XJfYdiiVo9pr1EP6vV8URVN5hKCHuM5qmz/Gi5GCYTUXveuruooc1:XJfHvHZE0FN5d5BzuAkUXG0oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105174, "uuid": "e3c9d9d0-7e5e-4f88-8694-b462650ffad6", "value": 510804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105174, "uuid": "e774c714-1935-4b69-b18a-f940f99fdeeb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105174, "uuid": "fd17aea3-c0f0-477b-8e5f-4e5688235931", "value": "PaymentXCopyXPDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c8ed01-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169267, "uuid": "84b8d3f2-9ce2-4b17-8776-7b1ff9e8b766", "comment": "Malware payload", "value": "8af1f6e0fd2ae06aba85eed1311abea3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169267, "uuid": "15841252-8c9c-42f0-bb5c-51f622ec9eff", "comment": "Malware payload", "value": "916f6217c7a9e6dd1c988379e2066e1e27aeb69825e3351356474dcb152f7ca6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169267, "uuid": "f6596b71-c41c-4dae-8f20-79d601afe80e", "comment": "Malware payload", "value": "564750508e42ec3f8a6d0477f63b525ecdcb7307", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169267, "uuid": "d929983d-5f90-4f23-8092-85a590854915", "comment": "Malware payload", "value": "80354d3333d424c1e2503cc51d4b329da55789d16ee52d2a3a8d2a2a32aed70cbc8346f6c9a7b4c0beb58572060ef931", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169267, "uuid": "bdee70e5-145c-438c-954c-78602a62e2ff", "value": "T17F04C716AF610FBBDCAFDD3706E9070139CCA41722A53B393674D928F54A54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169267, "uuid": "427c174d-6dda-48b8-9241-5038c33dc204", "value": "1536:gEGfsAkHtPnyj/FF0eNB+flcreGPPyQEPO/4ltZ9qBhAB1Forjjq3iLS2ORxSKpk:gEGfFkNUNNaQEo4jLqju31rNp46y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169267, "uuid": "3dd1f8ed-4f59-47b9-b392-39fb004b73da", "value": 173880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169267, "uuid": "52177333-8109-46ad-b84e-dde65af8ad85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169267, "uuid": "e4e44fc7-70a2-40f2-9ba3-1c2141553847", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04381dae-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144600, "uuid": "bf7e4333-f8bc-4845-91cd-56c1c5ed0337", "comment": "Malware payload", "value": "8586f6b01a808d32776517d2358d259c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144600, "uuid": "3dea3264-a9a0-47d8-bcde-d790e18659fc", "comment": "Malware payload", "value": "927ab70f891b4dfaef2f78d397e22c63b131fd8f697657ac4cf11402a6083884", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144600, "uuid": "1740ea97-f621-46b0-b7fa-3651cfeb3fee", "comment": "Malware payload", "value": "7e80cfda25a48b951a360661eaac2e3dc6709bbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144600, "uuid": "61c34f27-f215-4174-aa12-b4d59c7661bd", "comment": "Malware payload", "value": "c8951b240ab441ac4a85ecd9a93d13e9229c38cd1e6fc90e253d3562d8eb101e7ce7895958e37d3fe8530925618332c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144600, "uuid": "8764b246-9fd6-4f9c-9d35-78fbf4e6e54d", "value": "T16E646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144600, "uuid": "95516b43-5eb5-4667-ab99-dd3c6eb92575", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144600, "uuid": "d1af38ef-a8df-492d-96a1-8563f1457c5e", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144600, "uuid": "9e8e2543-a2f7-45db-bec8-bcef78a23ab2", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144600, "uuid": "ec281ba9-9c02-486f-bffc-dba2765be3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144600, "uuid": "9f76f46f-82f9-4492-a25f-4102db658bb5", "value": "46loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83906c4-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688109227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109227, "uuid": "59076ce9-cdc5-4ea0-9950-4c20a2c743e2", "comment": "Malware payload (RedLineStealer)", "value": "427b312de3f129625f3b83d99b6d4e5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109227, "uuid": "c1fb7b92-1320-4e4c-b21f-87149c5d5889", "comment": "Malware payload (RedLineStealer)", "value": "92b28daef76894d7bd55535c8eda41a654cf396bd555eb6001864828feac6ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109227, "uuid": "e73ae7e0-72a6-4d4f-a1f7-b3cf0d8491b5", "comment": "Malware payload (RedLineStealer)", "value": "04783297cd0c1a30bd6c2b3d54e59514e7b1fb52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109227, "uuid": "7f04b312-225a-4379-a457-adf7686780df", "comment": "Malware payload (RedLineStealer)", "value": "7eaf2bb4254e9b8594a782d2fd6887716c04b0a418bc904daadda9bca516dee4b3fa0bd51be56b32bd095778305b0ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109227, "uuid": "6a11ece1-3dd8-430d-bfa6-18c3a929a848", "value": "T1A7849D13929C7F61E5E54A7E8E3EF5EC760DBA608E19776A12386A2F09711F3C172700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109227, "uuid": "47d9d320-e582-4893-ad49-dde9acccdf0a", "value": "7df7cd62d521a0373722870d17467bbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109227, "uuid": "a306ac0d-393d-4f37-90ad-a7b6f30ed201", "value": "6144:SySLV3xqCwdSOLjIdpLeBdUbxles1T7ddCA4Z3zz:qLV3xNSL8pL5bxlzV3CjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109227, "uuid": "9a8b6627-0e0a-4767-886e-55478dd3a8de", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109227, "uuid": "49caaf72-215c-434b-91b5-e6b94209fa20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109227, "uuid": "540274e0-14c3-47ca-ba92-794cdadafff4", "value": "427b312de3f129625f3b83d99b6d4e5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d229ba2-1723-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688115007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115007, "uuid": "9b5790c7-0f00-4c9a-a874-7b5d3be574d0", "comment": "Malware payload (Mirai)", "value": "90cea7da6aa335982a7a1ecbcfd97634", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115007, "uuid": "d350a7cf-d470-4697-a83b-9e43e4430eb1", "comment": "Malware payload (Mirai)", "value": "93741b89c456f85ee5dc30eafcd320d0fae0579f29b93b479d01d9b9d9557c39", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115007, "uuid": "8be0e91a-bcf7-4706-9c5e-387959a09a32", "comment": "Malware payload (Mirai)", "value": "76c9960a7893153e7866a652c052fbb397cf0a76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115007, "uuid": "9dc0e64d-2e86-4b4b-b0fc-e0e4bd4399cf", "comment": "Malware payload (Mirai)", "value": "c6191905e7bc102181261b93c8ee3e9cd663b8ce4377b508490090dabb7e3e9bc98ae963018e2f18d242b0e884ddebf1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115007, "uuid": "c891e646-d77c-4234-b92c-953856688750", "value": "T1B7431854BC929A22C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115007, "uuid": "88b3a345-f4cb-4794-b5a9-d7f1d879e6f0", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5s71:wXYWyCc90TIQp2xyR671", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688115007, "uuid": "0a953a79-4d2f-4764-81c3-030625f9937b", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688115007, "uuid": "56f98adb-bb0c-4e81-aa0d-93d4c1c97f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115007, "uuid": "cbf7aa9c-7f47-47b9-a5db-bec771cf57b5", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf7709f-176b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688146308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146308, "uuid": "bec6a81e-683f-4456-a0cf-b9f80fc1f7b2", "comment": "Malware payload", "value": "d8a991d2905775a9e1ad475cdc2b966d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146308, "uuid": "a34229e3-0add-407a-83f3-f4eb369d63e1", "comment": "Malware payload", "value": "93aa960ef1fe1699cec3f34978c77262d7e4f37f4741d1e2ab5f4ad3eb819042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146308, "uuid": "c895b74f-ca1f-4655-ab10-a1d8dec44102", "comment": "Malware payload", "value": "7024f2ab052bd6e8d5a843876146785cdcb7f79d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146308, "uuid": "933b2ea4-422f-4be7-b3f3-1fb1132f06d4", "comment": "Malware payload", "value": "a1c8b60915cbf87dbd64a942e23b26f1c597ce6632b350ecfacc9c090124e0f227201676c4870e642eb61e9953a3a234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146308, "uuid": "76c70615-0313-4517-8c3d-1a8110d9348f", "value": "T19E83A40E7E218FADF6A9833047F38A21975933E523E0D685E2ACD5111E7034D585FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146308, "uuid": "5cfcd9e4-7dfa-43bb-a067-4aad818c86da", "value": "1536:ehATejxdj002yOr09xr5ndropAe3Omztw8TWW/X+kf:ehK20lC5ndrop+8iW/XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688146308, "uuid": "ecd2c3f5-470d-4497-8d17-8749fe9d25b0", "value": 88680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688146308, "uuid": "d082fe12-c12a-4e82-a711-37b40aaf2a9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146308, "uuid": "dacade2f-e101-4e3e-aa07-5f9662428e1b", "value": "d8a991d2905775a9e1ad475cdc2b966d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083662c7-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144607, "uuid": "748a8fad-58dc-47c3-8066-e5f77c4b81ed", "comment": "Malware payload", "value": "08e2995baedac5efb2678b4982480065", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144607, "uuid": "b6aecf75-f16e-452e-b61c-ed66fee6b10a", "comment": "Malware payload", "value": "95223a6075eb87a5f35affbf327c52a3d1c7ec6fc59c0ce7b28b89c978531c80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144607, "uuid": "33cda00d-aba7-4cf6-a5dc-e4152752ffda", "comment": "Malware payload", "value": "66a0897d9a8ba112660edf968643ba85920a9eab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144607, "uuid": "5ec4ff05-4b1a-478a-82ed-ffd7771d57b1", "comment": "Malware payload", "value": "e48b2ceb35106d2eff8fe6dcd7769636e72713a8ce9a29c17ea9ee2e03b3cbc0f858cb1957f97d0aae26e90311bf8841", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144607, "uuid": "ea1a827a-7e14-4699-983c-9636616ec2b1", "value": "T1A8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144607, "uuid": "a7657102-963f-4a47-bb23-940dabfe549d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144607, "uuid": "d06d9add-f156-4daf-ad19-92f4529206ef", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144607, "uuid": "46cc7b70-c31d-4323-b6ef-3dcd0a09c5e0", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144607, "uuid": "41869bdb-6632-4969-b074-a9314a1c3981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144607, "uuid": "e5da09fc-a36c-47ef-8b63-8f9d76b09d8c", "value": "47loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d538c32e-1781-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688155689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155689, "uuid": "7e60ab67-4e03-4d1a-afc0-ebc2ceec7ec0", "comment": "Malware payload", "value": "c3111eae66122e988111a15b2f7aedb7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155689, "uuid": "b8e9211d-30d6-4732-b1e8-2fc3ea1e3744", "comment": "Malware payload", "value": "95484be90e6c8e2d835eb078536314c90ff09ba99a97ef0757f7e19d2f196cce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155689, "uuid": "9f8e6767-7612-408b-b6a3-b654598207c8", "comment": "Malware payload", "value": "e469b0f965c4be361d35cb401de7a8cea4e7dd76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688155689, "uuid": "82ab12d7-d9c9-4c9e-ab9c-abf62dd8d67b", "comment": "Malware payload", "value": "45230aa3110a467188d7dd547569c80f125ae06f9360cafa4570282a2159fcd8759d97d968c7950e3670563fc2b883b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155689, "uuid": "8c8253ac-89df-4614-8a3b-4d7bbe376916", "value": "T175D2D0EAF2C7D4F0D5F594B8505C10C0F868329A9B2083FF089A62BD88637DA1639F61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155689, "uuid": "39a30b4e-5fba-422a-ba5b-1be148469efd", "value": "768:TYSoXdJZtUjkFfNJlVrQeHvPx2csGHEoESx0sr:TYJdJZGjkFV35/McrH/tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688155689, "uuid": "d227149f-265a-42d2-8163-9fd9d2c4ef54", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688155689, "uuid": "e162dfcc-d53c-470e-bcf6-b93fe8e6e7f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688155689, "uuid": "e7dd65ed-731c-4a59-9f3b-c96773cd27a4", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b135406f-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159494, "uuid": "9a46a27d-997b-47d3-b6bd-6cf46fcf21d2", "comment": "Malware payload (Mirai)", "value": "efc2d2bbe77cfdfd3602fde1903f133c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159494, "uuid": "1515a6ee-4cdf-4f59-a935-c378d64c316d", "comment": "Malware payload (Mirai)", "value": "960182b1ae05def09f443f030449ee250dc7a80cf38ae68f086dea03e08b5643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159494, "uuid": "bf3fcf36-fa66-473a-9479-d5474d908727", "comment": "Malware payload (Mirai)", "value": "56698cd4ee4ccf2f278c3554f0eeb7bb830c0d28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159494, "uuid": "2612ea34-8c3c-4607-bbcc-5991a2efd967", "comment": "Malware payload (Mirai)", "value": "4015e3823183f688e9e9fc8ebc9234c58735679382b5c21e750c39f51b3deec6225695a6499eef3162a1345b098f2ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159494, "uuid": "89ea14eb-c5cf-4d8b-bc70-589a4bf381b9", "value": "T14B539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159494, "uuid": "a55a8734-b7d0-43e1-8b63-db71b87d273f", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159494, "uuid": "2243360a-ad36-4c4e-9232-8b6c89ed9d46", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159494, "uuid": "ccf003ed-2e51-4bc7-8953-087ca61fb7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159494, "uuid": "91845cf3-0f13-4bc1-a176-0ae910df9e24", "value": "efc2d2bbe77cfdfd3602fde1903f133c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34282d9-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688109649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109649, "uuid": "6eb71011-02ce-4710-a6c0-b21fd3dbcbfe", "comment": "Malware payload (AgentTesla)", "value": "be042f209b58598fe1e6a1dd0069338f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109649, "uuid": "13052056-b4b7-4b5e-b5a2-a2295e17f03d", "comment": "Malware payload (AgentTesla)", "value": "9618f331b2bbad7bbb947cedaad7dd744169318cb11212e05089c6f4b8983400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109649, "uuid": "f6a0037d-3f12-4d6f-a1d2-ee0dceb61392", "comment": "Malware payload (AgentTesla)", "value": "e65ada8af54201b0251f105d56acd200ef1f6adc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109649, "uuid": "93846808-bebf-48ff-95ce-c2adf0852f0f", "comment": "Malware payload (AgentTesla)", "value": "eab2fbeb6d67e6bd5d0af96a2f80171dd7a0f3803b71eb46774e446ff2cd263dd409a3e5cef2104b1dfdd5983910e4cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109649, "uuid": "e9b050a2-78e6-47e6-ab5b-a8b74d465e6a", "value": "T1F61562BD294032A7947D9552C2520B4AF23B6C2FB2134D6B2ED617C1862E41E7BEDC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109649, "uuid": "640f641d-6c32-4c71-8568-1cee5a548581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109649, "uuid": "b2c12812-46d0-41ca-af62-6ab674de52c4", "value": "12288:0n7hgpSrh2uh87xM2dnn4TktJXCTDW01RYcOrsj0T55C:CmAt2h7lx4TktJXoYcOrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109649, "uuid": "e0a9509e-8960-4624-b005-345b30c4fcb0", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109649, "uuid": "3f42bec6-1b35-4b72-8bfe-57bfddc8d16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109649, "uuid": "871626ac-735c-4fa3-b0a5-54e1d76560b2", "value": "Inv. & SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e298268-1714-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688108674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108674, "uuid": "9b51fcad-aa79-4e0a-8a0d-178a3258c15e", "comment": "Malware payload (RedLineStealer)", "value": "600869ca11d3c2988c1bef7ae7dc1af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108674, "uuid": "2d9d8ff9-e012-406e-af7d-857862fc2bdc", "comment": "Malware payload (RedLineStealer)", "value": "966dd595fc018c22a4b99f77066d8eb60aee0af02504bb7f915457c7b2726157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108674, "uuid": "94ddecbb-e319-4256-9eaf-81815eaa6058", "comment": "Malware payload (RedLineStealer)", "value": "ec7c3c62c1c5e1272de0f99acd7f1906374b3a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108674, "uuid": "f1b16c46-1a43-45ce-8f9c-627b7a04158b", "comment": "Malware payload (RedLineStealer)", "value": "627ed62d36ffbf82b24ba9348aa6642281e5cce13cba2ad6b054f4a782970d24f30bc001c1f029d8dd084ad55362c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108674, "uuid": "0048680a-76e8-4ead-86e3-a24b281f2e84", "value": "T197151221B690C572D9B7923140E6CD68AE3871755BE8C1CB7ADC27B66E103E1B3371CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108674, "uuid": "1253e66c-80bb-4971-b09e-5c1f09c5fe76", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108674, "uuid": "f8de4db3-b095-4cba-8067-925c77451822", "value": "24576:ik70TrcD00Cqn22LLJUj+MoIAGAT2ysplxVw8z6/P8:ikQTAD00H2MdUKqAzyVHz8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108674, "uuid": "56a178b0-f41f-406b-9276-c9a6e231b736", "value": 918080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108674, "uuid": "9ffdc19a-7836-4598-9feb-96df405acda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108674, "uuid": "14ba4d52-ad1d-4fd9-af9d-3681c835f202", "value": "433713_Quotation,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a354d7a-1734-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688122411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122411, "uuid": "e1a4d334-991f-48e6-b48f-b52dd22671e2", "comment": "Malware payload (AgentTesla)", "value": "6ee086e9b7086ae426d912fd541c1cfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122411, "uuid": "5d357ea5-d71d-4af6-9d59-7252efec99da", "comment": "Malware payload (AgentTesla)", "value": "971af8d67cb7f2a81fcd15f2a50f66251355411499a56a2d92bccbd7839d67ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122411, "uuid": "e520e51a-163b-4eef-af98-eaddde1f6a61", "comment": "Malware payload (AgentTesla)", "value": "bed954ac8abf01e2c325058730e9299f08a49f84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122411, "uuid": "bfba66c5-2548-4e79-9f14-2f41183873ee", "comment": "Malware payload (AgentTesla)", "value": "162312c4dbb83f38796e1b82fc36762478c7b6f00990392e9dce3b3d04b421daa7526beb2541051dc4a88fe989f7d1a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122411, "uuid": "c9f77276-3f3b-4203-97ec-7608938bbf07", "value": "T14D25C724997E0A13C074C3B9D6D1E32FAA9D5C9724209B320CC17FCE5F7AA06159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122411, "uuid": "a4ba6866-b1d0-4269-9baf-a0d5e7823fd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122411, "uuid": "abc272d0-bbd3-4fdd-804e-cfd251bb4f04", "value": "12288:x0Bk76dL7FdZzIeeNyE6qt2XLBpKjx2UFAZkPl0sq:x0u8ZdZzIeeNyEFcN0jh6kPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688122411, "uuid": "430aee67-7629-4a07-aab6-94dd16b8cfbe", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688122411, "uuid": "64f44efc-a358-489a-beb8-cb3ed0546f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122411, "uuid": "61fa04f0-874d-4277-9184-094de37c0a9b", "value": "Curriculum Vitea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4e7c71-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144938, "uuid": "7d1885b9-19a1-4288-976b-d6f9254f3eb2", "comment": "Malware payload", "value": "51b46476fe7fa9b4379a26123bd73cc7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144938, "uuid": "80852379-2805-43a6-84d8-8794598ec2f7", "comment": "Malware payload", "value": "972212807dbd82405bb0d9a73ee9a2274149a0e11167278ffab06c6d0ff7f56d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144938, "uuid": "aff380fc-d147-4889-923e-14e4e6699385", "comment": "Malware payload", "value": "90c039abba1df120f7120eee39eb6d2cf7129b2e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144938, "uuid": "6238687e-2d75-4c1c-8be9-601a997770be", "comment": "Malware payload", "value": "524d731cce3ec93d8f6357a9073dd1aea2e0596804d3eb5d2231f1be4b659330bf6d2bd7207180c4474e3148d0b1014a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144938, "uuid": "6afce6fb-8510-4612-bf82-db4f97800050", "value": "T1F8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144938, "uuid": "0036947a-8322-4aab-911a-c41a33f87f6e", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144938, "uuid": "d7989105-6733-4f15-8f53-907f661e86ea", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144938, "uuid": "f3c12a9d-d649-4daa-8ae3-43d5f9e676a6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144938, "uuid": "667703d1-c987-40c1-b495-4918a16d165a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144938, "uuid": "617b7bdd-513b-4aac-b03d-c50e219b94bf", "value": "8loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e096db-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112549, "uuid": "b109e3b9-9cc1-443c-9ee7-1b9787f86c2f", "comment": "Malware payload (Mirai)", "value": "f2e7d4c88cadcf80fa1a0d792c67e4a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112549, "uuid": "427f61c3-ce4a-4fe6-8a53-187c38657ebb", "comment": "Malware payload (Mirai)", "value": "9796753c55559a262dd611c3d629df8820a555fb777ac1f7b5cd401abd32d8c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112549, "uuid": "0dad37e3-9a06-4ac6-8ee0-576569a9d304", "comment": "Malware payload (Mirai)", "value": "1b2e0d8d62c1e23b26d4690fb658c33d0823b233", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112549, "uuid": "d9a4f233-6c22-4116-9499-ef4a49417a33", "comment": "Malware payload (Mirai)", "value": "6027568d69d817e3fc273022a3e967f53481a5c28e7e8517b86bf80fc0115010fc49cb882055cc94466e5d66cbbf3ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112549, "uuid": "c2f422b8-c1b9-4876-b9fd-dacd30628680", "value": "T1A8935C8DB4024D6DF98BE9BD54224E0ADD21235076C30F1BA7ABFDD378231A8BD86D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112549, "uuid": "f2ba2c1c-35e0-43e0-a2dc-4eda4f24a5c9", "value": "1536:e5gfPnFwfhFX1m1ZNSEd7fpJg1pmQZFHHW8GPWsiaPLUB0Y4W:e5tfhFXE11FpopFnyNLUKY4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112549, "uuid": "dadb1549-6188-4f54-9789-43fb0f2f2cac", "value": 92596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112549, "uuid": "85b95b8c-4f61-4cdf-9e59-052989e4abca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112549, "uuid": "c4d7ac55-c390-4aa6-8e1d-20029f6e3c42", "value": "f2e7d4c88cadcf80fa1a0d792c67e4a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2d6a48-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144912, "uuid": "4cdb2977-f23e-427a-b1c4-e2d64a627ea4", "comment": "Malware payload", "value": "d5b6b13cf9a77c05367c4c589d776aa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144912, "uuid": "c58372c4-868e-42a3-b970-2af9155a4aa9", "comment": "Malware payload", "value": "97cd896b9926a16a62b7785ba261e3076173ec9544df041017c4ca419842e571", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144912, "uuid": "8446622a-ba81-405e-bdf4-0cbea99ea270", "comment": "Malware payload", "value": "5cf94a6267febbf8f8df8f6427b76362841ad98b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144912, "uuid": "bdd4074e-e5f4-42b0-b7d9-e1f85e7ad405", "comment": "Malware payload", "value": "d908c9f0c3fdafa663c64fac5086fa609c9177c630a7b8e7e10a29b18d00e163ae14f9c26fbf0ddd7ea8838649056d17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144912, "uuid": "818a8b3b-d99f-4b8d-a6fb-a7aaaaae2a08", "value": "T190646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144912, "uuid": "e678e01c-16f5-4f17-8d13-a42373caa705", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144912, "uuid": "ead47800-83d7-4d5b-a43d-989619724648", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144912, "uuid": "86e435e2-b8df-468e-b935-1f166c2eb649", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144912, "uuid": "ab650d30-416c-4a36-a8e6-e602a5f8df47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144912, "uuid": "aee9b156-f07d-4d1a-b701-8a678cea918f", "value": "85loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de10ab40-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144107, "uuid": "4ab1e88b-8413-4afe-be0c-c75d4dfa3a68", "comment": "Malware payload", "value": "d6db4bceaf28b469a2c3298a7076bc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144107, "uuid": "b6c96170-de3b-4367-b2d9-9811eddaa460", "comment": "Malware payload", "value": "97fc228c23bde829b5889b11c06d4bb0d9859e35d99e6b2e7e34cfb84c1eba15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144107, "uuid": "37ef3406-12a7-4898-8467-1bf246e17f03", "comment": "Malware payload", "value": "610612e09c97d6d671c11fa1745e6d2294ab8c4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144107, "uuid": "98b826c0-8450-40d4-8887-002307789162", "comment": "Malware payload", "value": "59bf1cb911b388e6f24aa5e2b69fb5021ef6ac222d96dd3dc75eec63db42a48c061ab8d4253e97d46b4dae2543c362d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144107, "uuid": "83d47493-ca64-484b-a21c-6495816764fe", "value": "T1B346339DF3486F22CA7E16B5F8210D4593ADC192598AF73F664C0ADD2C33793C8261A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144107, "uuid": "73f9b554-4b93-4f3c-8c73-d847bdce8fb1", "value": "98304:C3hi/Y6z8gBNG9VCQ5YB0BaqG0WUB1rlgrB+rvO+y1uuAROH:C30TPNoiB0ByyCkrGP1uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144107, "uuid": "15d770ee-3ef0-42f8-89c0-c19a5cb11d5e", "value": 5413376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144107, "uuid": "0dd26002-f89c-4ef3-bccd-baf027a18054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144107, "uuid": "bd0f3787-53d1-4b6c-bef4-a0e0409c5184", "value": "SecuriteInfo.com.Trojan.GenericKD.67726247.25100.5938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a92c61a-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144343, "uuid": "7eb932a2-1556-4b94-bbfe-c82cbd403485", "comment": "Malware payload", "value": "8606af52e06ea2cc4ddaee554ffc02a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144343, "uuid": "ce68d81a-621b-48fa-a39a-0e57bc2565ca", "comment": "Malware payload", "value": "987a23611eac335f00d863f953897c4f16fba053fc22316a17cd6eae1c170951", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144343, "uuid": "50a0293f-1d53-4dd5-b6ce-65627f6c2814", "comment": "Malware payload", "value": "1e3ab2c96ebb56586ec97bab51bc221aeb3e586b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144343, "uuid": "561d311d-0b65-441b-888f-e7f5660af438", "comment": "Malware payload", "value": "2044a6ef14849b6701b58a9e148cbf007209db11f42e60e82d12fc47ab98da170a1d50a90b43dbc7fdb25b59efea20db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144343, "uuid": "55e1e521-e8e8-479a-9ccd-9454c5c7fdaf", "value": "T1F1646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144343, "uuid": "1240d22d-8bd0-45a4-8af0-032b743d3a15", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144343, "uuid": "590f289b-065c-4189-a16b-70e0f73adc4b", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144343, "uuid": "7812639e-0d78-447d-95cb-7bafca7b2228", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144343, "uuid": "73dc41ab-8d37-4a26-9877-c1b62dd5db80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144343, "uuid": "d5405be3-2de3-49fc-80f8-22e67e3d8c6b", "value": "11loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65722b6c-170c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688105250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105250, "uuid": "3d8232ba-402b-4f34-8f91-535d3faa7aa8", "comment": "Malware payload (AgentTesla)", "value": "8be7b36b987bf4acc4af121f2c9e19c1", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105250, "uuid": "793153f0-092a-48b9-8ef7-ec8a4a152dbe", "comment": "Malware payload (AgentTesla)", "value": "988f95cebd45db538007257ec7a8241533d706acdfc4aeecd0b273a00b1c82be", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105250, "uuid": "bc4b9ae4-1686-4da1-8dd8-59d0d284a6f9", "comment": "Malware payload (AgentTesla)", "value": "a9be6531162181596e10ac1cd4ce25ad87ae0385", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105250, "uuid": "f5b50b8f-db97-4246-af3e-c5983515d472", "comment": "Malware payload (AgentTesla)", "value": "c62cf37a923759e26de7a89d2e78b77bce12b167362c2788cc2b6e7b39e7de06625ee45c9b7f9df98cabebedbe567275", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105250, "uuid": "f30fedbf-1fa5-4dae-ac5c-a7429be7b76c", "value": "T16D54237A425BB323F9E03EFCCF468DA507944F7A58B068E4D1AB6B15C4274247213FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105250, "uuid": "e1f3cb21-76bb-41d2-9e70-b2eb7664119f", "value": "6144:3d8+IiNjLRT0dUky4/St4H5XLnX5LUE9Hmci:3dZFLRTqUky4/StKdBTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105250, "uuid": "aa8e2139-da81-4ba4-b06a-9a0ed85e8a3e", "value": 293030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105250, "uuid": "62b6a3ed-3cc9-467f-94f7-e629c9c8d6e4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105250, "uuid": "c7c383d1-c17e-434c-b168-01b244074064", "value": "shipment label.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002bdd5e-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144594, "uuid": "a6804a1e-8c5e-4292-b646-2789ebd5f445", "comment": "Malware payload", "value": "9e7601a3b6b2bdb441ec48a80aefd97f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144594, "uuid": "37c45f9f-ece7-4633-911c-bd02e5e60538", "comment": "Malware payload", "value": "98a1255ec37128555ab4bd4c6b45befdff3021df20ccf57861355916d75beb20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144594, "uuid": "9912900f-e565-452c-bc33-502f78a8fc29", "comment": "Malware payload", "value": "8c56e981dc647b5b854a719708efa7efe8f9ca7d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144594, "uuid": "22ed4e97-b36c-493d-af42-d017c878a77c", "comment": "Malware payload", "value": "c7b6592149660db2f6f5192312b0eae5a0bb980e6ceca65c35ba727c1e8aa0221925c151f5a8ea0fea16116b80ab5887", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144594, "uuid": "59989b1f-1e16-4efe-ad04-9cf8e89f5ecf", "value": "T19F646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144594, "uuid": "fc04fccd-65b2-40d9-b222-db77e098d56c", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144594, "uuid": "0bb23004-3c84-4e3b-8302-96c0470afaa7", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144594, "uuid": "23e8db09-98d6-4ebd-9dda-06eaea9b67b7", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144594, "uuid": "3b6d2d13-53e8-4b14-94fc-44709cf3379b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144594, "uuid": "a7379f39-a53f-4284-a44a-bcbc18bae5cc", "value": "45loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaaddf16-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101178, "uuid": "660ee89a-de0a-4ac2-8c1c-f909656de3be", "comment": "Malware payload (Mirai)", "value": "70d273b00e538e66034d22c62a0e8ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101178, "uuid": "aa0d1974-33e2-4577-89a6-640c9c208d55", "comment": "Malware payload (Mirai)", "value": "99304556d481fd8a26c3c036da44d1095c954030b417fceab35c451bad9a60f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101178, "uuid": "3f254c8c-4786-4b3d-b8a1-f0db7eae6e23", "comment": "Malware payload (Mirai)", "value": "c429d60836bbaccc78e608565e36568536f05b93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101178, "uuid": "5c5ee9bc-2ae6-4a29-8935-cf6da6296927", "comment": "Malware payload (Mirai)", "value": "298b9af92ed78efbb7cc7e69c25bb332c6373d1e1909c48f9b971bdcf9716fae06a48c38008713d012d42cdce8a096ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101178, "uuid": "640854ec-a219-4e8a-a922-86db7691d8c5", "value": "T153A3C61ABF610FF7ECABDC3749E5270528DC641A21A93B757934D814F24B24B5AE38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101178, "uuid": "25e881bd-4a58-4f32-9f89-5e86c22277c8", "value": "1536:xgxwhsUQ955EqsGmt8E76qqBWqptHzGe1JINBjO0fGG7ZZ4yOoZ:xgxeqB1ZzdBG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101178, "uuid": "d73b5b7a-8cb5-4806-bb15-fabb7c2c5bcf", "value": 100684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101178, "uuid": "a175ce58-66b5-4a0c-a8b3-9df2849188bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101178, "uuid": "d7ce6046-ae35-45a2-bb5f-7d0528b542ec", "value": "70d273b00e538e66034d22c62a0e8ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce19b4a2-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144510, "uuid": "d2a8acb0-13d6-49db-9247-578dbaa021c1", "comment": "Malware payload", "value": "ffe029628c41ccb96417706db3350682", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144510, "uuid": "4868399f-8b7f-4dd1-b7b1-0c1a1186c135", "comment": "Malware payload", "value": "9a64f76beff258f89e5720d6b12def536c31db87c642dc58e527e2f613ad464b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144510, "uuid": "3bb885bf-2c24-4f15-a5ce-ecc5eb5b330a", "comment": "Malware payload", "value": "3cfb5d1f3d89f7e62e0398b1ab9d69b2fa33015b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144510, "uuid": "aa2605de-17ea-4d41-9eb4-1672f7a59a8f", "comment": "Malware payload", "value": "f90e5acf675bde6094321b9f295a259d9e99464a1a720994f2906e2139ea4e7cc17d3bfc6e1aed44f73be1e4d439ec2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144510, "uuid": "3223c923-7495-4267-9899-df768463347f", "value": "T1C2646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144510, "uuid": "1a7e6ba7-3e4d-4254-baa6-7d54d80f1ce7", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144510, "uuid": "28f5c472-04bb-4f2a-83ce-a1a83cfdea24", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144510, "uuid": "8689c144-fbce-40c5-ba0f-c86111442878", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144510, "uuid": "ee7bcb04-ef25-421b-bcea-d85534ec50c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144510, "uuid": "94586135-b734-4d01-8166-835dfc194b41", "value": "35loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921d64ec-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144409, "uuid": "8592263a-929b-4ee1-8225-dd6ca5880125", "comment": "Malware payload", "value": "d1b40e6a5e1888daddd0d8f3fcdcbf8e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144409, "uuid": "b8c5baf7-ff8d-4cfb-b92f-4c8734a368ef", "comment": "Malware payload", "value": "9b345c9e26036f0325be4e645d00a447f68897e2f201d5b18cf430a95a5331f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144409, "uuid": "890b4c82-f783-4761-a015-0be593056e9a", "comment": "Malware payload", "value": "eca4dbc10c4603cde616e26de84590219d3707d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144409, "uuid": "1956c473-8c5b-49a7-97cf-92fc975bcb3b", "comment": "Malware payload", "value": "983365f5d7501adf3b538dd49c588a23b88be7c5bedb8bf584535f408d759cbbd89ac7d1730eabeaf08335efae63a2ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144409, "uuid": "011fd0b7-a917-4c48-9cb4-2d785d0454bf", "value": "T180646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144409, "uuid": "c8ccd03b-837c-4df6-a0b7-21b861b476c0", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144409, "uuid": "1470b08d-3385-44f6-8b96-c7635f3c755e", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144409, "uuid": "0ba1cb40-c9b0-4a1a-94e3-b4a548b24104", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144409, "uuid": "78efe764-1aea-4bc6-a0b7-74b9cee173bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144409, "uuid": "b238b9c4-5dd2-42df-aa8c-eff60306b02f", "value": "20loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ae34fc-1703-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101472, "uuid": "3e0f38c3-4209-4e09-b466-81811f9d68d2", "comment": "Malware payload (Mirai)", "value": "ea733fe52d9326c6024ec91bb77fa89a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101472, "uuid": "4171202c-f7b9-4e30-b290-4e5fcef3390f", "comment": "Malware payload (Mirai)", "value": "9b48fb10044af546980b95f463c07de9a5d5215148a87a4d325c9b276fdb2ca9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101472, "uuid": "69c3bc7f-2089-41a4-a62b-2d247c04cf01", "comment": "Malware payload (Mirai)", "value": "e21196a9ddd1f09eec5d0ef2d1ccfaee585415c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101472, "uuid": "07cc8412-469e-4096-9525-f1fcbacd2dd7", "comment": "Malware payload (Mirai)", "value": "d71cd7913197d822fdfae810c1d652b2227ed3295ad45c9ba103d8a9d3707e0f3a5dca8d40fe4107da89bd1469c16fa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101472, "uuid": "b325b0f6-647d-42b5-a8ba-f9aea77e048b", "value": "T179734BD5B4028D6CFC4BE6BF84220B0AF92163105FA30F2B956BFDA33D631A59D46D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101472, "uuid": "8bb64ac4-151c-4217-a6c8-85734b13c74e", "value": "1536:Z9Q/sd8CDtP3nLQNvl65NywGyDb1S6NissUlgwjMKy+4v86V:ZZP3nLQlQ/VpUNixy93V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101472, "uuid": "240211f2-b352-4dcd-82d1-7f11ef69cc68", "value": 74356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101472, "uuid": "77645ffe-d23e-4424-bffd-05b7e9ab2ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101472, "uuid": "56df501c-b3e9-45fd-895b-3dca3c146b19", "value": "ea733fe52d9326c6024ec91bb77fa89a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f20dc2-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144764, "uuid": "58f09e24-d395-4701-87bb-711e4308b827", "comment": "Malware payload", "value": "7b721558896b14c5b0207bfcda0af862", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144764, "uuid": "418e9dd1-be19-4391-9077-ac558904d82d", "comment": "Malware payload", "value": "9ba8373bb8741c49a22057bfc197f353e6334776f9596c31c57e4563a2f9cbad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144764, "uuid": "a00aeae1-1a95-462e-980e-7b8e482acf47", "comment": "Malware payload", "value": "e0151bc7a6ae28931b672a09839bf7b788d7bc83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144764, "uuid": "f11c61a5-3f2f-488f-990f-03b3dc629f64", "comment": "Malware payload", "value": "405355d998d79ff7e8e00577ee9ddae5585647fba0cbc97608fe3c8d9937a4b7dd29b389ca14de29cf72f5439c2dacfb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144764, "uuid": "096d4b98-3d39-43be-b650-97727351266b", "value": "T1A4646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144764, "uuid": "45b56732-7513-4aa5-b105-85756b55e9be", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144764, "uuid": "7461531e-8255-4343-a8da-16094a4e8f6f", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144764, "uuid": "4df63ff5-d612-4ad2-9e45-cbb15d8f4ebf", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144764, "uuid": "0ce3d323-193e-4881-8c4b-f303f457dab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144764, "uuid": "2a9a0c7d-d8e7-48f8-988e-6bd62f7b632f", "value": "65loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582544a1-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108234, "uuid": "f8210cac-0200-4ade-a3d2-f88feeafc2ae", "comment": "Malware payload", "value": "fdfad10c7c07cd9e9a5c4c5d2a7e055c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108234, "uuid": "affd82ec-551d-442c-ae92-7d9dd804c97d", "comment": "Malware payload", "value": "9c1a45fbf90274840bba36cef3a3ecd5f7f20c45e8029b1263dd0c86812cdac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108234, "uuid": "e19675c8-d62c-461a-81c3-fe5cdb11d1c6", "comment": "Malware payload", "value": "83dc95a27b780b32eb9eb82be2e87e6e1e15cb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108234, "uuid": "c2279b12-a4de-4c73-8861-ea16225f13bd", "comment": "Malware payload", "value": "35bacbb169ed251fe2e261f3b0758779a113551662afcbc8d1c4ff8c3f8d885633041e266819e0a5e27736467ef7e2d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108234, "uuid": "4149f1fc-dea2-4375-a29a-5b4ef37ece87", "value": "T130551202B9C148B3C9721C335A785B20593DBD201F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108234, "uuid": "4efa325d-7e2c-4f57-81ca-c96733f51689", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108234, "uuid": "dd3a8b17-d2fb-4eec-a4fe-397242666081", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnA5:IBJctgBhc6Kus+9gO0qnA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108234, "uuid": "450ba6b0-cd8b-4810-ac92-24abc0021b23", "value": 1353751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108234, "uuid": "ef6a7eec-4c83-42f1-8f91-ce67e2105ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108234, "uuid": "2e551378-f363-45f0-ae24-6ed045a2aca5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75768e3f-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169272, "uuid": "c71e2c4f-40d6-45da-9ded-5a50c2f73b15", "comment": "Malware payload", "value": "75cc31c67369808c16db3a766ed3417d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169272, "uuid": "9f530c13-d630-4c03-8e87-22263eef75b9", "comment": "Malware payload", "value": "9cfcf6c4cfcc079c5abe694b582616fb43e7a8d341db5765812bbad2d5073bfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169272, "uuid": "ed8b0992-3077-4cee-aa9d-2fae60d396b9", "comment": "Malware payload", "value": "936a3f0dab5338cd809a8f077d73616f365a476e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169272, "uuid": "2d49e695-95f3-4282-a3b2-b53535344d9c", "comment": "Malware payload", "value": "81b03abfb655c44e07b622ff11c7e807f3c121f832c059c6dc4071b708b83acf9c02cff708b9c6ebb1ed7d63cad39071", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169272, "uuid": "f9ed71ec-e315-4de4-872a-589b4c061f4f", "value": "T177041946EA404B13C0D627BAFADF42553323AB5497EB33059928AFF43F8679A4F23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169272, "uuid": "9d66dcda-02b6-457e-98f9-662fa16b951e", "value": "3072:zjKdyV8vHTStaydoQJK/yEqv82pxPpZcRorM/RM2tE/sLkB:zjDV8futaydoQJKaKExPPzrM/RoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169272, "uuid": "27b8e0ec-6e3e-4eee-9ddf-9229acd72ba5", "value": 177490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169272, "uuid": "ac0ec012-80f7-400d-96fa-051000551f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169272, "uuid": "818d0c34-bcf3-4df8-b944-e53b1e321243", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fac1963-171e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112837, "uuid": "ef7dc89c-0e03-468a-b456-c7b616d9306b", "comment": "Malware payload (Mirai)", "value": "810d5115021b7d4ece7dc4b8cbffe254", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112837, "uuid": "28ef7321-906c-4cb7-9376-7203536fa6f4", "comment": "Malware payload (Mirai)", "value": "9e092162938b694253eb4382f3fd9f5547c8c464b8578526400b508a876be53d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112837, "uuid": "7193cc4e-dbf7-4691-9a1d-b81ceb8783bc", "comment": "Malware payload (Mirai)", "value": "93037d7400dc792fa4d79114ba5d1870bda44ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112837, "uuid": "def371bf-7193-46c1-a213-60cd84c1ebdf", "comment": "Malware payload (Mirai)", "value": "5dee199d93b8582790ae2f129cf8492f97541272bd17306654ce805aa3d892d4988b08d7fb1bd5f72cb6bcebf0757d24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112837, "uuid": "42e4d3f5-0c1a-4a5d-988d-09822db4b48c", "value": "T1B2A36D24B9392F26C0D0787E21FB4751F6E2269E26A4C59D7DB30F4FFF206406816AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112837, "uuid": "fc09cff4-1ca1-41b1-b849-82027dc1e4b2", "value": "1536:sv8X5KsYcOSnJaFmCNIUulW3c43f88ywaVZmVQy1S9WZpJ6VRcpa3uB6vmTgcAOp:+WJPJVKB1fEF6VZAVRcUugvmMNO3Ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112837, "uuid": "7bc8b694-4288-49dc-ba66-dfa3f8d1ab08", "value": 102688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112837, "uuid": "8a2fd932-457d-402d-9fe3-8ca95da6b28d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112837, "uuid": "b18161e8-7dc9-4a05-94d9-7cacdd4b64ac", "value": "810d5115021b7d4ece7dc4b8cbffe254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9e807-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144440, "uuid": "74318c7b-f1fd-4e6a-a486-857348348ddb", "comment": "Malware payload", "value": "1674aab0ec91ca0f06d4ba4630b72020", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144440, "uuid": "8df01e90-830f-4123-8e15-455a1825cf33", "comment": "Malware payload", "value": "9e1145a7d6b6286a7bd8ba19d559da49046fa049210f0d17f75f18aa16ec7fc3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144440, "uuid": "2a2a52a7-3873-4d98-8133-5ce1d3c611ae", "comment": "Malware payload", "value": "bc70c5104f14653b82daff7ef54cd7e406f9068e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144440, "uuid": "0bae254e-c21a-4aa4-b51f-ec9d74815e05", "comment": "Malware payload", "value": "2550342d6ba9f474cca2f7a034f258abe1fa1d29000fb2a6c40dfcc14abba8b0cfa22b141fb0f0b89773b97054aac54a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144440, "uuid": "7ab14444-9d23-44eb-bdba-68bbc579dc81", "value": "T18D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144440, "uuid": "59f9c3be-ec1b-4374-baeb-c18090997b29", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144440, "uuid": "413bd107-e0cf-4a64-a3b8-37baf6843782", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144440, "uuid": "e491f800-0f4d-470c-b7e4-d35287464e25", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144440, "uuid": "fd0ca1dc-e35d-4498-8a19-f6ed493c5b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144440, "uuid": "de6d832e-3345-4e90-a812-9a01a1208d2d", "value": "25loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d13e18f-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112537, "uuid": "67fc3079-4d83-4ca5-93cc-a544e874c3b9", "comment": "Malware payload (Mirai)", "value": "e7bb0c5ba5dcc6c0cf7daf69a9a01205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112537, "uuid": "8284fcd8-7988-4e48-890a-cc415179d5e5", "comment": "Malware payload (Mirai)", "value": "9e1bb8dbd46a0df1e1663bca377fd5ce81d21b14f48df904aadbea4e45602b34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112537, "uuid": "0107df40-3ee1-4d7d-ba59-eeb15d0877a9", "comment": "Malware payload (Mirai)", "value": "e5369709f798dd9d636502782ce85a69f5e8c103", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112537, "uuid": "246012a4-7802-43a1-8653-8cdcb3f0f3de", "comment": "Malware payload (Mirai)", "value": "ca9d35fb552675e7d47c266d1763e86481edd50ef23d9115f62d25eec35cf5cb9aa3891b5876e03a8f06e004fbd1f6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112537, "uuid": "f8668777-c8f3-474f-954f-bec3ab5138eb", "value": "T18D336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112537, "uuid": "55ae9bf8-2c81-49ef-a037-3dd0cbf1f87d", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112537, "uuid": "a88a7313-125e-4016-92a6-63ceeaa45022", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112537, "uuid": "a1f3ae57-1904-437c-b998-6cf203cefe66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112537, "uuid": "920cec86-0bb6-493a-8e27-9e8e37f367fd", "value": "e7bb0c5ba5dcc6c0cf7daf69a9a01205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f78dcb-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108195, "uuid": "04e6a430-c100-4009-9769-ffce6d4d682e", "comment": "Malware payload", "value": "914d3c7591853f91db7c9b9ea6e44aab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108195, "uuid": "407870bf-6f97-48a8-935e-e4bd4f9cef72", "comment": "Malware payload", "value": "9e985a4108e69626e1ff5a856889714c9e4ec4d0f2262f90ccef2ec3c5c0de3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108195, "uuid": "a4c96ce0-9954-4b70-b610-3c527032f35d", "comment": "Malware payload", "value": "08426b9c7495fcaad46712814fcf929ce4471a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108195, "uuid": "ca8e89a7-cd44-4ca0-8a82-66b3f399dce4", "comment": "Malware payload", "value": "3f0ee1c2a5d7f6e2d4c96a77b31527fef0aef597fdd48f8049d3461e9ad14474ea79e5bc3ca3303198772292e79b1ddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108195, "uuid": "9e42bc7a-1f27-4745-8ad4-ac3671363a7d", "value": "T13894D002BAC194B2D4631C376A79AB21A93DBD201F76CEDF63D02A5DD9315C0DB317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108195, "uuid": "c9c883e8-4b79-4f7e-91ee-c36ea55def50", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108195, "uuid": "fadf9d3b-dc43-452a-b408-00822f7d53ed", "value": "6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/dNbM1/EI6XAx9jtPTF:2ToPWBv/cpGrU3yVtX+t4Vd2EATjFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108195, "uuid": "b78fa20e-04a3-4b77-914d-681d1e4edc74", "value": 430439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108195, "uuid": "f6efe5a4-6655-4827-b778-59f4a2f33f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108195, "uuid": "fca2afc9-206b-4669-b580-d2a723076254", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28acb8d8-170b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688104718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104718, "uuid": "e9fd9acc-a735-4c60-9896-ee0c7193e451", "comment": "Malware payload (AgentTesla)", "value": "7f8570c4f281adccbc80f93c9df9707c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104718, "uuid": "c48f47a9-5a88-42e7-9d1a-9ce8cfc1ecbe", "comment": "Malware payload (AgentTesla)", "value": "9fcdce539a3c62058be649eeb435eda920d406ef8f2f671dc61d830f1b94d944", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104718, "uuid": "7fb49703-a8c0-41f6-b3c7-086e027ef3e2", "comment": "Malware payload (AgentTesla)", "value": "da4fc1ed6bb33fd98afaa81cf84ddbe23da455ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104718, "uuid": "301ce440-7345-4289-9899-998a7af9e7c2", "comment": "Malware payload (AgentTesla)", "value": "ce76e385642aa96b70f13bacc877757f6d6d3a37b3b5fa812edee9cdd85f8273902731ddf53c1a4d37ce2f08257038ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104718, "uuid": "4b098721-7f83-47cf-97ae-333af3b3371e", "value": "T115352206F981FD6BD85693387452947A414CFC29D3A8E8435B1ABB4E04F0AB489B77CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104718, "uuid": "4e6f441a-dd5c-4858-86da-5a061e090443", "value": "24576:4Rzlzjw6sMo0xfsjcUos+xKKzSw6s3o0xfsjcUos+xKGVrAeJ7vSn:4RRA6sAxfsjdos+xKKx6sLxfsjdos+xW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688104718, "uuid": "5e10fae3-8bd0-421a-86ac-4a1a1a7e789a", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688104718, "uuid": "b525dd3a-5184-42e6-a708-535f3fe95e5b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104718, "uuid": "52fea6e6-6347-4bdf-adf5-f4eebc0d86d5", "value": "oustandingXswiftTT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b461e59-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150867, "uuid": "f8325024-f97f-4886-91fb-65086d68a8e7", "comment": "Malware payload", "value": "5767ca40c29cb20842c8d3b12c93d582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150867, "uuid": "1aa21b95-21d7-412a-861c-ea4388dc9c37", "comment": "Malware payload", "value": "a14f448e7fbeed5aee2f0db602bca444bb821e731452e0e43f914b1cd902fec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150867, "uuid": "afcc70fe-5581-4b73-890e-70c9fda96d4f", "comment": "Malware payload", "value": "8fe5bcd90416a48b3f862ea52f726239d2d8efc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150867, "uuid": "8e5f1824-9ebb-4064-929e-c120e3fc9145", "comment": "Malware payload", "value": "6e74756fc184179806d9fa48a6fb6f48f7ac58bafb5f37e56f3da44ecb1f2b791f0c3cdca5dc40636914e6d850c6fc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150867, "uuid": "3efa75f3-50e6-4a41-af51-fdac811ebda1", "value": "T125F38D2335E0CCF3D24A11314DA69B6EB3B9F9700E624943F3D46B8D9D38AD1A627257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150867, "uuid": "d85c7d18-7f77-4702-a0c1-1d5b25822e3e", "value": "97e65999ac3a66c864b3eb38bb84c377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150867, "uuid": "50f868bf-0acb-43bc-a86a-800f0748a5bd", "value": "3072:s2A2+ClsFxK7hfi5ji+8T26z02mNt4H96u:/AbZFx4h2uaew4Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150867, "uuid": "0b89b139-e24c-4015-b020-7245bff2525f", "value": 161568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150867, "uuid": "869666b5-7af6-41ba-99c2-a91dbd43287d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150867, "uuid": "3fc90787-f866-426d-8adc-398ff5c17c4c", "value": "chuaname.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8a8c84-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108295, "uuid": "977ec866-f7fc-448c-9019-5cebf26f76e8", "comment": "Malware payload", "value": "7cbf3d1245a86edc1a0647cb181d1ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108295, "uuid": "c11c3b5b-b890-4b0c-b972-1207fd5dea7c", "comment": "Malware payload", "value": "a14f651a7f227a9beb5c6c85d5c3c9101d04a1a956981e22d4fe7dc063a62aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108295, "uuid": "1fa7a9c2-2914-47f4-9562-7a83a5a4996c", "comment": "Malware payload", "value": "d31c15429537195b3c14534837b463eab532724a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108295, "uuid": "bbf4f70d-5d09-454d-9f2f-0078850e1470", "comment": "Malware payload", "value": "3bec96a8f7a37fd96b1a31af0b51beb20b7c2625664be73c1015eed4c3c509d00bda6b89acca72716615d096bd704d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108295, "uuid": "172ab64f-aba5-4c28-b83b-00604a9d64b6", "value": "T1CAF40102BEC599B2D1721C321B755B20A93DBD202F75CEDBA3D02A5DDE225C0DB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108295, "uuid": "0fe9afbf-8e73-4479-b088-bb849e7807a0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108295, "uuid": "d98a5d2f-94eb-40d0-ad01-3166c52f6566", "value": "12288:2ToPWBv/cpGrU3yVtX+t4V1x9MonlaQuCMNNC4gHCDuhHGjYsVbWwvPqxcU:2TbBv5rUyXV1XnlaQO7giDuhHGjxxzvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108295, "uuid": "9893487d-0eeb-4cef-b6c8-a322795a9b15", "value": 733971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108295, "uuid": "164a7690-f040-4da7-af71-a85343bd90a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108295, "uuid": "d5a3f1dc-3853-4a06-961d-51af21436b38", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f26770-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144922, "uuid": "b8cbabf2-2916-45f3-8065-0fd7945c0897", "comment": "Malware payload", "value": "7a8f2ad30ac44a3418b2028e5bac48a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144922, "uuid": "ad0d207d-84f2-45d4-a700-32545d508e79", "comment": "Malware payload", "value": "a1b213099cd6fcc4ce298706112cbb6d20a66d369f6cc80bbbbf7a0819606b14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144922, "uuid": "84852f14-410e-4c8c-9ab8-49d6d0ebc08f", "comment": "Malware payload", "value": "5523010647e62196dca7e3288d1e0b0db16ad021", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144922, "uuid": "ade0dd79-60e9-4fe7-881e-2d1690254479", "comment": "Malware payload", "value": "9cc891667fc2dbe9e5b3892fbbdcd2563baa449149b2d4db5fc84f5d501ba067b626556d79b762b6329b7c19a3a91370", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144922, "uuid": "b1488167-8c31-462b-8c9e-13d9631f2bc2", "value": "T1F9646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144922, "uuid": "cc2b9492-1682-421f-bbfd-4899e628d7f1", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144922, "uuid": "66bb0a7c-426e-4dde-a0a1-b7a25390bbed", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144922, "uuid": "c7509731-5bf4-4903-ab05-bb8ca8ef4634", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144922, "uuid": "e9082953-ccc8-4a0c-a259-465dcfe43dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144922, "uuid": "4b1681c1-186b-44dd-9109-183632f0bc26", "value": "87loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f05987-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150715, "uuid": "5230b729-3462-4ad9-b35f-c940ff554078", "comment": "Malware payload", "value": "78ca6266294789d169792c330758cb4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150715, "uuid": "336cb4ac-90c9-4c3f-985a-f48d2a94b978", "comment": "Malware payload", "value": "a1c7a2331009bf0cac46f57a5446d3c969161c435c67ac4a1b98c0a4ce712787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150715, "uuid": "3e76b392-2786-4267-9f0c-b788af6a7d0c", "comment": "Malware payload", "value": "01474dea306722d9da1ae2a83aa089912b989861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150715, "uuid": "12940665-b8b8-4cea-96ec-3a4e408e859e", "comment": "Malware payload", "value": "57a470d3284d85e779eaf7848e710a5c56cf5a0b4f9b3e2883370dbf8b927311122628f2f14d940252a9ad97f1ee1ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150715, "uuid": "4b7ed5db-c1fa-4778-9731-e92dcdd0ca03", "value": "T19AD633DA15E92187F0E947B6E84383422765765A4F6190F33B14DA7F78B24A0E0B0FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150715, "uuid": "7a78f809-321e-47ce-b539-6289e000ff3a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150715, "uuid": "ad53a5d7-2fea-4d71-b064-fb52aef4f846", "value": "196608:HGzErOAvYMg2gO1wjcjOJCx9zFajuc0diN+O3L0B4NoRgLRhwzCpJXd3mIqN2sqx:mzyqN4wLJCBLliNZ70ERmgJN3mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150715, "uuid": "46d4f915-f92d-4565-b5e7-bcc49ea93f12", "value": 12936192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150715, "uuid": "c8906ea0-9c80-4655-808e-04c66768bc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150715, "uuid": "2c158676-db87-4763-bdb9-75b8da4c760a", "value": "SecuriteInfo.com.Trojan.Generic.33993308.27608.29847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078dc055-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108099, "uuid": "1f5d21ae-dd89-4256-863e-e7e15f4f0be8", "comment": "Malware payload", "value": "87440297f51a44bae4caffaaa42c866d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108099, "uuid": "0c43752d-aa3b-415f-aa49-fc93ca91a5ba", "comment": "Malware payload", "value": "a1fe6d726fe4951bfbbaa9ae7a83be114b82fa216a63132cd63ba026773476c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108099, "uuid": "a09535cb-7091-4563-99f8-3135c2ff221c", "comment": "Malware payload", "value": "7c0261d4856c40f377bfda60d5502ae246c96bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108099, "uuid": "4bf70812-313c-4a1c-8b98-36a2b86ebc30", "comment": "Malware payload", "value": "774446e58173d9da2b7a93a4305a8a8a867425edb22653af659b322ca0d244de2df69e46d5e26e374e7069f55311678e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108099, "uuid": "bfc09bab-c125-47eb-b969-0bc63e4c9b7d", "value": "T1EC95BF70F1E0DDFAE74312382CA960100AE39DA15595638D30AFFABCEAB334774D955A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108099, "uuid": "ba080721-6c68-4ba3-b616-7b8e928a299c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108099, "uuid": "4341d81c-143b-4ced-9f87-83d2116d6e9a", "value": "49152:au+7e9ZZehjHumgZgB4chdHd5J+GtsWEhu:9ohjHu1ZWxdHd7+GiWEhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108099, "uuid": "fbbf466d-4af1-43d0-9c16-a0553b6f76bf", "value": 2002800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108099, "uuid": "e347de21-9d4a-42a6-abb5-2940d6eee46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108099, "uuid": "1fa04286-92de-4b53-b6c0-dbd62fce871f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de0f03e-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163112, "uuid": "55f55f05-0f74-459e-85ab-0e106ca6f1f8", "comment": "Malware payload (Mirai)", "value": "b866d47e2e20bc130e800225cc2650d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163112, "uuid": "af9c5d09-fa46-4eeb-97a3-e3f4b75459b2", "comment": "Malware payload (Mirai)", "value": "a24638c481dbac6370370d83d7a3a7c0e2c806b0f2307dfadf0e785f0fefdd38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163112, "uuid": "a494bad6-e0cd-413a-acd8-8637be428a08", "comment": "Malware payload (Mirai)", "value": "76f6e8c39f25273606c938ea2cf054d7e7954e4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163112, "uuid": "5072963b-be90-45f1-b1c0-98022be96aa6", "comment": "Malware payload (Mirai)", "value": "d85f22cc62725c556dab3a0a0a769768e80bc5b95e14d1405c63ceab5cf98484fa86b898a18f4d122648100224e0949d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163112, "uuid": "d2362c14-ab9d-4160-800a-64ef7739a824", "value": "T162C2DF7C57BABA8AD8BCDC3DA49E33B10C1172C4B11E062286624DEDF76650F2C9D09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163112, "uuid": "10cc606e-eec2-46cb-827a-f535636a01e2", "value": "384:xCWYYvL2zdEUBzxPWvvPO5Qm+SZp5IbFQxHrQQMTsULSMqP8ezhsDTqRWGVCz0Ni:xCWYYvkEUfPH51Zp5i4nM4RF1sDT2WIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163112, "uuid": "09eb1366-c500-43f9-8e28-4561090e6f9a", "value": 27260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163112, "uuid": "04f73fd1-2f4c-440a-b9f1-008af64ccf89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163112, "uuid": "d2f06517-95ae-4b35-8c15-659c9f0816b6", "value": "b866d47e2e20bc130e800225cc2650d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dd9aab-170b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688104767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104767, "uuid": "c472514a-4f33-4e47-98ce-92a971e8e9c6", "comment": "Malware payload", "value": "5d200db6137bc3413773f92b0075a411", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104767, "uuid": "337f9058-5da6-4b56-83c7-b9af7e1cf662", "comment": "Malware payload", "value": "a3cada5cfb61ff86311effb688e49bdc8bdfd60d35005c28713d1e76dc66ab31", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104767, "uuid": "b84fea32-22f1-460d-8e40-664f9f70a8e7", "comment": "Malware payload", "value": "2aae2c6d97fe436f4153ec2d43d8fe86585d701b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688104767, "uuid": "908c4ec9-15de-442b-a724-7773544a19a5", "comment": "Malware payload", "value": "e853b830860cb58cc03a377d8f282540e67db304b4aeaa754265305dd984f4bc97fc97c975a92f352fa3c644be7ba017", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104767, "uuid": "aa5197b5-cca4-43a3-a40f-76518afdf3c4", "value": "T1C0E41207F695FD97D856933878924569010CFC2983F9E8835A1ABB8E05F0AE0C8777DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104767, "uuid": "a27fe061-3f1a-4c08-9225-4674cb35e390", "value": "12288:YGRv+zkBC6uEkk+zzo0LMkfsjfkM7W+oI6MqXJ5QtSVo7QlqxprkbkaTJW4z:Kzkw6sJzzo0xfsjcUos+xKtprkbkSJPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688104767, "uuid": "38ed243e-3560-4754-b75a-7d5250b5f6e4", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688104767, "uuid": "0251bbed-1871-4a5c-9e30-664926ec6316", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688104767, "uuid": "2013ad05-a130-404e-a47d-8ec957cdc951", "value": "project order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b48eb1f-1723-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688115004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115004, "uuid": "d3b86a3b-b11c-4bfe-8548-68c8e903b258", "comment": "Malware payload (Mirai)", "value": "5f893c20868d2740d74b60e2cea5f6a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115004, "uuid": "5e480232-a35b-4879-9925-4818b2654d91", "comment": "Malware payload (Mirai)", "value": "a4c2ebf90f20ede8fe63baacfc644282c6215e045839179c68e78747ffdc63e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115004, "uuid": "ac26cbe8-224e-489f-ab67-6cb8f9a16b32", "comment": "Malware payload (Mirai)", "value": "bc1c767977e87ff35ff15550d7ce38298fb75f84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115004, "uuid": "3e7187c2-28fe-4060-a036-fc1da5bd0ef3", "comment": "Malware payload (Mirai)", "value": "a4459bf71e53d865592a1daf82cd2ec4e7af3c425a6561aded64590676fa4cdb9cef386e86e77f7009201a0e7ea759e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115004, "uuid": "735b05f6-10b2-4748-a576-6f991d5d9cbe", "value": "T1EF2339C25643DDB6EC1195752037FB369B7AF0B62019FAC7E39D9632D402B02B94728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115004, "uuid": "0688346c-aef7-49a9-a3e8-b5eff08a85a9", "value": "1536:R4siMVoqpRt1+fj4btHkJlYYZ5IwgJb4ai:9VoyX1+fj4bBk/ixbji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688115004, "uuid": "98a060c9-429a-4a49-9ec9-2d21b774a52b", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688115004, "uuid": "bb439575-f1e6-4413-adb5-af4aa605c4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115004, "uuid": "a5e1b38b-0b2f-4f63-8190-0a673bb4806d", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135747ed-171e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112843, "uuid": "63a3dec8-92d6-4f48-8d0a-82d3bbf26396", "comment": "Malware payload (Mirai)", "value": "82329b44fd52811f7d754b43319f51bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112843, "uuid": "6330c937-b7c0-4e5b-9a73-bb7747dcf179", "comment": "Malware payload (Mirai)", "value": "a52b450be36badaa46b059b5129f5399bf3d02b34532c86805b530d34fa011e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112843, "uuid": "0ad3b727-1e1e-4983-814a-0ac1a9931c1e", "comment": "Malware payload (Mirai)", "value": "cbcbbb47ec671bb72847b56c713c27b55169cad2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112843, "uuid": "16e064ee-2c44-4e76-8fa9-13f1bc902189", "comment": "Malware payload (Mirai)", "value": "5b0cc1f0c897eeb2f67266423861589c3d932d70bbdcbddc13789d8f0b8383382e0a76e647ae098f919e302f9c8982d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112843, "uuid": "512d0408-fac9-44e2-9037-42eef39ae42b", "value": "T186431921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112843, "uuid": "ecf4fd58-22ef-46f0-93a4-513eb3753d35", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw4:RqtmZPuutfbltZFBSJsBcfDSTFI+BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112843, "uuid": "f066a2b3-103f-4bf6-b25d-0c7a87735d53", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112843, "uuid": "c3e68d1f-567b-45be-93a5-cce8782dcec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112843, "uuid": "e8a3ce34-e840-40ed-ab7c-d8ec462217b3", "value": "82329b44fd52811f7d754b43319f51bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7c6be2-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144453, "uuid": "7fbad757-7a87-48ec-876f-5404f73ea878", "comment": "Malware payload", "value": "1a12ea2a8c0c9348d493c342c78f102a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144453, "uuid": "78e0ced5-b965-41f8-af21-585c4797d765", "comment": "Malware payload", "value": "a5a3f70ad3cc90ba5f6001a58275931dd3df39026abe50f01292f543185c4da5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144453, "uuid": "0a34f484-9196-4ec8-bdc2-a7748047ff3b", "comment": "Malware payload", "value": "c0f25eb90664b3e71da662abc0ebbc57a033c2f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144453, "uuid": "7464a868-4e06-461a-b123-77f5154cca97", "comment": "Malware payload", "value": "119689609c564a2cea28dba1cb0f5685ebe23fc12ac42da4c4026f290442c16decccb78ecf4de39d4ff2033c667bff4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144453, "uuid": "7a736546-bade-4874-a97b-a6f429495f4c", "value": "T197646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144453, "uuid": "d5855530-ff3e-4ef7-935b-2f815cebecbf", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144453, "uuid": "1c82eb43-7122-45ec-b225-f3dc2dd2656f", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144453, "uuid": "2df86252-3914-4aa7-88e4-e1185bb59575", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144453, "uuid": "c6043736-694c-4ab8-ad43-1696a913886e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144453, "uuid": "b5ab9a41-ab10-4f08-a0dc-afddabf82af4", "value": "27loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84853433-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144816, "uuid": "0a66e9cf-5daa-4c31-a208-c34e68cdb236", "comment": "Malware payload", "value": "90fc88bd24f9092ac054d8bee1607e12", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144816, "uuid": "4c351f67-444b-482f-ad14-d35489a6fe09", "comment": "Malware payload", "value": "a5ede487eb866fc79371d01f27a98052e9321b63f247ae84655f1020eda9fed3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144816, "uuid": "82124e08-9904-4948-a98d-1092a64033e1", "comment": "Malware payload", "value": "a5eb7489f3c818f59c920c77ef87a22b76dd6aa0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144816, "uuid": "0d90d102-128a-406d-837a-695293bbb9a7", "comment": "Malware payload", "value": "557db859023133c2c073fcfc3cea5276facc02767bb22902067ee99fcf5a4471cc088180fd792ad8924014957d39a2c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144816, "uuid": "5a28f87f-fbba-447f-bfdf-f88ac0e12428", "value": "T1A8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144816, "uuid": "1ef6b49d-da2a-4788-8ba0-19be9a148481", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144816, "uuid": "1ee4268a-ca56-4263-be10-e9c6d91d722a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144816, "uuid": "83f45e60-defd-4bae-acda-5591098f3dc6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144816, "uuid": "0fa15fe0-7162-4d40-bd04-c6e7085ce471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144816, "uuid": "414aea44-8ed4-4577-b326-d77b5d47d46e", "value": "71loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b4b7cb-17a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688168813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168813, "uuid": "d63817ee-7612-4b44-a4ec-c8c21e9c0a2f", "comment": "Malware payload (Amadey)", "value": "15689407aaaa2100c79018a73b51fd8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168813, "uuid": "9ef94663-cb65-4e95-9479-eeadda2dee98", "comment": "Malware payload (Amadey)", "value": "a6ce27b30945c4fdc9d85e197ebbf7b73d9c1d5a64b8dd3718e0077e24413cd5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168813, "uuid": "b4da11a5-a7e8-4d8c-bf94-e5e9ca150788", "comment": "Malware payload (Amadey)", "value": "e87757bfc49582afa58913c0076c0ec4adef16b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168813, "uuid": "61b22649-eb6a-42de-a7aa-c217c3dcb3f3", "comment": "Malware payload (Amadey)", "value": "efa5163ff7e3663657275fda25314d99d54d64b52ba22e39d1a985dc8b71928f681a0c66d8cd14696c58c878d6281fbb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168813, "uuid": "b4110811-da93-453b-91fd-f4cd7b17e15b", "value": "T15515125179D208A2DB212E72A8A4D553ADB9ECE00F6446537E3C13360EF52D1AEF0DDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168813, "uuid": "1274c9c8-b368-483b-8bd6-153b6bd901bf", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168813, "uuid": "ea9b8ef3-4510-4037-bdae-515807c88f90", "value": "24576:rrg0dN5VGP5Ad/rxUhzATgPgGcr+4QCKjXD6A:r00dvQxAd/rxBTgDc2njT6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688168813, "uuid": "5d945eea-33db-47b4-b9cc-714f1cdedfa5", "value": 881472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688168813, "uuid": "fc19310d-f283-4fdb-9e8a-55b59fc33096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168813, "uuid": "7d82481a-f77f-4f52-9218-0d614b1136e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb8b639-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144482, "uuid": "4150094d-7f54-4e0f-8b13-b02b6cf7e58c", "comment": "Malware payload", "value": "bc863fe44d037348346d28ef7dfbf398", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144482, "uuid": "1b84f662-e857-423e-82e5-3ea171ec97b2", "comment": "Malware payload", "value": "a6d13172e1e03bc9ce77e450da52f07bbfe24d907c665a22b771e213b248ab24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144482, "uuid": "e2eb8549-2f83-4185-8438-6ab67f861390", "comment": "Malware payload", "value": "0239856fcfa06bc728ebcb170dea1e8d29bd1004", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144482, "uuid": "fa37df29-d981-4ede-af6b-6e2be9c72419", "comment": "Malware payload", "value": "a159a6ce8ff5f52be2ee168b41a649bd340b20e07667ac0affaecd517db178026df970b2fb3b93963dacdcfb08046007", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144482, "uuid": "0c007c81-07ad-4482-ac23-24f0f01bd804", "value": "T150646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144482, "uuid": "a5813ed0-ae4a-4577-a493-9d9f00838054", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144482, "uuid": "0f65d6e5-a88c-41d4-a354-c49860d6bed5", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144482, "uuid": "9ca2d0c3-10c6-4ecd-90b6-41007c6db78b", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144482, "uuid": "6b2ebde8-322e-4390-bc53-0b7274577dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144482, "uuid": "549f1cd1-9dcb-4b52-acbe-e4f25646e523", "value": "31loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002fc0c9-170e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688105939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105939, "uuid": "ff7a4cfe-c105-47dd-9c44-6112303b3025", "comment": "Malware payload (Formbook)", "value": "7febc477f6e348618cc0330afdad556f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105939, "uuid": "71c76678-2248-4c97-82f8-8767cf95a3a2", "comment": "Malware payload (Formbook)", "value": "a715a5da20dda10eb010a386479f0be39ebd5ab37b8dc1a468e389226be22ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105939, "uuid": "0d96cb72-4c07-4e89-b790-be211f04ed6e", "comment": "Malware payload (Formbook)", "value": "dfee846a9787f316a24f37298b480da76d722b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105939, "uuid": "86dae2c3-d858-4711-be09-b11a05a30e77", "comment": "Malware payload (Formbook)", "value": "e9f53c0ba356da331fba6fcaacf802d69762920176a24db4cf7070edc652204f710aa5ddf8e4b2b4602b68bcb6be52c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105939, "uuid": "83e3a725-53dc-42ba-b50b-b4b935b7b4fb", "value": "T1944412B826F1D5A3D0A249304FBA67E98BFEA0261979471F37301F5EB937240D94E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105939, "uuid": "c2a855f0-97bb-436d-a904-1b5e19018755", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105939, "uuid": "134d29d2-48d4-4ebe-88bc-d304ca481a30", "value": "6144:vYa6OL+sHZRzM851eyo2QRcjg8ENYZ7QWFg/F35QcKTKa3:vYwpZhMM19o2QyjgYZ0WFgUTKa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105939, "uuid": "0b626bc3-c462-4f73-adc2-aa344408589c", "value": 262020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105939, "uuid": "416970d6-9830-40d6-8eb0-48255802d2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105939, "uuid": "70f664fc-7db9-4ea2-91ad-8ed71f861d72", "value": "PERMANENTMETAL NEW ORDERFOB$ _KORIA PORT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429f2360-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150718, "uuid": "c88d8d5a-fc4d-4558-ba9e-b36087e40209", "comment": "Malware payload", "value": "ca3b422bf506e55786f22001937b851c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150718, "uuid": "80b1caa8-9b2c-409c-9a8f-1b1e12ab48d1", "comment": "Malware payload", "value": "a74af26ef8ee96f7389a7d945c2c76774f63046bd86e1bdad5049e86da63d62b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150718, "uuid": "55280207-ddba-4141-a7cb-8c0ace4fd346", "comment": "Malware payload", "value": "267e1e29d2503eee091f504b910d94811971004c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150718, "uuid": "d6eb8d00-7dbb-42c8-8a7d-53defd1101d8", "comment": "Malware payload", "value": "681168c7f7ad214b6b595d8f6ca2271f2f0388c00f75846178f0ea431b032cd417dc05b971052b84864126045796f90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150718, "uuid": "6326f5e3-5786-4480-85a5-50a9b9a84e7f", "value": "T179E6330167F89FE9EABEAFB1A87074960BBBF8056239EB1D1E4094D718C1711E124737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150718, "uuid": "7e80f3f1-de7b-46d1-8433-a3c555fd85d4", "value": "393216:aFtb4jstNiP1h3Vu3D7lIWCisPhk4pvIu5eMnmL+s1:aFtbGstNidtVEL+5vIu5XnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150718, "uuid": "f932e313-109a-4f16-ac53-3d838e6c5f78", "value": 13943296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150718, "uuid": "861d2d65-0815-4386-8ec4-c53b99ead147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150718, "uuid": "26d8f9e0-1957-47dd-aaa5-55ba32169537", "value": "SecuriteInfo.com.Win64.RansomX-gen.15559.6870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ad1879-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169269, "uuid": "3e913120-a3ce-4944-91b5-c3a5e0676ca6", "comment": "Malware payload", "value": "d35d8d46da4bde6403fbf3eed205bf10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169269, "uuid": "738d3860-f3ff-455e-8663-6e391c030558", "comment": "Malware payload", "value": "a7670ae26b52aa65e1a8fd3b32e26cc35099752c18c6c2bbed77b55ec411315c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169269, "uuid": "f272f46d-16f7-4d71-b76c-04c1b108aca7", "comment": "Malware payload", "value": "3f2645c8aa833aed08fc79b6b0a18351cfb3e02f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169269, "uuid": "d8dd96b5-316a-4e96-8ac4-3fb2ba84f2e6", "comment": "Malware payload", "value": "4d2aa5dd1897134effc796b63f2a4366ee4a4019ebda06ac60bcd890fcfa579063bc137f363887f2562b6841f4a3c22f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169269, "uuid": "54bfa637-413d-457b-a343-63e46ef5fd63", "value": "T1AFD3281BB5D194FDC8EAC1B44F9EF13AD973B0281138B25B27C4AA262E5DE305F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169269, "uuid": "883c3f60-990d-475e-9172-a2016124a487", "value": "3072:y7465q4585ToBjxvTzHCoUzOVBuxI8gkuID9cu5cGPd:y7465q4ahcvOtefifcGPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169269, "uuid": "fad0d178-eb11-426b-ac33-1d25430ea3e9", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169269, "uuid": "65abfa9a-69b5-421a-9120-352efb6e86b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169269, "uuid": "0fe69c14-77fd-4306-8945-58d6d9fc5711", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72856121-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144786, "uuid": "33ef25a7-9770-4140-901f-01bb78ac95be", "comment": "Malware payload", "value": "a04ba394e8d0cb501c62249374813d3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144786, "uuid": "fc1e0cfc-1226-46cd-adc1-b0a6001d73a8", "comment": "Malware payload", "value": "a7ebbf668a837818c8f73b1a1f0f393ba5ced0c5d4a8722662d795ed667a488c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144786, "uuid": "d669c296-c886-42ba-b46b-45304e2c086a", "comment": "Malware payload", "value": "0ccceba4d1fb1ecb7893fca37622110579d37f82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144786, "uuid": "3c89856f-89ea-49a4-b597-0759bb93c843", "comment": "Malware payload", "value": "91fe6c6a7f1359cb1ccf9242a399719a8623b6fab928e25a3f4123ae3b4eea477e95c6e1469fce757740ab28bd4eec49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144786, "uuid": "17337964-e1b8-4481-8a05-c4bbc890328b", "value": "T1BF646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144786, "uuid": "0b5ce65e-ca82-4c51-9323-c5fc45af8c0d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144786, "uuid": "8fe703d6-23b8-4c45-995a-fd048c422eda", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144786, "uuid": "ccc9c522-7660-453f-8a9c-a0d9bd15fcac", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144786, "uuid": "bad94e6d-2385-42e9-a02d-df15ddb80fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144786, "uuid": "818928fe-05b3-4e65-9055-4418088c3a69", "value": "68loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ccb1de-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688141996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141996, "uuid": "68fb2fcc-5612-444a-b506-3c14268fa36f", "comment": "Malware payload", "value": "703c3a5b14ba924d9edfe3d5311ed7ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141996, "uuid": "51e82da5-fd13-48e5-94e9-8d0720f448f9", "comment": "Malware payload", "value": "a84917bb7404fb7a683f146cb29f77547f5f61ff57f03e11698f4674c4fa0767", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141996, "uuid": "e1ae2d46-f0e2-4ad8-b09f-53d9ed25a2ac", "comment": "Malware payload", "value": "0f0695e71096c4e2bdd4de737da0d95751f397b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141996, "uuid": "055ab02f-4a58-4a26-bdb4-e3326a67f5f9", "comment": "Malware payload", "value": "f9eb67c6c4f98622dbc303623f1223006373648fe1af7e5bdfc5ba1c9e1282482ed5ab4a5086128bd8507c7dbc0a409e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141996, "uuid": "1550abc9-c9dd-45ec-9083-68317b25e453", "value": "T19E352340AFE4EC9AC95AC03664D7CE7E3BB8CB1188BD03286554B60FDD9D7061A96CF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141996, "uuid": "fcc945e2-5159-43ba-9319-3e3ec37e1f80", "value": "b9083dd82a429a49d949568d3647ca0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141996, "uuid": "0a1f5705-b230-41b7-8494-9b3d46e035ce", "value": "24576:IhloDX0XOf4lLZPs0QvNemOReGh1kLbkZEFK0gmJBphnYf0sA:IhloJf6FFAN2ek1kH2EFK0gsBDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688141996, "uuid": "5001dbc6-ea6f-409a-b442-b2f65c1fe9a4", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688141996, "uuid": "77813d54-7b73-4f49-86e0-1ccd57fe9a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141996, "uuid": "945505e4-e522-4687-b783-2ce91fef2e6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ceafbeb-1797-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688164936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164936, "uuid": "6abc1be1-c17a-4cf3-9b63-2fb629dc05bc", "comment": "Malware payload (RedLineStealer)", "value": "455e3542c735a72f3327beee0911ed3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164936, "uuid": "a5bf108a-1124-4b57-aafb-9871aa0db1de", "comment": "Malware payload (RedLineStealer)", "value": "a8ab824da87f6df5db7402a67edca0baf3b2da422ab48dbded3d03cb9e137ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164936, "uuid": "ad51bfab-a325-41b5-9563-ded02468e4fb", "comment": "Malware payload (RedLineStealer)", "value": "6bb8984793aad07f2b553f836efa6fcd0944223b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164936, "uuid": "c3c4ca2e-4080-49fa-bc3a-bc54f05be437", "comment": "Malware payload (RedLineStealer)", "value": "05b18c672d3630f815ff7cf07c5524734125214431f017e1cf9366ebf5eaf9acef474e9426ea52d56e31cdee4c05953a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164936, "uuid": "428caddf-25ef-46ed-8995-8765ae0d393c", "value": "T1B0849E0386D03EF4E9358B32AF1FCAE8770DF1558E697B6622189E2F04B9072D663715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164936, "uuid": "c788ab74-7d8a-40f3-93be-e70dc4f93e7c", "value": "e01beb805c20903e324ef65e741d0209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164936, "uuid": "c25a0885-0d88-4cac-ab61-8b2cdb77e493", "value": "6144:CvWGT+Bbm7agZjkP2fEtHjqXS5Xr9Q/HkvyT:C+GT+BvgdkPAExqXS5xUkvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688164936, "uuid": "5b472d6f-51f5-4618-b1f7-f7128b734e18", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688164936, "uuid": "dfbea176-43c2-4078-89b5-c0ac17af1d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164936, "uuid": "8ca5f166-3392-419d-94f9-e6f10911778d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4226a8dd-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144704, "uuid": "7b2aab80-ca1a-48b5-9ab5-7f6faf20008b", "comment": "Malware payload", "value": "efa923cf20c4a59cf91901ddec0c80ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144704, "uuid": "fcd02d59-03d8-4b91-b8e3-d5793c76504a", "comment": "Malware payload", "value": "a96b970f4e5c953e0a902af5e6c09d363afe7692ef84658b10d4431c588c0cc3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144704, "uuid": "29fbc9fc-07c2-4777-aaeb-540ffa866021", "comment": "Malware payload", "value": "c45003d51982fb5e11ee79b81e939b279d8c7fd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144704, "uuid": "094b3379-4929-49cf-b8a1-eac1bb5592fe", "comment": "Malware payload", "value": "3990fb643f260267ad5279a10f1c5adfbc4a817d75fdc1a4e7c11220b9a4485eca2ec5763aa59460f47661d3468e7c4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144704, "uuid": "f8bf2adf-f683-4e0f-a250-4780d50312ee", "value": "T129646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144704, "uuid": "dcbd9464-e566-4347-b525-35526c392973", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144704, "uuid": "8849b312-0896-4069-91e8-f86acf4ae0aa", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144704, "uuid": "b7cd9435-2083-457a-8574-b64df70b2050", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144704, "uuid": "6e97e49b-9e88-4c01-b1a8-e9fc9dde70b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144704, "uuid": "52d79ae5-8a37-488c-a6a6-8a35896fb3ff", "value": "58loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2fe9e7-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163087, "uuid": "6a1c0599-021e-4cb0-b885-985a697fc155", "comment": "Malware payload (Mirai)", "value": "a659044aba6466af0b9e9a4e4f4bc495", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163087, "uuid": "38546ec5-b2a8-417d-b14c-19e05dd95d7c", "comment": "Malware payload (Mirai)", "value": "aa4f4276b41575885ddcfd86da7ced8a34c102487d44e02df9eb0c222d255a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163087, "uuid": "f47e4344-8b2e-4ae9-9a27-6c7c2d27d90e", "comment": "Malware payload (Mirai)", "value": "f430d22de699592aaa2077835530fcfbaeffaeb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163087, "uuid": "d28864e7-9788-45d8-aaca-f4b68f757fca", "comment": "Malware payload (Mirai)", "value": "5bf3e89b3245604353cb85f4ac2a77c75b509e3668d572dba03836bebe5a70a1fd0d0b9660092238927c13c60c82d68f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163087, "uuid": "9fed398e-24e1-4cb3-b939-31fc95c22fe7", "value": "T1D5C2E1C2D59D495BC458C1BF117927A684D02CD10B699217761CBBECFC8F981BC28A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163087, "uuid": "728f678e-31ae-4c4e-908e-6aec729b5b37", "value": "384:M6p2ajqPYfLjUctjICT/SbPtHwAPcecwN57VMR6zMOuoVltm4W9buUzjHnyN+QdT:kPYzgcbabPtHzrcwv7bdsPTHnyN+U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163087, "uuid": "81e12259-1ced-4788-85be-da75f0fffd21", "value": 26416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163087, "uuid": "c1ca6624-e361-4707-8cb3-1656ed2a1cf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163087, "uuid": "03e6657e-18ab-4fa6-8ed3-a47a6835eb31", "value": "a659044aba6466af0b9e9a4e4f4bc495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b1f25-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137081, "uuid": "483f4f0d-3254-4738-81a5-b10784335595", "comment": "Malware payload", "value": "cb69b8f8a225cba9fce75dc29cd52c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137081, "uuid": "de3309f5-01bb-4b01-826d-d96ef8aee468", "comment": "Malware payload", "value": "ab1c423a3c58bbbd474474afed53cb37b0c39a4bc32dda506fa3117b19769129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137081, "uuid": "18cba19a-81c3-4814-934b-40650a3ffaa4", "comment": "Malware payload", "value": "bc3723b72b00749b9a3cb53109da783a0de9b3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137081, "uuid": "9d2bbbbb-3e1e-4b75-8b04-37b384c8ab85", "comment": "Malware payload", "value": "845e6fc88a5409df07a2876eb9de8bbfaf5b3b68367d415a9de9ef40740a64f3ff76ebfc7f4df35284f20ba8128c4c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137081, "uuid": "d9af16b0-23c6-4fa8-8992-6c68e016fa46", "value": "T173251202BAC288B2D5621D375A386B20657DBD202F35CEDB63E47A5DD9315C0EB317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137081, "uuid": "503d579a-a57c-496b-8fba-97dd2450f249", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137081, "uuid": "ba05a924-542c-434e-9740-820dee39b11a", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTi:IBJctgBhc6Kus+9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137081, "uuid": "813cd8a4-156e-460e-a77a-83b0601b964c", "value": 1016087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137081, "uuid": "94cd0236-0c8b-4d5a-ab8f-bcad20601532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137081, "uuid": "0d9d941d-93f8-4178-a612-4d6f3d16cb14", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa4a3d4-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108220, "uuid": "359ba34f-a970-4c65-9066-d12d7bc9ae95", "comment": "Malware payload", "value": "159aa3aff98cea91f8822ae6aa23d6ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108220, "uuid": "f9d66f84-90e1-4bf5-9fb5-e75d86a82924", "comment": "Malware payload", "value": "ab832b3674c93aa34edcdca78cde231a74e4cc1a2c02836a910491a33936a4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108220, "uuid": "06ed6152-e3a9-4867-892c-59febe8ec527", "comment": "Malware payload", "value": "0ba041331626547f60ccfec6364647397e45fc05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108220, "uuid": "4de48a93-5481-4dfc-8943-7171d720dd18", "comment": "Malware payload", "value": "82647809b6368891969e8474fff455b515b424e994ee67a3e156ad4411fb3acc86a1acf00254b7f984e75fa6c1ac2222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108220, "uuid": "87f2a86c-533f-4535-9f84-73a17def4590", "value": "T14894CF81B77ADFA2DE3943F981A314512BBA202F5410F7545CC770CA2931FB681AED6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108220, "uuid": "5f9962e3-8774-424d-8bf0-d9aa19e3a56f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108220, "uuid": "68a99689-a7f9-4621-8aa8-511237f14d7f", "value": "6144:F82nTFKbLkeEJchg8UHQKLKL5Ncgh+yWSisy+kw2:a2ZKn2aYwKLU5NcoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108220, "uuid": "08707aea-927a-4973-928c-00c8b544bf58", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108220, "uuid": "d4b5ee40-5e31-48b7-acda-c925f6ef2182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108220, "uuid": "5f842c80-54bf-44a9-a3bb-2fc757c9aa42", "value": "PO860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3b7343-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159490, "uuid": "b5725083-716a-44d0-b6c6-f05dd1f42f2c", "comment": "Malware payload (Mirai)", "value": "04d828253720317d685060641250829b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159490, "uuid": "8dca2c04-e35c-4768-83b9-8f3b6c6450de", "comment": "Malware payload (Mirai)", "value": "abdca333ef1a189a41a7c7053157fe661e508fe2717a646dc0304cb64759b8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159490, "uuid": "46c96ef5-2513-4233-ad0b-1584c9adb8b7", "comment": "Malware payload (Mirai)", "value": "c4315e57042639dd634dc8534dbbf92527999d13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159490, "uuid": "99409cbd-a756-44c3-a9ed-0f9b8278b536", "comment": "Malware payload (Mirai)", "value": "ed54ae28463465ded77fc555a4a23e1535e3f1b61e016ea9b728d46ad9a786b27031f05a0efc9f20dcbc3ff52d5b4dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159490, "uuid": "743cedc1-d1bb-4285-86f0-73d21bbda587", "value": "T1A3735D24A97D2E26C0D4A17B61FB8321F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159490, "uuid": "6168fd17-d26f-42a3-9d6a-357b874834ae", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8L:YwfdNu4cmZvFqI3w7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159490, "uuid": "b8d88497-951f-4ab1-ad3e-c2476db1f533", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159490, "uuid": "3b6c4576-d4c0-42ae-a4c6-b8b45d8cc7e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159490, "uuid": "944b6d4f-ed81-4331-a173-51b27f86e4ab", "value": "04d828253720317d685060641250829b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3824685-171c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112253, "uuid": "817f81ad-581f-402c-b5f3-88fdfe99d928", "comment": "Malware payload (Mirai)", "value": "8a48626633f89a53a3ebcefcb41ed1e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112253, "uuid": "99a132c7-593b-4a46-a8de-0938d13ba5ce", "comment": "Malware payload (Mirai)", "value": "ac7e69076d879e8d8c34f21742bea975fe1067a1bd719058b5074d0b618ccfda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112253, "uuid": "97fc74c9-c159-46b4-8c82-8c60b3bb83d6", "comment": "Malware payload (Mirai)", "value": "6b7ac94a98a5ade70fd8c23b288d414befce8e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112253, "uuid": "5cfb002e-bb35-4645-886b-5e37fccf019e", "comment": "Malware payload (Mirai)", "value": "0d4d6229441c758e71247562939798a5333c1da6a00e314beb88a9b3e58e7fde80341aee63e61eee532657225f7044b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112253, "uuid": "b1315a27-8b54-416f-ae56-47eba10ab816", "value": "T13E33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112253, "uuid": "c8746cd6-c436-42c6-b58a-8c370120f7c1", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGQ:r/hqaJMeteqK806MHdkfQX6HuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112253, "uuid": "bed0c4dc-cd59-4679-b81c-89b61e357474", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112253, "uuid": "d8063c79-6370-4644-9670-4fc7c6e599a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112253, "uuid": "fc6c336d-d0e4-4b67-b5b3-2ca7b8713221", "value": "8a48626633f89a53a3ebcefcb41ed1e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d52171-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144675, "uuid": "158a52d6-3547-4e21-8e14-733d95451d8a", "comment": "Malware payload", "value": "d35342b4175abd3cb8e8f208a3d6cd6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144675, "uuid": "b8274067-a2c5-4d78-812d-88682374695c", "comment": "Malware payload", "value": "aced7c3abc561982312c77f76eaf0f1f097d0d8cc75dcec37606e0f62c737a7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144675, "uuid": "f871c9b5-1a3b-4f8d-bbe8-fd255c0a37b5", "comment": "Malware payload", "value": "f8f17146d31b8b67cb1d3d9d72fddb2a62577750", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144675, "uuid": "6d8daf3c-5577-4da5-85db-51bbd786313e", "comment": "Malware payload", "value": "4eb2d3c357f0632a651806ec685424c8e7ce33bc2a46ec84260dc0f5618e9b77f4a992c53dc192ad57a8c94cb217ac6d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144675, "uuid": "3d7c3907-4baa-4112-96c2-eca60e03c405", "value": "T167646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144675, "uuid": "67eb8c85-92a6-47cd-9b8b-0d36b9f783a1", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144675, "uuid": "b95b1da6-2685-438e-9fcb-5712c34afa75", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144675, "uuid": "2f4f38dd-a5b0-4346-834b-d0bc78c32484", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144675, "uuid": "31a0a10d-6da9-4f32-bde5-c296fa27355e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144675, "uuid": "4be3864f-8c00-4ea2-8bf6-78a72d5cfd40", "value": "55loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fda46c8-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688131440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131440, "uuid": "7d51aab3-582d-414c-a0dd-fefb002c475f", "comment": "Malware payload (Formbook)", "value": "2d940a322d0b6f52b505ebe36cc6dd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131440, "uuid": "90a5dabb-e783-4972-8b1b-d60a9834eb2f", "comment": "Malware payload (Formbook)", "value": "ad1ca63f77662125df76d05e0b575113787abacc09017c0ef6ded375dd8259c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131440, "uuid": "27dd118c-eb06-42ec-a04d-35bfb0921667", "comment": "Malware payload (Formbook)", "value": "d4506810ff2f219900fb240479eea3f97d4f27e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131440, "uuid": "b07cc281-46a6-40b1-be83-49b558cd6d91", "comment": "Malware payload (Formbook)", "value": "64fae8525c610f389da4870760611626ac27a57f85d374641bbfb77da4b7e0570a1c477e74b5bfcef8c2eded305b959b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131440, "uuid": "8a8da5b0-3cb2-452a-80a0-6c04078c5fb8", "value": "T10CE4483D29BC5323C074C3A5DFE1D723B224982B3121EA665DC39B954796F422AC367E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131440, "uuid": "25af5892-2fa4-4d4c-bb17-f1f5498f0035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131440, "uuid": "859ae365-a955-486f-8af1-fb2f1046266e", "value": "12288:LFsoJuSXjmOEF/mEIugMaolGDM1qzn6cfZtf7cR2nuqBpWKT0:p1JFPEIugkUzn6eZtjcRoBpWKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131440, "uuid": "076e7d1e-8a94-4508-bfc9-fa98935fcb51", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131440, "uuid": "fa58abfe-fca0-45f6-91e3-06070a60276d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131440, "uuid": "be02c3ca-b671-47f3-b8f0-3ad31000b78a", "value": "z98Solicitacaodecotacao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26220a0-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688110936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110936, "uuid": "9631216a-45b2-42de-a984-649f21463f0b", "comment": "Malware payload (Smoke Loader)", "value": "8d95973cbca243683a5ceebd38af2f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110936, "uuid": "6c4e77ba-cbf1-49ed-b921-fbfc79036954", "comment": "Malware payload (Smoke Loader)", "value": "ad509e9a6776af2ad47e31722566921a62737b2eecf54fa5bb601304429c1a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110936, "uuid": "8fe83975-d7f3-411f-993f-f2fd322f9f44", "comment": "Malware payload (Smoke Loader)", "value": "659f567e799f90bc9c2e348f9f842096b3442728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110936, "uuid": "a6b232bc-23b6-497b-86eb-b4c5bfe89a27", "comment": "Malware payload (Smoke Loader)", "value": "6ab049eacde76933767ac3aac31c46a233539e252e933b4538aba656f4ace514a5681f19cf4db634cc2ed32c50af1998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110936, "uuid": "31e5b872-e9df-439b-8727-229404c1e816", "value": "T118544C03A2DC7F61E5E54A3E8E3EF5EC761DB6604F293B5A12385A2F15B12E3C162710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110936, "uuid": "38387f67-0c62-472e-8ecf-277f4b670007", "value": "0bd2f32677a0e93201a9419699247165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110936, "uuid": "9416dc11-06d7-4fae-8f11-7b5e3c924aff", "value": "3072:Q0xiMYj+v1QSYxHZz9OLMLT7EgKoTdBg5EtFKt1aaBiwKZ1:SRSYxHZzflhhuftWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110936, "uuid": "11fca87f-5419-4137-8176-f912708df0fb", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110936, "uuid": "af607962-c880-4990-b862-4a707d58537b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110936, "uuid": "1af06c04-2bfc-4226-aa46-ea6d5549ba92", "value": "8d95973cbca243683a5ceebd38af2f14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2648358a-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108150, "uuid": "a73907da-be09-4ba1-b3f8-ee2521da9953", "comment": "Malware payload", "value": "cf56d3719af5f985ccd930f9b7a3b970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108150, "uuid": "d87f539f-1aed-47f4-8abb-ebc97538a332", "comment": "Malware payload", "value": "ad938ff252a3dc036c86792189f1d91f80146c75c089d6cc7135a99507a13828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108150, "uuid": "4320284b-d5e2-4971-9400-b16f6aaf3659", "comment": "Malware payload", "value": "b6dfdb7a0f3908ebc79396a9ebaf6d5e7c61e88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108150, "uuid": "3fb10cb4-200e-49ae-84f7-64bde6acf56b", "comment": "Malware payload", "value": "2eb44023fec0a1156e712c627d0410b4fb4c3c585c1e9b797cd004cab43459027ec7984e806583161acaccf27f70753d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108150, "uuid": "d762ee33-4cfe-4236-8a2a-c4b76db59b63", "value": "T112551202B9C148B3C57318335A785B20593DBD602F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108150, "uuid": "19da2d8d-89cb-44db-bc15-410c22e29c92", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108150, "uuid": "5694d587-375d-49f2-b59d-9f466e3b1c25", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnAZ:IBJctgBhc6Kus+9gO0qnAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108150, "uuid": "3d036aa4-0513-45a9-b79e-4a1ea2e3b2be", "value": 1351903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108150, "uuid": "94e0409e-6616-4a9e-b179-28cc5863f936", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108150, "uuid": "6b073778-a0ee-46c1-9781-18ca106b6c2c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362644b2-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150697, "uuid": "ad61d1ef-a3b5-47a7-a537-bb56e2e7e456", "comment": "Malware payload", "value": "dbcd9b091c9e4bab30762d651160f8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150697, "uuid": "dc94d29c-3dfb-4995-8e7c-5b42a5535ac2", "comment": "Malware payload", "value": "ada1ba5fc7ed33503da1724eb04a1826ebbfbb4d88c07920db1c6e82d6f0b36c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150697, "uuid": "53a12540-2cda-4ea4-a4b7-c6de6e07c349", "comment": "Malware payload", "value": "8eff9deff3e41f22e9b2328f33b38f83d6f33edf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150697, "uuid": "dafc1a33-560d-4189-8db0-1c1465815ebb", "comment": "Malware payload", "value": "b9dc736c315547d170e7ddfe517e5d7ac1b8c779fb5e95badc06f3f6f5bf19954462c6111669a83cd1f775747a5dd268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150697, "uuid": "f946ecb5-22fb-4558-afaa-cd647ee5dc98", "value": "T1BEC633F762DB9C11D9B7DB7B968341C21139F8636B0CD56B708C64ABAC328DAB230745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150697, "uuid": "88496d99-d9a2-4567-906d-3593b27548ad", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150697, "uuid": "9b176880-a8c2-4927-9d8d-703044616312", "value": "196608:HQd/CD4BXlyuK1ieR8ef1fDwRxvhU8MYhtnpECdAYTkbbjcluzLhg/fXfvma7Lm4:wdU4BVyfpRpxDy81YhtniQRTsbjWcIf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150697, "uuid": "a4e06a87-99c1-4a91-a581-85e5277d9f32", "value": 11777024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150697, "uuid": "b4aeff51-c431-4c2b-a83d-fe72f6ec35e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150697, "uuid": "67b4d2ca-a7d5-4fab-b795-84e703cca3d2", "value": "SecuriteInfo.com.Trojan.Generic.33988026.11017.5826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9282d35f-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688109620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109620, "uuid": "2e9118db-3232-43a2-bc60-5176de8920bd", "comment": "Malware payload (GCleaner)", "value": "dd6dec3600e3092e9f1969ce6357a1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109620, "uuid": "105e3500-41e9-4c1d-8df7-b48de377f2e7", "comment": "Malware payload (GCleaner)", "value": "adb6fcdf68a54e44cbc8e720040436958931ebbde6ba507ddff6fa20ec8b9774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109620, "uuid": "a203bd9b-ab58-4a16-aa16-f5ac07f69768", "comment": "Malware payload (GCleaner)", "value": "c342bd4e0b3c106512107cd6d63593ce0b500783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109620, "uuid": "d5b14cde-2926-402f-bdc5-27e9f6fe8d50", "comment": "Malware payload (GCleaner)", "value": "99b08941406d31e7a25bf970a1430201276190d20a9e4efc2c11482287c018a688aafb4de6d666e3118782f21a6d5dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109620, "uuid": "f085407e-3c01-4052-ac70-3be54f542f70", "value": "T195452343F7A5D5BDF7B25ABC6C6888740A377D6A2E70810839CE71CD28775528D2BB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109620, "uuid": "8cc97905-406c-42ca-b628-2b458f810832", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109620, "uuid": "2a9d19fc-5fe2-468c-a12b-c8e0138ee649", "value": "24576:+fOyyb8QeQBGiz0W5n3LK/eANTn+c5he1rARpJjBBp/D:+G7deQBGm0W5n3OWANn+6hk2pvBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109620, "uuid": "fa271df5-9707-48fd-9f2e-03bb3ccfed96", "value": 1257745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109620, "uuid": "e34d2319-386f-4366-830a-81e8fcdf41a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109620, "uuid": "6befbddc-5c5b-4fd4-b052-e2794da6694b", "value": "dd6dec3600e3092e9f1969ce6357a1bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89de451a-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688111324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111324, "uuid": "f8bc9038-2c68-49eb-bb5b-25e63637be81", "comment": "Malware payload", "value": "840ac0c93e1af97fc71ca3874b8c69d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111324, "uuid": "0036765b-04db-4adf-994e-5bc0007ca276", "comment": "Malware payload", "value": "adcf3658371d890b3b240d10a78dc56aec866b6d4c7691b0450adab0c8b2f37b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111324, "uuid": "b9d43b56-ce0d-4816-b303-017271358e9f", "comment": "Malware payload", "value": "f42c6f60c913df9807ece8ad2df77a3cd91e246a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111324, "uuid": "3679717a-e7d5-4f7d-93ee-230ca0c90fe3", "comment": "Malware payload", "value": "759c02309ce2ac713d4b28c685c38a73446aa7fae51976e462d1ff9693522b75643c3011ed69b28d4ffdc05a24d0bb2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111324, "uuid": "ae99a466-ae4a-4b11-af8e-edc416723edb", "value": "T1D2C4F11339FC83A4C2FDF933C15DF9258A3AE7601B72298BA3D4A51E1E607409636BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111324, "uuid": "f22c41f2-0a69-4e6c-abe2-fb458d6c4dec", "value": "ae3313a7e55f2835265780c2d394ac1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111324, "uuid": "a0e8ee29-72f6-475a-a10c-891d2089807e", "value": "12288:RGOXZF/AR6tnI5LcLIUG/C0AsBHs32EyuEXHBc1:Rh/QSnK/VrNs3IuiHBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111324, "uuid": "e54c003f-4052-487e-b238-cd4604d2c575", "value": 546440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111324, "uuid": "192a37fe-bbad-4a71-a238-5b242cd06d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111324, "uuid": "1ac56809-aca7-4714-8c60-5911ccdef4ae", "value": "840ac0c93e1af97fc71ca3874b8c69d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e40ded-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688150722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150722, "uuid": "a7dfbc75-e9c5-4a78-bb84-7c08dd509d46", "comment": "Malware payload (RedLineStealer)", "value": "e2f80f75049fc5b335cd14cc1e36ce8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150722, "uuid": "72ad9b53-50f2-4aa9-a040-ff81662ddf17", "comment": "Malware payload (RedLineStealer)", "value": "ae025809e03a89496d161b722b94d9ce5eb1f0bb74fd8c814fc82a9eac757c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150722, "uuid": "64cad4e8-4133-4d19-b8d1-ef05e00919d7", "comment": "Malware payload (RedLineStealer)", "value": "53e7800606e0b7779bf9293a096f234c06495c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150722, "uuid": "7ca343c3-02c2-42d3-a240-982e168e8f88", "comment": "Malware payload (RedLineStealer)", "value": "178483a1991ddda970fd6fd81416e60e26cc280595cbe83fabcf77b59785070580ac3e683f895ee589ae6aba25f2648c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150722, "uuid": "de4a3127-13e2-49eb-83e6-933cfb925d8b", "value": "T1C846220BBA5A9FE5C35F5F32C59725000F39D282776BC31F798A13A636C37AAA941407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150722, "uuid": "31ba4384-91c7-41ce-aa36-d50b71517285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150722, "uuid": "ee86c1ea-2c29-4c33-aa1e-369c02fa19e0", "value": "98304:WglS84rSm0QPTnnkvg3GPNGxpInRSWVko8FvGjhs:W44rdLPjkvgWPNqpInRHV2vEhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150722, "uuid": "218b4d7a-9c42-49eb-b105-e4539f9094fb", "value": 5829632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150722, "uuid": "129ddefa-b005-4687-86ad-c9213cff485f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150722, "uuid": "434185d8-aa17-4d28-80b3-ef24d0ede3f3", "value": "SecuriteInfo.com.Win32.SpywareX-gen.15264.26149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf0542b-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688140909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140909, "uuid": "c699dc66-2745-4114-b48a-98d2a7a3a9b0", "comment": "Malware payload", "value": "13c687680f0aa0eab400b42107b92a15", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140909, "uuid": "b602c8cb-cae1-4cda-be4b-631cb169eb53", "comment": "Malware payload", "value": "ae9cbd3196959c172d223096973c85e6aa88583164b9ab60ef0ccec0c12b3d08", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140909, "uuid": "526861c2-ef82-4636-9114-482cad68b1f8", "comment": "Malware payload", "value": "79dac4abf8b10b8d674e761178c190d2e9eb7e57", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140909, "uuid": "03ebc8b4-9442-4525-934c-da49599eba57", "comment": "Malware payload", "value": "e21ca8c3cbd80a4cc02f419df73a89bed824cf4ef27fa2099e224e9a8d2117a8d54dba8c429cf9be610880bea690ad61", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140909, "uuid": "cd16567b-6fb3-4e20-9e28-00fa2cdef222", "value": "T1A246334B3C23DF2E1B424559A88E91BAD070C6E936B88DC23FBF0784C52B7D4499D99D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140909, "uuid": "82869a34-0141-4659-8fa6-9849380999b5", "value": "98304:6oOwIO+5Ca2yf/6fxAXoxHiYdv/IHMs78YD85K9cB1qeG5MdUHjAywMcul+gTmGs:6oJ+k4yJhkYdv/wkYD598aqdUH9+2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140909, "uuid": "90cfcac1-d7de-4349-8c94-e1906558e116", "value": 5383720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140909, "uuid": "215fcf60-9114-4833-9d96-929ce4fb2e14", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140909, "uuid": "7cdd314f-30e5-43c5-a118-77fed4fa7eed", "value": "factSiinueva.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a155c5-173c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688125920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125920, "uuid": "d778aac1-3ea3-4b5c-bb24-d4f1b78fdac7", "comment": "Malware payload (AgentTesla)", "value": "5e4803c828c2114bd84a716ef57beefc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125920, "uuid": "cd1593db-d15e-4a8d-8dc8-bbb21e30a154", "comment": "Malware payload (AgentTesla)", "value": "aed00c25c329f6b88aa005feac5d2b1b73e8b46303984d194aaef41c84e2ed51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125920, "uuid": "46db92e6-912b-4efd-85d6-c904eea925b3", "comment": "Malware payload (AgentTesla)", "value": "6189611c98b3c14b0256ce7cbae178c6723d9f30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688125920, "uuid": "e4e5c253-1c69-4c94-aa4d-c32146c68e71", "comment": "Malware payload (AgentTesla)", "value": "4142bc164cb0d1b0e0856eb219f215c788ab11a9ee1b595027339a9eca8775f683e28b55e590a129608c496a77139b49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125920, "uuid": "b9d10e4b-2aa2-4ed1-bec8-9771b1767806", "value": "T172E4183C6B7D9A22C034C2B5CFD584B3F2558F3AB411D522588A7BB56762B921DC332E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125920, "uuid": "a3ef190a-73e1-4975-95f8-63a18c5b8603", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125920, "uuid": "5ac01062-e79d-4606-8aa0-20fb9e8e744b", "value": "12288:Acj6ZyEW4lnmoDHvzBzHMmZNKtnnY+DMb+1f41+NvtXJtTywhu5ONj:VcyVunm67Bg2NKt94i1i+NvtZt5u5ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688125920, "uuid": "92465227-3fdc-4139-88e4-7f0880e035a3", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688125920, "uuid": "4e50025a-fb1f-4a8d-8547-bcece5910fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688125920, "uuid": "e933ffe1-696b-4873-b73a-bef646ad4e10", "value": "235080 MID-ATLANTIC SALT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3989a7-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144807, "uuid": "3fa3e39f-ef68-44e2-9488-670dcfbd4ae3", "comment": "Malware payload", "value": "408d6f9867493909d3b30403bc8737cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144807, "uuid": "05cdd67f-48ca-4a29-8fb6-7c4bf314ee10", "comment": "Malware payload", "value": "af6135fc68f7234e225fdf3a0a164e7618d9ebfd22c6b11f8fb546f0fae7a3f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144807, "uuid": "1ff56f1d-529b-4cfa-9364-f0ab39b5853e", "comment": "Malware payload", "value": "8f8492b5f072c1e852271f654fb8ccecca225a98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144807, "uuid": "b289e63e-b70d-4cae-9e66-74939ff15643", "comment": "Malware payload", "value": "ca2fe0f90394d0a8f52110bc9a68b15f0b5f2b96a8d56ef6b97556571cb4100973b8c8395bfb2bd69d6614c518786a8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144807, "uuid": "89181cff-b475-4df8-9bb8-9fcdc5bd5232", "value": "T107646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144807, "uuid": "613bd7b3-21a8-446b-af37-d35daabf507c", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144807, "uuid": "046dadb8-8645-48d0-828d-e7200ddec095", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144807, "uuid": "d2e93bf1-11ad-4e32-9f6b-8f7b3ddaf43b", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144807, "uuid": "a7859d03-66a6-4c41-b237-88e4d8f74452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144807, "uuid": "3650705a-ab7d-4a0d-9ac2-8ded22097091", "value": "70loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d2e885-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159481, "uuid": "1e102923-dca5-4816-915e-cffdde0cc6d7", "comment": "Malware payload (Mirai)", "value": "035404268a57b6c0eb5563270b8e9613", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159481, "uuid": "4eaa4802-aeb7-4465-accd-7f0c141e289a", "comment": "Malware payload (Mirai)", "value": "afa7ef8c31540563dad1b3648a4e522d1d5575b94188559a72fe5bf789b18061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159481, "uuid": "b3634da2-20bf-4d3a-a867-f7dcf9583d01", "comment": "Malware payload (Mirai)", "value": "5f322c6b4004cfa60b77cb2f21fcb42822866395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159481, "uuid": "3f1ebaa1-4ca7-4a28-ac2d-40466345a383", "comment": "Malware payload (Mirai)", "value": "82042d4e443a947ca8b881a975db6ab0e741ebfe7e20e5a2bec8b51587b8e1c05294903f658a627f2b7945672ca34175", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159481, "uuid": "26b41353-67dd-4333-975b-fb3d8aca1662", "value": "T138B2C0A7B15B4996EEFEAAB02DD8D2F10BB20F5FF7D38B4932502A2005154177A10AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159481, "uuid": "2a4c3197-f273-4a7a-a0ce-a22ef94fa189", "value": "384:zhK/MDtv399iGtmfrSyhRIjTQ1Dk25OUEDa1A/fzy0M96cqWeOM4uVcqgw05VxJJ:tNDd99i6m+yPIgBQJDa1+re6cqP4uVcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159481, "uuid": "1ae0e55a-b0db-4f16-844b-6ef61775cb90", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159481, "uuid": "f5d92daf-993c-4b51-b9ed-80b55875ee67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159481, "uuid": "f2d51e60-638d-47ac-af17-0168bbd28ee9", "value": "035404268a57b6c0eb5563270b8e9613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5201f2-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150713, "uuid": "fc68cbe6-1532-498c-bec6-58a01ca0551c", "comment": "Malware payload", "value": "efdba66570151f0c6112b28263b2045b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150713, "uuid": "914396d6-8d7f-47ca-9129-bd31cb952c7f", "comment": "Malware payload", "value": "b219506b8c5418d07c30c49b40ba373e2f21100fe529d79ff675941441b5a02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150713, "uuid": "ed39301e-fd28-4812-8e32-727d0634cdde", "comment": "Malware payload", "value": "7ecaee9829d7859bb069ee0baf9c0bc62807213b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150713, "uuid": "654704ab-fc4a-4877-bba6-ebe472579642", "comment": "Malware payload", "value": "e8701264e3a032dad30b663c63c15fd2f177dcc1056df3f4e653049e8b98c4b68f71c9fea90e6aa8009ae65ccf6ba9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150713, "uuid": "571d0611-dcee-4fde-b903-a829c6fff356", "value": "T1BE56020CF35C9B57EA8F07BE93B2805887BDC6009156AB8F1E4C92F55943350E98DDAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150713, "uuid": "59b7abbc-cb9b-4b9f-83e3-c21aa46df19d", "value": "196608:F+63s3ga/XCvzVq4ts6BLHhAXVdqbSO6+A:VSbCvDS6PATqeO6+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150713, "uuid": "385968eb-d7c1-470e-b841-7c7d8319aaa2", "value": 6347264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150713, "uuid": "6c5bc382-f9c3-4c95-b438-9c64c6e1435e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150713, "uuid": "fef5b1c1-1dc3-4736-8a68-14ab668ea01c", "value": "SecuriteInfo.com.Variant.Tedy.386572.16678.17061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ae95f0-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150693, "uuid": "da1eca43-934c-4a33-8735-655e75a2e5db", "comment": "Malware payload", "value": "dce307b99a32a0005f12deed74491566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150693, "uuid": "73e41a15-d516-4318-9732-e19b7b62b0ed", "comment": "Malware payload", "value": "b2f8798998dde06bfda72a267a2373aed76a65012493167d0fa43e905388b2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150693, "uuid": "c3fb9079-8f28-4b19-81b2-c48629634edf", "comment": "Malware payload", "value": "4104f84205aaa994996b74daa865c6c9f616238f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150693, "uuid": "42d38d21-6b3a-40f9-be00-3e06b30a489f", "comment": "Malware payload", "value": "ca457c163c7f14585a8f2c6352d70af84f9236bc41f745e69533898a7e2eafba68040a6680793e69c7fca05def0e9784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150693, "uuid": "6fd21a95-70ee-4f1e-8b37-59428ba5efa3", "value": "T120D6239BB7879E36E64F01BFF425A91DCBA2D802E187F78E919D9DE02182312DC4C157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150693, "uuid": "99625734-70ec-4299-b1b8-21bc97c4c6ac", "value": "393216:XcvPpIxXtqV3WcyDf+eADMof1P/bD1nf0qp:Xc3It2GTTXsdVMqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150693, "uuid": "71848c84-cd5f-483e-b2f6-16118e94a2d9", "value": 13655552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150693, "uuid": "0d0a0868-b29d-4260-8712-9e1acbf9c3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150693, "uuid": "1543cf1c-6b84-4dfe-9587-780facf51d2f", "value": "SecuriteInfo.com.Win64.Malware-gen.24598.20945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bfccb5-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163100, "uuid": "66c8f548-a82b-4b28-a4e2-839ba1d6f419", "comment": "Malware payload (Mirai)", "value": "efca3d599117bd4af5a553c0cf9071af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163100, "uuid": "710b62b6-2ba0-4d8c-be9b-6a184b336d3e", "comment": "Malware payload (Mirai)", "value": "b3284cc047e620c08b151564d9d88019c5c9d359300dc9ae567de0b62d87b8b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163100, "uuid": "083feb61-6048-40d8-be20-833e16bdf372", "comment": "Malware payload (Mirai)", "value": "3141d8a04792d4aaedf5bc2c589e4b1f7cb0dc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163100, "uuid": "5a19ec9f-a65c-4879-bf1a-2c098f932dd9", "comment": "Malware payload (Mirai)", "value": "081c4624e6097f8ca3019a77c1f22d2e8b9a94e801ccc92bd82a5a1e314b5cbc9e2667b79614d62ab8c4d791a03af393", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163100, "uuid": "eedfea88-3d90-4267-8e18-752f798e21d2", "value": "T1A3338DB5C578EDA8D1144A78BE248E749723E100C6A33EFADA44C6698083EFCF1583F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163100, "uuid": "b3706032-cb13-4abb-a2fa-2966f2c61a46", "value": "1536:Ua0dwtW3xO/SkMfs3nOYGpJLEuVmtCwu:UtdTwgf+nOZp1Vmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163100, "uuid": "f626bea6-b82e-4f3f-965a-8bb2b3e8efed", "value": 51668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163100, "uuid": "568fdf5d-9b2d-41d9-a4a5-ed061ace5a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163100, "uuid": "7473a3fc-3601-42e8-b64d-1978a67fa758", "value": "efca3d599117bd4af5a553c0cf9071af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ec1b28-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688145009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145009, "uuid": "da8765f2-bdfd-416e-a4bf-295f390d6a38", "comment": "Malware payload", "value": "e4752dae300f9a3fbbe115e93f821bba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145009, "uuid": "9f0525bb-8888-406b-b6ef-1e956d021425", "comment": "Malware payload", "value": "b36badbfabaa9a29e13e8a153f26e5647e3e608ccb74d835db2af56682bc69dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145009, "uuid": "cc592d50-95e6-4136-b54e-97b9e59c4df8", "comment": "Malware payload", "value": "9a37c0bef529ffe0913553204a12d039116ddc47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145009, "uuid": "034378fd-b477-4e32-9c40-e6350ce92b4e", "comment": "Malware payload", "value": "6f23b91489d59c29a51e5c63eac27c35c305f289fdf622b28b80b235c3c827a6f88e710b7f7f68a6d6c77acb5ce6a493", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145009, "uuid": "5f4f286c-0191-4eaf-bceb-c4c1c89bc842", "value": "T1A6646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145009, "uuid": "d18d9310-140d-4e82-9769-c75a672c8c82", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145009, "uuid": "7da5711a-926f-4151-86a6-ac01fd8ca729", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688145009, "uuid": "b1d11da2-db1c-46e6-9264-5743d991fa18", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688145009, "uuid": "022f40b6-aed6-4483-b4e8-1795a8dea4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145009, "uuid": "eb2874ac-d52b-44d9-805d-1c6007d404b1", "value": "9loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c71ad32-170d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688105557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105557, "uuid": "69e55b17-4e26-4f6b-b058-e7b45c3fd4a7", "comment": "Malware payload (RedLineStealer)", "value": "ab0c054bf141c5b801adefcbd27c0b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105557, "uuid": "ea961441-d13a-439c-8770-efcba8b7ae13", "comment": "Malware payload (RedLineStealer)", "value": "b3f3bb14379a2bd38947031d90c8408ea308009de631e9132d643b20ee645a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105557, "uuid": "99d83089-6525-4224-9610-3de47fdadd53", "comment": "Malware payload (RedLineStealer)", "value": "c257066faa26635948f5a1ed6632fd8462960a05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105557, "uuid": "067ff5b5-4792-4cd2-976a-a6b9131d53db", "comment": "Malware payload (RedLineStealer)", "value": "0de426390c6d3f64541ef31caf3335b4c6e311587d131a16cb4c12928cbe1843528ba79d8666a91885e36635f9fca9f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105557, "uuid": "f661275d-1448-4338-9cd3-a9f5ef074aa8", "value": "T1DE155B2C38CC827EDDF220B942ECB334416DB5A00735D5C376C90AEBD6646D3AAF565A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105557, "uuid": "3e4b432d-72af-4808-b902-35b9041136de", "value": "0c2767651579865fc388772609a1d6d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105557, "uuid": "c0500686-b847-4bad-b2db-4116bac7ff84", "value": "12288:mqMJUqEnVG0PmTh+kAUsdxGQiuNpEXWpNJdRY/:eVh+kf/Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105557, "uuid": "9dde30f3-ac62-4df4-bfe1-474cc139cd33", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105557, "uuid": "92e50886-3fed-4bfa-85c2-d731b4cae14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105557, "uuid": "6928ccde-719b-4582-87ad-c5ec75134e1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88f96cc-1754-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688136340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136340, "uuid": "a1ea335d-9495-4132-9729-2c6dfe23332a", "comment": "Malware payload", "value": "2c31a750240788f924ef64a2fb4fdf3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136340, "uuid": "9cd361cb-56e0-4dcb-a2fb-56f637432ae1", "comment": "Malware payload", "value": "b49bf3a4baf637e067a8db7360051eba39713b7958519b49f8e236b6014c8477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136340, "uuid": "5f1c62d8-1e1e-499d-898f-b8d4fcf902ff", "comment": "Malware payload", "value": "c9c6a7f911d16b49d8b838dca3683357b72c9d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136340, "uuid": "c65b8fc7-21fa-4f91-bc53-da7bb009cb01", "comment": "Malware payload", "value": "0c1b2832d397691c6fca2750d64ee174f25411863478e95a47e3e24767ae18da363303c74072ebd8a12be5592ea253ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136340, "uuid": "63d76a0d-a096-47ac-83cd-865bf8d4a195", "value": "T102357D2BF386AC3EC4EA0A768973A328543B7B6165178C1A57F40D4CCF294522E3F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136340, "uuid": "e1f956b5-93e6-44eb-bdeb-659330cfb1c1", "value": "1d0e46bf2c3f16a56f3bbe0adcf5e6fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136340, "uuid": "8a4d1af7-2d1c-4ec0-b600-54996710d6c5", "value": "12288:XRYqX7pdDWExBDmkYhiPJSA0IqOO2vBwRns2MqnuY/gtTyb7:hY6frxBDmkY+Jr0Iql2v4sx+uxtTyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688136340, "uuid": "ad1ad2c5-0705-4fae-8dd2-e3708c925612", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688136340, "uuid": "ac328609-ee8b-4e52-bb61-e8ffea207ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136340, "uuid": "44e312dc-f83b-4a53-a4ae-30ad56c43aa1", "value": "Trigona", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60ba6d-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150733, "uuid": "a2d0671a-2e3a-455c-99f8-eac06e1a5ec6", "comment": "Malware payload", "value": "265348a2f4bbc4aa50a500312181fb0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150733, "uuid": "527c987a-0fb0-4ef7-b9dc-a2fb1ee7cfb3", "comment": "Malware payload", "value": "b7520f0dbc7c5a13abc7d674cd8dae45de74d00ad69dc2c58badb38ec177bb02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150733, "uuid": "dddcf8c5-2dbf-46ed-b158-8f8b43a7281e", "comment": "Malware payload", "value": "4c29ccc3e71f7d6f4775723668bbafa1dde8e6a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150733, "uuid": "5d44cd24-6265-476d-8a5d-b94216c32b83", "comment": "Malware payload", "value": "436894a92e300f7eeb866fd8f9e6470dd787046e3e321ba27a5ed9cad887e5a47fe366dcc4d251449f3c66942500a025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150733, "uuid": "d704a20d-74d6-48f7-8414-3b151cf49d9f", "value": "T1C6563343597325E9D3B44BFC4B676E6088B0D501ACAA58E17E1A78EFE008F15E77630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150733, "uuid": "4e7001d7-8c48-4f46-b199-699d60767873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150733, "uuid": "0de71d10-45b9-452d-be1d-6f4908d439b4", "value": "98304:PpWl83Rjjdf0hXpKQkERC5lzrZVgZu06j+rrtsRoqx4JpAhbGHj:PpWlQp+IQkTDAuIXmL4JpUgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150733, "uuid": "0fb63159-d666-435a-b0e0-e45610ed5c1d", "value": 6319104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150733, "uuid": "c36b6c22-eb11-4b22-a117-1f5453899be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150733, "uuid": "75e89b7b-6a6c-4cee-a31a-ae3daf5539b1", "value": "SecuriteInfo.com.Variant.Ransom.Loki.5934.24230.1342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2379cd1e-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688109005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109005, "uuid": "bf1cac2d-50eb-412d-9dc8-c4f2a3ac25a5", "comment": "Malware payload (SnakeKeylogger)", "value": "9dc4c910240eff095a3d13ae8e726b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109005, "uuid": "8b4efa49-d949-44bb-b3da-f6ba576189bb", "comment": "Malware payload (SnakeKeylogger)", "value": "b76064b8e97ccbc5fce60d49f1fd9ada07864c2ca6a3f2f569180cd8b03161c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109005, "uuid": "4be900eb-5009-466b-8ac8-c4ea7d07f213", "comment": "Malware payload (SnakeKeylogger)", "value": "4196c7d44d6681c684a3ae95e699bd15b6b1ca9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109005, "uuid": "23a65a90-4a0a-4a06-9805-47a8a20ba5cd", "comment": "Malware payload (SnakeKeylogger)", "value": "2913349631e230e9c96e60a164e782cf0d2aa34d7912d5799561ca2e75561b72f295d2ecf6a3e933d20383af1d27a223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109005, "uuid": "a2253b22-541c-458c-bf2d-cc81a9413ae7", "value": "T1D054128417E5CCAAF4E75A381637272579B5FF6630B49B035BE24E687C232D0860E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109005, "uuid": "fbeaba02-bbf5-4002-bc4e-44f3ec7f29eb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109005, "uuid": "b2adef52-27f6-46de-859a-5901112fbcaa", "value": "6144:/Ya624NxqbHh4PJtvbXRqK4u316t9I4t+i2un6aMEkUps:/Yo4DqbByAK5Yt9ptRbNlkUps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109005, "uuid": "5fe89600-7e55-46e3-8408-11ed231326f8", "value": 279951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109005, "uuid": "9e6e02ac-aef9-4a2a-a4dc-31d05d8c6e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109005, "uuid": "1a489f9a-af89-4168-98ee-627e0a34b181", "value": "9dc4c910240eff095a3d13ae8e726b86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36be6d5f-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688111185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111185, "uuid": "548f76a3-d9e6-41c0-8ac0-d78d8f354a08", "comment": "Malware payload (AgentTesla)", "value": "c6f3924141277cc30c641eed47d795ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111185, "uuid": "f6f76d00-f752-4089-8f3f-4949336be14d", "comment": "Malware payload (AgentTesla)", "value": "b8affa2c64dd1a3661fd9ea46581ea09b733871562c2d080f2c81923e7275961", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111185, "uuid": "07693221-dc3b-4fac-9997-8987205a67be", "comment": "Malware payload (AgentTesla)", "value": "c539e13846ce442d2b7b24d80f1503d8cc6f929d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111185, "uuid": "18a91785-59bf-47d2-8e70-7769e4f13c4f", "comment": "Malware payload (AgentTesla)", "value": "c67686b63748260a47e09f0056f6440388111677064a30747189fe5f8267b8b56c86399ffd732932cb2d2fed2e9981a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111185, "uuid": "e04938db-0244-4f18-8f61-9413a51c6faf", "value": "T170E4583D2ABC5323C174C7A5CFE18723B264982B3161EA765CC39B954796F4229C363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111185, "uuid": "8633f186-e2ef-49a2-aea2-343b05049c67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111185, "uuid": "7c38d689-bc92-4c93-a2c8-1c47c0e0cfa8", "value": "12288:7FrHZWoydQsyizjgGfX8AVuFv2Lt+R3uhAX/wObOY7A8XKHP3N:ZrHERgMGAVu1teCX/wObOx8XoP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111185, "uuid": "c54f9dda-59c2-4aee-b4db-1ba58a393e9b", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111185, "uuid": "ad729c96-8c4c-4f0a-8388-910e3b21d22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111185, "uuid": "dda1ef39-4de2-411a-833c-9fd2a8316dd7", "value": "c6f3924141277cc30c641eed47d795ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab4ea20-171d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688112533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112533, "uuid": "a148b8a2-2303-4192-94da-b6d704b30c76", "comment": "Malware payload (Mirai)", "value": "646ded7f76bb638e35446081d33bfa63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112533, "uuid": "bef5c25d-a471-4984-836c-792fa753f337", "comment": "Malware payload (Mirai)", "value": "bb422c9ffafb10bf289bc312ea57709241b6ddc0557ecba4f6931007074d51a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112533, "uuid": "50f03b44-0c1d-41b4-b2fd-d29a9d48c42c", "comment": "Malware payload (Mirai)", "value": "d8fd85ca6b3db1bd6e53a7d597dd829bc39e9f66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688112533, "uuid": "62299cc6-ddde-4087-86e8-85b68b3d58e0", "comment": "Malware payload (Mirai)", "value": "8666d035b84db53eec484e9c241d0bcf83bc1d92543b94b7017695a219aa73fcdcf2778ca141390e01b0a0436f0ef68b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112533, "uuid": "07539798-0671-47af-acef-e1c68500e050", "value": "T1F582DF3061AB74E4DBE00430EAAECEC697560BF9D1FC36931758AB7CCA4550621F82DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112533, "uuid": "75517c80-479f-478b-bf5a-1dc32ba0ace3", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KManhymdGUop5h5l+:6/V0P6+kom0tVAoNvm+to1ns3Uoznl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688112533, "uuid": "59118b80-af62-4be8-8c25-3f02e484fe64", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688112533, "uuid": "503fe661-b9e8-4a3d-aeb7-1ad0fba83cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688112533, "uuid": "eb166e37-81ab-434e-96a7-af7062aea0f7", "value": "646ded7f76bb638e35446081d33bfa63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81e81f5-175d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140205, "uuid": "9e0a35cf-a76c-4160-96d1-696abe51a255", "comment": "Malware payload (Mirai)", "value": "b867e2d2172417b94c6b9c03d58e592e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140205, "uuid": "c0b20a47-049f-4dd8-a5b4-d9482123a884", "comment": "Malware payload (Mirai)", "value": "bb4b23d43c87a72fac09ce824b1d578a64cd36f3d68d8de97fbb0fdbb5348075", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140205, "uuid": "28ef1af4-f066-4753-904c-6ffdf6629330", "comment": "Malware payload (Mirai)", "value": "f9d587bdb8586a31891bc49dcdaadd2b47cf228c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140205, "uuid": "41502972-c445-4279-880d-cf034dad7725", "comment": "Malware payload (Mirai)", "value": "db563d7ffc1384205554a1d8518087a14255cd1ce90eaa2c400e0b8c1f96cd8e65382944c8c550a2131557eeabc32072", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140205, "uuid": "40c73d9f-c913-4c6d-8c64-cd24e6895dd9", "value": "T17933F291806D9DB5C8B03DB1D8A45AE07AFD0B3CF94BB72EBA08968530C71976FF5448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140205, "uuid": "8e294f4d-6aee-464b-b685-9749ec052f31", "value": "768:LLbPpQwNueqlA/gS8wgXFuCAIDRFLoBcoDz9q3UELjCHVIpH3UQJc2ZVYCYjK0N4:r+wg7A/ww96jomLm1IpXVJc21+3onv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140205, "uuid": "859dcb5d-3d15-409d-b077-74b16bf704f7", "value": 52524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140205, "uuid": "a6e6bd03-3eb8-4b86-bce2-dd2a58100e0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140205, "uuid": "29704ac0-b8a5-4396-ac68-930c1ad5b38b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d15a1a-1737-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688123712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123712, "uuid": "eb1d6379-2be9-4a95-bf0e-12eee6603e35", "comment": "Malware payload (RedLineStealer)", "value": "ab3b38695928e45bb71809734e6884c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123712, "uuid": "1c322346-627e-4a51-9fd7-00c73202d07a", "comment": "Malware payload (RedLineStealer)", "value": "bb4fb2752596b88f87df22550e465e3ab8793dfa6ffe5794dda0f5928eea8d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123712, "uuid": "0bef32fc-6dee-4031-942e-77b9e5a7fd9f", "comment": "Malware payload (RedLineStealer)", "value": "608be2ef87c1769ecd5009a75ff476133b25d727", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688123712, "uuid": "e526eb09-3cd4-4f99-95da-36288ca83924", "comment": "Malware payload (RedLineStealer)", "value": "5ced426c13790ef64c27f514b2984bdcd5c3f0c89a1286c2a68550274f3d30aabda52b2f482a8d1df7415764f46afd68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123712, "uuid": "0628ab2c-76b0-4647-a070-76aeb1bf8f19", "value": "T1DC14D28C73CE8F9EF2143D7088CAB20F8D66A732D1E5550D718F5AA9A7B1785A15EC0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123712, "uuid": "be95f52b-8bbe-4c5d-b15b-cbc969acdef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123712, "uuid": "6c821f7f-484a-47e7-9027-9678db70f2e0", "value": "3072:d/2Vo7fRiu9NWF420JfG8HVqWVAolazLANpdLETUmrceKfxKQ4objFp5:d/T9j9NQ42KG8HVigNpdYDra5PpbjFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688123712, "uuid": "7c6b7000-fe0f-47a7-8096-dafe5f252fdf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688123712, "uuid": "61913c5c-bdf2-4786-bdd1-9d8f41d2ce6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688123712, "uuid": "fc31b43f-0282-4269-8528-cd45c49f5d11", "value": "ab3b38695928e45bb71809734e6884c0.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2733a2-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688111244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111244, "uuid": "ac61d685-8bc8-4436-a8e7-68f3cfc92535", "comment": "Malware payload (RedLineStealer)", "value": "ba254d0470072c049047fe427ad903d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111244, "uuid": "5f7252cf-3f71-45e9-975d-b470d3588c0d", "comment": "Malware payload (RedLineStealer)", "value": "bb710df86a1db1fd91fed1e7065ec5d1e46a42be619717ddb45db8d59f0a0e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111244, "uuid": "83261b32-ff35-4280-97ff-5f2613d0e1d8", "comment": "Malware payload (RedLineStealer)", "value": "69bbfae69d186e5e5c8479158fe87ae907f04b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111244, "uuid": "8b09b23c-2291-46ac-b7bf-29ea15cf7bdc", "comment": "Malware payload (RedLineStealer)", "value": "92dbde864798200618ba6b25eeeb64e52dbc29a1ab692d22dc39395cb6d82110a7df6d25ce90c6b4fa7216b773789a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111244, "uuid": "fd4c6c63-59d9-4bca-9528-b60b332d4a1e", "value": "T1930512133EAC87A5C9EEF4B340FFF5158A3D53313B72368B6398A2A91550BD0925D392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111244, "uuid": "94591416-4ac9-4399-b370-c0e46d7bbfda", "value": "bb1d8bfc6c51ca02a6f390c720552f6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111244, "uuid": "71c86be9-900a-4d1f-94ea-8ca12ea885f5", "value": "12288:tZacjZWFTAR6tnIHlKnaEMU/cNHG65ho8Mh0fqlvLWqrI4xQiu54kAMUn3H3te/Z:facNSTQSnlnaEMkc8W5MFLWbMvkAzHml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111244, "uuid": "e0815fce-833a-41ce-a974-8cc6e500f866", "value": 851592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111244, "uuid": "45de2c5d-106f-4ab0-a422-95f8f94b56c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111244, "uuid": "3cb4205d-b0cf-42d8-a00e-8bc46635a69e", "value": "ba254d0470072c049047fe427ad903d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afe9396-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108105, "uuid": "6648c69a-fd2b-4d28-a40c-41e31d435d3c", "comment": "Malware payload", "value": "f3e6d120fbd2c06c8d4fc195c0453d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108105, "uuid": "dc36b401-7156-44f1-a69f-3d131acc78fe", "comment": "Malware payload", "value": "bbb8fbbb20bebbfaa7b103359319cd5e20b967748c079303f396f236a92e00b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108105, "uuid": "699bb527-7983-4057-8a15-3e565a79ed8e", "comment": "Malware payload", "value": "732798f4ac2712ecd77d26fd6e0daeaa3d33c813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108105, "uuid": "7d9243b3-bcf0-457a-ba63-a3b8f3cbd9b9", "comment": "Malware payload", "value": "98fa097d3264e67c054e9fc5fdb68057e666920af3adb2959549decdf1a78b984c3761b8b5426cbd5556133a71c2e522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108105, "uuid": "1401a76e-717a-413d-8971-250d18527dfc", "value": "T1CC35123C4FA7EDE2C6AD813898B149AC5B79C0AE0456C7A7398050FCBAD735057912DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108105, "uuid": "e0ed67f0-7fba-4018-b3e1-223e5d288f2e", "value": "24576:p3dyFDYfwhsphT0PsbkJX6slO8P/EcOSRM7mx7IkKT11t:RehsphAPsL+Ou/E70Muxc1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108105, "uuid": "c92fb06f-b14f-40fd-80e7-eb0b412ee781", "value": 1154064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108105, "uuid": "b1680389-cb16-48b7-bdbb-8fc00544960b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108105, "uuid": "ca0836dc-cb70-4cc9-ac76-4a32b9c7afa3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcad000-16fd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688098764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098764, "uuid": "5367447e-afcd-46ea-844f-c7efcda73613", "comment": "Malware payload", "value": "b19945ffc8f7a693e79c1677aa827750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098764, "uuid": "c4127f59-9dac-458d-a8f9-73a61cdf3a82", "comment": "Malware payload", "value": "bbdd3b5459f3fbeadfaa5b9882cc63630a7367b0d4bbe1e7eeb481b87ecc07d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098764, "uuid": "c7414168-9563-452d-b241-f2e89ee1a20d", "comment": "Malware payload", "value": "2f19f27d3c77cfc0ad8c0b2c57e81369fcd3a638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688098764, "uuid": "2be596dc-2427-4632-83e6-1d79504789c8", "comment": "Malware payload", "value": "572c5a5079112ad93f7164b25605f203f513b99335ff08dd68b28509b95c61b4464a9b9a5e41b84eba0554cd88d47627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098764, "uuid": "1c29e979-0156-4026-96e9-3ea827f8c469", "value": "T14824097EDED0862DF735BF34C6717A29C962EFC3D91122C13948482F5911CBCA2BA916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098764, "uuid": "59f4c0a7-053e-4de0-947f-713decb58eb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098764, "uuid": "084927f1-fe5a-4231-ab80-d82af4886402", "value": "3072:GS9NbxyEqqpFxmIFhFrFaFSFLtLF5FiFzF1FnF5FOU9aFGFrNFCFTFrFuvFqBFUv:HfcUtnU9xvMbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688098764, "uuid": "fb1c2d74-ba7f-4a78-ae84-9c2bfec98303", "value": 221176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688098764, "uuid": "3ca0ee34-56ea-4129-9599-381fe8c3bc80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688098764, "uuid": "c8a12336-f35d-43a7-8bfa-55a7c29660f2", "value": "b19945ffc8f7a693e79c1677aa827750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedbddc0-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144135, "uuid": "dbde221f-e297-40be-bb2d-5213fd57773b", "comment": "Malware payload", "value": "0bdb5f2ba4c9e123c1659498f4368da9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144135, "uuid": "3f565093-dbaf-4e38-b1a1-d2ed03bf7d25", "comment": "Malware payload", "value": "bc862fd37f306fddbaf45378c6022897d8a852b86f3e9895c47ff933821f33af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144135, "uuid": "c1d13e93-2057-43c8-bdee-e94978a503e1", "comment": "Malware payload", "value": "0475b3a904d809737aaf93e887fd48d7db7587f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144135, "uuid": "2d5f4d32-569b-443d-b29e-c837339eb72e", "comment": "Malware payload", "value": "8ec7f49ffd2e1e6a7601259c50d2be0dd61963877f0f00fea7366f0811a45ca411222186d046141329388cc0fd5ec83d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144135, "uuid": "2c1153d1-d010-47db-a36d-f383c01936e5", "value": "T1F02633D1E8120920E1681BB91E9EC5D027376D81FF0BD70ADE61B37EDA3A1E209156DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144135, "uuid": "a27b090c-a82a-4758-ab2e-3a3a8001f2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144135, "uuid": "8548a09b-a095-49b9-9f66-a095fb554592", "value": "98304:SK6ZMhkqa1Kg+OEIcqPawaRpxokHp9TdrfWqcmg2ESiWWabie6r2:8jchqiHxbldumRESiGbKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144135, "uuid": "9733245b-d01a-4b70-a8ed-c8fb55a0becf", "value": 4471296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144135, "uuid": "79444994-0310-4180-accb-e05077f5f3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144135, "uuid": "b177655d-8bfe-4b63-9ab1-683d174db712", "value": "SecuriteInfo.com.Trojan.GenericKD.67699635.10687.22456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9f0e1d-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144163, "uuid": "5eb5670a-1e33-4676-b1c7-ecb4f095f081", "comment": "Malware payload", "value": "e676a26ef5bffc64ca505895615ef203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144163, "uuid": "fe3f79a7-8f7f-46ef-b637-018e7904e3f0", "comment": "Malware payload", "value": "bd213bacf745262d609025230b73d653d2ef62875f28860ea1b4d1a65f5c5cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144163, "uuid": "76cc242a-c820-461d-aa48-4fcce59c2281", "comment": "Malware payload", "value": "cd5d4f0998c2b7eb976fa0334fd0fb8eca3c652a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144163, "uuid": "1f2bbaa2-861c-4166-b084-024c16dce891", "comment": "Malware payload", "value": "a3739abedee285c41bf40d9e8c62896fa8f3bfbd3474cea36ea7360a5f9130fe1a4b3327f7687b47125fb1e67adafb03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144163, "uuid": "d2df9350-5da0-4919-bee2-d6e06e02b692", "value": "T18DD63364B3B574C2C0BC1B70E5EF535B4B7030668D040EEF9FA2A0259F46BDA9A67790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144163, "uuid": "9fb21349-e1ab-4f37-8f83-7f94596ba546", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144163, "uuid": "584f6747-ef92-423b-84c3-366e92c72797", "value": "196608:7xE1bjwrv7awT9uCUEqxHCrlDB65XHJtrXqCjZjVL3xfBlKojnh3Vg9uWkR:dEds/D3qxi8/7qCj1F3NBbnhq9uWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144163, "uuid": "7ddc7106-9980-4d86-b4b0-bdd240b0e40f", "value": 13521408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144163, "uuid": "4f9a0fe4-8c24-41f4-a69e-f076f8048b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144163, "uuid": "b1758090-cec9-44c8-ab2d-140098ab397f", "value": "SecuriteInfo.com.Win32.Malware.Injector.E1Q5VA.26735.336", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47016e85-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140847, "uuid": "b3dd40d5-7320-4c58-8f4d-0360b6f9b3d3", "comment": "Malware payload (Mirai)", "value": "743e6a23158a7b827957d10ef0b2b6a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140847, "uuid": "1f65f48b-2c67-473b-af3c-b5c1b2dbc70e", "comment": "Malware payload (Mirai)", "value": "bd9f03b07d532d8913985fe96ce2edf225d166a5dfe994bf0292d91d878650d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140847, "uuid": "9bc5df70-f790-47ae-a539-cea9290d5c1e", "comment": "Malware payload (Mirai)", "value": "05a352907256cf35f692cb374b757868dec78782", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140847, "uuid": "325f9fc2-1f9c-4b33-b4ac-ada24aa0d7eb", "comment": "Malware payload (Mirai)", "value": "7640e00340f657ee5900749d05a6149c143a452777439ed085ce23bf9b128cec21fb7150de9649e05c3d8dca72d0ad96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140847, "uuid": "1524bc51-066a-4752-955f-e8e6135799c6", "value": "T1F8536DCAB8119E7DF5CBE6BE85210D0EB821722150931B17BB6FFC83BD731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140847, "uuid": "cb635f8b-8782-40b4-936d-2a4ce951acef", "value": "1536:sXyRgQFVTbSX5pxLepSGYocF1ohON2P3B+qo76E83:R1UvA8E9oOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140847, "uuid": "520dbabf-3688-4152-9b1d-7e55a05a374b", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140847, "uuid": "30314999-2428-4813-b85f-909260d7208b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140847, "uuid": "2ce3d9b6-6319-4d07-8caa-e09a34ef0a46", "value": "743e6a23158a7b827957d10ef0b2b6a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d9f3f1-176b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688146296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146296, "uuid": "955b4246-1541-4c66-9019-0a64ea53638e", "comment": "Malware payload", "value": "33b6f0c08782cb5d5f87ac20578cceb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146296, "uuid": "c85688a1-1d00-4c6f-bcf8-02c351ad33d8", "comment": "Malware payload", "value": "be7160998811304d9a507cf7d17a4ea9fe033fce060b4fe57f796de401caf03e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146296, "uuid": "65b0ccc8-931a-41dc-a2cc-a9a2dd87961d", "comment": "Malware payload", "value": "7336d4b97b7b5f0cd0308f1063c8ed6b5bf5d49c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688146296, "uuid": "5efea45d-b7b4-4bf7-9c49-59e06fd5c30d", "comment": "Malware payload", "value": "f138ce33c9e2de83830cd35baf3b132f67a32934c42333e208d7c784a9afb02ec1cdcc14767b430424ef457a2ed60b7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146296, "uuid": "972e8705-546e-422c-b7e6-ebf5ba02ab51", "value": "T15F632A45BC809722C6D1167BFB0E029D376643E8D2ED7307AA25AF2133CB96B0F76651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146296, "uuid": "b5615524-845a-4c12-8bcd-846c5374cc30", "value": "1536:bjX8Yhvxz35ZV3waWmPRI2BIhxKKZOw+c0/XvTo:/X8YhJz358aRIjUKOB/fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688146296, "uuid": "bf1b988f-0d61-4f29-abc8-94fc1dde43e5", "value": 67220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688146296, "uuid": "572a9f52-40e5-4ad0-8cef-5f094c10269d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688146296, "uuid": "519278f1-9768-4996-be78-7ea2ce53bd43", "value": "33b6f0c08782cb5d5f87ac20578cceb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bec836-174e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688133778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133778, "uuid": "9a44167f-b379-4de7-ad45-48ba0ea63a74", "comment": "Malware payload (Mirai)", "value": "58479dff3b9f34d95d045641fe495eab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133778, "uuid": "f4c01ed0-0623-40f1-b2e0-7ad4e0731c0d", "comment": "Malware payload (Mirai)", "value": "bede209c7dfc1931bd9e847c45c9a6bc4de5ddac2fba5ed3d0f2cc9d54ed2799", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133778, "uuid": "30b4d809-97ce-42c9-87cd-7ef07566ffaa", "comment": "Malware payload (Mirai)", "value": "de2528d56300b54338f1018fff28b941e67964d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133778, "uuid": "0e3cd9f8-72b8-416a-82e2-a8f124cc970b", "comment": "Malware payload (Mirai)", "value": "c300d68d454b90c718c54e35bef41999b5c3b40a3d5257b2b614b183112437937e8056ff19f5d8c28cac6f9000429ed1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133778, "uuid": "0adacdd7-29df-4910-8200-7d02379e2027", "value": "T128931882B8814A26C6D812BEF93D01CD372167E9E2DFB2239D101F643BC696F0D67E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133778, "uuid": "71593cd8-0422-4f3d-8c22-fb2c15ebe5d3", "value": "1536:1ANnsssPLt7w1pFvbKqCaU3QWihnH2plZSj0L4MMizxkIzMxi46/xZ4Pa:1yatUfNb234pH2LnQ6/xZ4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133778, "uuid": "4249a858-4b65-434a-ab63-3e71d4edcdfb", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133778, "uuid": "3b095cc9-cc7d-47a6-8412-39367f39d0fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133778, "uuid": "391abec8-ab3e-4ee7-befa-c64d6a204f45", "value": "58479dff3b9f34d95d045641fe495eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9312ff5c-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688120788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120788, "uuid": "a91f6850-d4a2-40b7-ab25-817e7b0f69d8", "comment": "Malware payload (Mirai)", "value": "8628ff5ea810a077094826fc1eca9e8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120788, "uuid": "9ccbb9a1-7da1-44ee-b9d4-cd53a54bc9cf", "comment": "Malware payload (Mirai)", "value": "beea6775642378fd042f2ba5bcf10e228fff3cda5d71cd7ebefe21a3ee38ed39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120788, "uuid": "a8135ca7-afc6-4148-b2db-3309979f4309", "comment": "Malware payload (Mirai)", "value": "17ed361eb5136036e87915a7606863f6097705c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120788, "uuid": "77caf3ad-ca83-41b1-980d-d6d0362e27e9", "comment": "Malware payload (Mirai)", "value": "b55c614a92e1fb35a1aaf8e8430b6cbe4206686e663f7757ce342ccc2038b47fe4c4f94fc17e052d68d3048474420162", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120788, "uuid": "d0027a47-afb0-41e4-9824-6a686c0a3bbc", "value": "T18C23F2D392266A70F8D115B69CBB0A03F23E85F0C96670F270141B7F67D59C76272952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120788, "uuid": "8586bac4-1ba3-4757-8154-243dcbf61c6b", "value": "768:Kvrs5VsXM78ksMGuO0i3cYpLNPGvuhmmAuByisyViuSbny55f0S3U0:orsq0FNOz3cYpLNPKumpycuSzy55z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120788, "uuid": "39389386-cb6b-4abd-9eab-87f603fa1796", "value": 46272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120788, "uuid": "08daabfd-a5da-47f6-94e8-1c299383e311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120788, "uuid": "e3232b8d-1693-402a-80c0-1829c18b6ce3", "value": "8628ff5ea810a077094826fc1eca9e8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ae529a-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144685, "uuid": "06385076-73a4-4475-991f-33e68c313ffd", "comment": "Malware payload", "value": "af37a6100cc6dca26d5751277cc6f25d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144685, "uuid": "628b60c7-2aa3-4333-a44e-9c329407d640", "comment": "Malware payload", "value": "bf584154814a2c3aee067597b1bfe592eb2ba248c03b56ae8cd88c6c7963f6d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144685, "uuid": "a42d157b-f790-438d-ba37-cec83ba06e4b", "comment": "Malware payload", "value": "cc748e1cb7c3e5a2775c3ca92f8c1aadb0fcb2ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144685, "uuid": "0bae161b-2640-41da-bcf4-43ad9266bb64", "comment": "Malware payload", "value": "7c462d3a919be185590213e7c1532297bf01e25d7cf86d08f33c7f2ca26434fa2bdc01289917d5f43c38be747af02ee5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144685, "uuid": "96585d3b-80c5-462f-8025-d818f224f371", "value": "T107646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144685, "uuid": "064edf4b-6ad2-4d11-8249-903104defb12", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144685, "uuid": "83ed03f3-c003-4b57-93fc-0ddf92095f44", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144685, "uuid": "47b7e158-39d1-4fb3-8d85-1542211af09c", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144685, "uuid": "30a9df81-3fea-43b5-a651-dcd3e4657400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144685, "uuid": "d94cd6e6-5a63-4089-b5c5-baf6fd55fac0", "value": "56loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638b318a-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137029, "uuid": "ca720a81-3f2b-4a4d-818f-a647d3c12b24", "comment": "Malware payload", "value": "7106aab423db77a92c6e97a70bc8ef84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137029, "uuid": "83e8eda1-8f62-49df-8661-80c2f5a154bd", "comment": "Malware payload", "value": "bf92cc39c4a885688598416d73f1d720023b7ff573224ab6b0790a042983245b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137029, "uuid": "93cddc0f-0ef7-4d00-8dd0-984deea1421a", "comment": "Malware payload", "value": "ffa5faac3ffd055869f5e5ee1a8106dc6a6cdea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137029, "uuid": "646deb93-8b7f-4f05-a48c-74bc47bcf945", "comment": "Malware payload", "value": "57966734be069847952c30496e6bb299bbd66f95081e5b48d107ac4b1f54df73c23dc48eae12d9844737ab900869dc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137029, "uuid": "4d79b7c9-e794-4889-b2a6-ae8f61dc3443", "value": "T15A763301748C4BF0CED1107E4A93E76121E53A307736C69BEBD99779F6246E2E9248F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137029, "uuid": "0de24fa4-83e2-44bf-b5c9-89f1bb565a14", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137029, "uuid": "d86058a6-c3e6-4a37-ba32-f40b5366c716", "value": "196608:l4R4y6i8QjS6/4osJem6/QBDpnDpxGTlO9enTtK6eq/g:y4O8QjVsJe//ANnD6TE9ecv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137029, "uuid": "bfcb1873-49dc-4458-a969-a4bcb8296bbb", "value": 7489569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137029, "uuid": "b90d2502-fbd3-4948-be68-da76685b64b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137029, "uuid": "435e7130-9a57-4278-90b3-47e18d33c082", "value": "7106aab423db77a92c6e97a70bc8ef84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c236f3-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688108123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108123, "uuid": "5aa0495a-9184-405f-9988-264aca129474", "comment": "Malware payload (Formbook)", "value": "f40ce377376c42b597ec909ce7c4f0ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108123, "uuid": "88e0e158-aaf3-4eaa-9758-5e0c2d533856", "comment": "Malware payload (Formbook)", "value": "bfdc9430338ae8787f1ffd56e70d4805bf1a90538eac918e52a81e4001e379f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108123, "uuid": "18c8e888-c393-4937-9fdc-04e3e67f1c58", "comment": "Malware payload (Formbook)", "value": "1e2ace4e0013b53a3acaabc89036438c06965a29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108123, "uuid": "2a475680-843d-46e9-83e0-b034e2ea9f69", "comment": "Malware payload (Formbook)", "value": "2fad6a7cff8f5774536d783004053708020911520eac44e619fc7730f7a1af4eb9e86492183def12c641f9d9ae6b3f87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108123, "uuid": "5b8147ba-fcba-47d1-a096-1463bb4d84c8", "value": "T17EB4E07D1B848FC5EBFD703870B78A3C4BA194B56046A731FA9884F06FD5B800294A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108123, "uuid": "6bd1c1b9-e938-49f1-8094-a612e18dce8e", "value": "12288:kukKUgdbbpmIC8ufD0qIFTX+YAU/n0ZXZT80:QKUgdbbkIC8uDHsXXAA0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108123, "uuid": "09da69c2-bc61-4f5a-af13-11e0bfc22f19", "value": 495632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108123, "uuid": "23585fb5-745a-4d15-9590-984ee127accb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108123, "uuid": "da8e30b6-87db-4fdd-b527-698079c60393", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2201be83-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144650, "uuid": "3a338333-913e-4199-aacb-43d64e04b608", "comment": "Malware payload", "value": "8238c848a13805c67aa90db8230c6d66", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144650, "uuid": "0d9bc7b9-7147-416e-951b-0c7129cbedbe", "comment": "Malware payload", "value": "bff9135b370f3708055dd0e12298479eee01381d3409a3627531d5613dc156c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144650, "uuid": "ca40c694-327b-4603-9423-371ef5ab39a7", "comment": "Malware payload", "value": "54f3b3305a8eab99bd2c72fd088ed99935aa9466", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144650, "uuid": "9607a6e2-6ed3-4860-a420-4a1a8e9160f3", "comment": "Malware payload", "value": "ddc4a79896ebc9467c89ff1f39ca68dfdd8525f18ba8ffa865c2e57b981e86cf0fa609c00fde53c77fba50fdd245b44d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144650, "uuid": "59c26203-3b4b-480a-8b0b-7adbfa49e702", "value": "T1A0646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144650, "uuid": "02754c1b-71ea-40cd-9580-0828ccdbc2c4", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144650, "uuid": "83d8a603-24a9-466e-8f5e-820b8b205d76", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144650, "uuid": "1b94cadb-671a-403c-9919-a51566a74e11", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144650, "uuid": "abf1fca5-678a-4c4e-94ce-ec423b09e4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144650, "uuid": "f510ea0f-4e19-4530-92ec-77b77558049f", "value": "52loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6609a29e-174b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132309, "uuid": "a7f4eb4f-c74e-40bc-a9eb-3961d39527bc", "comment": "Malware payload (Mirai)", "value": "624178ce9eaa9fd48de4d2a4ef079a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132309, "uuid": "51608b87-ef64-4540-9e8f-97e918f900ec", "comment": "Malware payload (Mirai)", "value": "c00682fd8561a0c54d9c13fdae47b547fbea41bd040db1b7c9dbf14184431133", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132309, "uuid": "bae42fd6-dfc9-4508-9793-033e69fec180", "comment": "Malware payload (Mirai)", "value": "164a6e561d2adb34fae3b0d4f6ab65a5daeb3b49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132309, "uuid": "44850624-4561-4568-894b-d9c7f6f55545", "comment": "Malware payload (Mirai)", "value": "59e194b2ef65fc2071eb158d3284a38f4808908f5268bc6fdfdab85bc8beca9ec6a5a60a3a4f6b745f26be971e7d77c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132309, "uuid": "26e75d05-f0af-4202-985d-b888ff8cc9cb", "value": "T11D632999B4024F6CF90BDABD64164E09AD61238163D30F1A5BABFDD33D73168BE12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132309, "uuid": "b56ab58a-13a4-456a-9445-0b95316e9872", "value": "1536:XZEIUjQttlP/inVQsfLwymhqM8NZ9JMfWazd:XZEH8PJ0JLwym0lsWAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132309, "uuid": "ee0d5dbb-dca4-4c86-acd8-a971c2fd2448", "value": 72460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132309, "uuid": "19897d40-35d8-4774-a3c9-dec2dbcd8715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132309, "uuid": "fb43053b-b11d-4263-8b9b-c5ebf506ef82", "value": "624178ce9eaa9fd48de4d2a4ef079a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43caabdc-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150720, "uuid": "dbb2c74c-acf3-4ade-ac50-6e764d959044", "comment": "Malware payload", "value": "31008d1a6b014e669db6867ca8303d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150720, "uuid": "ddc41eff-b676-4e9e-83a3-df2a09d6c94f", "comment": "Malware payload", "value": "c089b47075108736a2967b75eedc3601b672254a3b438361648cde0dc4517695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150720, "uuid": "29046f0e-6d26-489d-b6f0-27cbd723447e", "comment": "Malware payload", "value": "3e3eb377d338a2af536ed5ae92874f9fb2355ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150720, "uuid": "caf2cc84-b328-48e2-b750-bf7433438198", "comment": "Malware payload", "value": "6614d0f9c14b345575b81c698251de4cf3518f45bbcdc449fe795d8d798e1b665aec333c626d295e0ec09142e0295e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150720, "uuid": "6c705b06-a06e-4a0a-b960-fc7fb2b71bae", "value": "T13B563307FA8B85F3C20C0B3AC05218656762E372F323DA1DF6E513B6A6537DE196590B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150720, "uuid": "ea19a021-d462-42b7-b418-9be38527db81", "value": "196608:TsCdVeC35Cfz+n7y9kItRBtlT3tshwnNamXKy:TsCdTJA2ZqlBHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150720, "uuid": "5ad92ced-c555-40bf-ab55-d84fd5ea7041", "value": 6447104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150720, "uuid": "5796c4f8-85cf-4092-97e2-fc430a0597da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150720, "uuid": "cb8845f0-73d7-4bd7-98d6-592e12e2307f", "value": "SecuriteInfo.com.Variant.MSILHeracles.90838.26595.9595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e2a1f9-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144335, "uuid": "1de3569d-f401-43fe-8376-22d94b098b4a", "comment": "Malware payload", "value": "3e84720949d16e9a3cfc2b19c79dad6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144335, "uuid": "4aae00a6-4114-41ca-a89e-c04d25996ad8", "comment": "Malware payload", "value": "c0a78e0e7a675af4af0a37d3a546ff7c97cd518724457e09a0468172f982e6b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144335, "uuid": "cae231f3-999a-4a38-835b-4493b75c80c1", "comment": "Malware payload", "value": "4d20e051818b62e90ae47869f4e31bd2e2063881", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144335, "uuid": "ee2eab34-32fb-449c-b740-363577c25c57", "comment": "Malware payload", "value": "5c7e72397b37708dce9e4885a4507c3636f17696e8675845af34dafa9d2ae8e898d3d9a8759c8d0ee345b7bc78aee5ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144335, "uuid": "60235aa8-901d-432c-8f37-824e78c363e1", "value": "T14C646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144335, "uuid": "dfa6357a-c18c-4dce-9508-e8479d5da874", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144335, "uuid": "f29042a9-2ab6-4234-9d56-e8c247fa10b2", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144335, "uuid": "c6253863-19ad-48b7-9a06-85a89fc16b95", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144335, "uuid": "6fc408fa-0c2b-4b08-92e7-803ad2bf0859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144335, "uuid": "704a8d32-38ba-4179-976b-bb69e50a0e48", "value": "10loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419962db-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140838, "uuid": "7a99300a-f23f-46c2-8d13-0d952fd94935", "comment": "Malware payload (Mirai)", "value": "eeb6539d94c9c996d1166540762e55b5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140838, "uuid": "087d4411-9d4d-4a0c-8ff3-0e9553a11829", "comment": "Malware payload (Mirai)", "value": "c130d2daa802daab8f6ca085aa8551e91d35a4f4c14f11019fbf785a1624fa46", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140838, "uuid": "fa84ca73-297e-406b-8083-171ad36e1e11", "comment": "Malware payload (Mirai)", "value": "b05bc86a982ba133957e9c24a993a2cc71ae2696", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140838, "uuid": "fbfa3397-529d-4446-82fd-731d63929a67", "comment": "Malware payload (Mirai)", "value": "45a1ce6f14b0de6447c278fd39785ca5c7bfdb8f7fdd1361af641a63870ce2220d9a5b4cf1b36980e06936971eaf2306", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140838, "uuid": "ff9b7aeb-b2d0-4c0d-a649-7ad301c0e39b", "value": "T1B0D2E14689F7E4B1C4BCD87266BABAC4F6B46551E3185B7B48CCF5BF5D9B24C0220700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140838, "uuid": "fde16f68-a2b6-4351-9417-c9150ca7967b", "value": "768:TYSoXdJZUtqz0hVGTa/V7t4zY/R04O/FbSx0sP:TYJdJZmY03GU504ntP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140838, "uuid": "3056e5fa-92a9-4dda-8451-dbf1770e04ce", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140838, "uuid": "76fe98b1-d2bc-4852-8c71-fd43c3b63db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140838, "uuid": "6439d51e-af0a-47aa-8cd1-74d9439da5e5", "value": "eeb6539d94c9c996d1166540762e55b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a8fb8-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137207, "uuid": "62131dee-7066-4024-a010-fe9c2290206b", "comment": "Malware payload", "value": "36b60fe0b495bb566de36934a2f02c8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137207, "uuid": "c00dc6c0-575e-492c-8c55-7ae4bb64a9d6", "comment": "Malware payload", "value": "c14d81b0d7968df0cfd54267ddecff4d076d0dd30a715adba64cd5d588b5e86d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137207, "uuid": "e5e36021-8fa4-460c-ba93-8bb8526e5fc5", "comment": "Malware payload", "value": "614f48f76723a3f7e797fca6f7e7c6158ef08199", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137207, "uuid": "98618cb7-b185-48a0-80b8-1e34b08a494c", "comment": "Malware payload", "value": "9d2f3e0204248646d2bd3ad75c9a55a9f1f91aefb5d84e833c669214a7a5024bad485ea2fc47a771522fc341cdbbe4ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137207, "uuid": "05c37576-7d58-4dd0-9f19-d1464e4acceb", "value": "T1C3530682FC81D906DAD4137ABA6E51DE33253399E1DE7207DD126F103BCA91F0DAB252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137207, "uuid": "6ecd1a60-18e3-4f8b-b51b-dfa2d711aba2", "value": "1536:cRvYcnotQXeGk+Bc26GVqRtN1NdPGbQJyT:cRwcnY+SZhZJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137207, "uuid": "cc3643b2-4cda-4255-9120-14ae9aa75797", "value": 64044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137207, "uuid": "df84b0ef-6ab3-4259-a8a8-27b351f53a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137207, "uuid": "5725ee85-cfaa-4a5a-a364-50911815d0ee", "value": "0xh0roxxnavebusyoo.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa95b3d-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140826, "uuid": "a81caf0a-38dc-4830-8fc9-bf3074497866", "comment": "Malware payload (Mirai)", "value": "e84392d3f28794e1594381b3b159df11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140826, "uuid": "c0532d47-f603-4942-b193-c5a70871e807", "comment": "Malware payload (Mirai)", "value": "c17a9609bc424d1b4bbe1726e34c60c9efa19ecbd97d8102279293f84bb0c0f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140826, "uuid": "8dca2fe2-1942-4eaf-9d68-79e90bedee3a", "comment": "Malware payload (Mirai)", "value": "98ef757fe82451a47859e90039a1a74ad0e24100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140826, "uuid": "107de044-255d-4aad-9be3-6f9eff8dd988", "comment": "Malware payload (Mirai)", "value": "26b995b13920ebf525f6e8e2314f94dc328ffc22581651a950b959e970e64c5ae4ee5c5c556d0502c303b369058b0a90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140826, "uuid": "81757746-2c6a-40a2-bb17-9edc30f1f453", "value": "T136B2D03602CDAAA3C9508934FAE9C708235306B9E1AF70563B810B79D7D12DDE2355AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140826, "uuid": "cfee2f00-3786-4d7e-995f-e3229dfb017b", "value": "384:t9dWyZ1lp0E/Z6uy1AEZZBTCU9HT5SExCDtEFL88lKOsl0ITVphymdGUop5ht3:t9dWCp0E/oZ1zZBT31TYsCcL8zXpzs3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140826, "uuid": "fd213a30-d919-4618-8595-d51f5fe2c61a", "value": 24516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140826, "uuid": "395ea10a-c18a-4cc4-95cb-38b7390e659e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140826, "uuid": "4c735249-23d0-450c-94dc-17d0c250edd7", "value": "e84392d3f28794e1594381b3b159df11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e715da-1703-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101462, "uuid": "0c2851e9-3b22-43d4-997a-4e209af6c131", "comment": "Malware payload (Mirai)", "value": "e4d0907cb42863ea588579e3552cc74b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101462, "uuid": "47e240ff-7aa5-4a3f-b919-2d4cf60377d0", "comment": "Malware payload (Mirai)", "value": "c189ddf4291c63ed93aad3aadaab1152d8c8b975351faec8ffb8ddfcdca34a3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101462, "uuid": "ebdda124-6a0f-4b0f-ac59-310ed08a101c", "comment": "Malware payload (Mirai)", "value": "bb67cb3d0d3df29735350ad7878c38430bf97a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101462, "uuid": "719923b8-6029-46a6-a8fa-d5247082d17c", "comment": "Malware payload (Mirai)", "value": "67b9b02e518a7f5913adc3d33aeba16e9b57309eef915464555919a38367d0b20161a7c80fd710de08db189ba3a6116a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101462, "uuid": "ffee97ab-97fd-4eef-a898-9f20e8e40003", "value": "T11D734921A97A2E17C4D4F5BE22B78764B2F1274E36E8C61E7C720F4EFF2554029425B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101462, "uuid": "3ef9e49d-0cea-4baa-83cb-3a4db3e5f5d5", "value": "1536:SPqYLqSFtKUwUYkKkNS8zGbQOajBVNXZRDutbu4A:kVjFFtX+bNajB7XGrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101462, "uuid": "99c7e640-8bd8-4c5a-b583-c0d5bfea1c6b", "value": 77528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101462, "uuid": "0d1185d0-fe24-4ba4-bdca-fa6e5efc2b73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101462, "uuid": "c04d5abb-323a-4563-afaa-48aa610ea4cc", "value": "e4d0907cb42863ea588579e3552cc74b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0de6965-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688154393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154393, "uuid": "f993d637-5aa5-4add-a962-bcb66b0363b7", "comment": "Malware payload (RedLineStealer)", "value": "027b3cd9271a8679b7820fe1f40f0fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154393, "uuid": "eaeb0560-4a20-40f7-8fe7-5ec6c83d4360", "comment": "Malware payload (RedLineStealer)", "value": "c190faa8ba6708c63fde062a6cf434243dc82e99931bacc579ff780f41528fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154393, "uuid": "caed1b37-ed0f-4f42-bc39-e14c76717832", "comment": "Malware payload (RedLineStealer)", "value": "91749d9f80ab4440e4f8b1f95fcaa0118acce1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154393, "uuid": "ecb0f73f-8885-4920-ad52-c9bfb85155cc", "comment": "Malware payload (RedLineStealer)", "value": "cc3657b13172fa154820e9d6c39182e52a9c7d05136a32ffa08f339c41110a37064ca0270e067caf0c4f5529003e5064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154393, "uuid": "00c75e40-9893-423c-b230-515b6e1c9df3", "value": "T1D1B6336D37F299E6C8F6623064E211C35667B07793B583BE4358EC960C71164BCB0BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154393, "uuid": "34c724d3-439f-4ab2-ab1e-d9bf7272e924", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154393, "uuid": "7bde8aed-e863-4c93-b97f-0d4947f7afcc", "value": "196608:UasN8mTZ8AB4V/uWQ1DDSYeJa9hH4AbD3GluSj2iMlKlLYOE22pXA9HLDHU:PslBcHsDDSYkEHTbt+MlSYCYXARLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154393, "uuid": "afa4f1d9-d2ba-4946-9586-fe2d329a292f", "value": 10468352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154393, "uuid": "966817f1-d73c-4b39-8460-ebe5e2f125a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154393, "uuid": "d9302bfd-3bd3-4bad-a95c-852decf944b1", "value": "SecuriteInfo.com.Win64.Malware-gen.3680.32653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8ca87c-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144104, "uuid": "c6da94e8-5c67-4f52-bdba-4e384cfda1d7", "comment": "Malware payload", "value": "5d979f318bf3340707fd2b563601ef64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144104, "uuid": "8a16adc8-731d-4be7-8055-99f52b53e0e2", "comment": "Malware payload", "value": "c196a4a8b69db8da8978c24263d86823bc12821212f0210ed24530d7c8bffbbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144104, "uuid": "e870f4f3-afd5-4f3c-b975-da3f6f2d8098", "comment": "Malware payload", "value": "03dccf03484e52c56996b1263d1abff707af3cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144104, "uuid": "02f9a13b-169f-4385-8c9a-a59d18e73b86", "comment": "Malware payload", "value": "60f72c170be2719e77d1a0c3b13c9cf71c04206f42987ad080043699374ebfb77a2efb11d2713cd6ed933623e853796f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144104, "uuid": "f1ed91f2-dee7-41bc-819c-6a381917f1a6", "value": "T107E6330372474899D8865FF2C5A341048B85C293F767C38C658E33899F25FF2AD7999B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144104, "uuid": "506255dc-9ba2-461e-aaf6-88069dbe3fd6", "value": "393216:ph+otOOZgd3vV+YQt48V16yL5Q1LAWtRUtlQxZ:/+TOZWgP48VhL6R/tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144104, "uuid": "08b06837-74ce-4e61-ab7a-b56fb39f2e00", "value": 14808064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144104, "uuid": "cf19d773-d7bb-49c0-948e-a0d85f13b787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144104, "uuid": "50d567ca-4216-4f16-abdb-8633d3c61be1", "value": "SecuriteInfo.com.Win64.DropperX-gen.30872.28764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac85b2d-1749-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688131512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131512, "uuid": "2fce5396-ee21-49aa-8f48-b3eeb55174e2", "comment": "Malware payload (RedLineStealer)", "value": "b8f4d37298efbff82ec07aa49ee502a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131512, "uuid": "b4df451e-8029-4e65-b4f2-7d17c47849bd", "comment": "Malware payload (RedLineStealer)", "value": "c2135daa85b4be7b7e17624ebf3919789052a29d9aef41c86dabed291a283b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131512, "uuid": "1ac70903-5d10-4d73-a33b-4ae5c018001f", "comment": "Malware payload (RedLineStealer)", "value": "cbf9a545ce74d9cb72404fb77a3e4d9bcfcd2e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688131512, "uuid": "d4716a5c-fbb2-476e-8121-d4e681664b51", "comment": "Malware payload (RedLineStealer)", "value": "3119acf37f2b6023ab98a4a34556d4424d306f12a26c4a38eea4ad41ecdddfca2ba6f64e51582fda1a0396a5a9d39eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131512, "uuid": "cdde0e90-3ff7-490a-b22a-10c1898e86a8", "value": "T1FC04E668364B657EC96F883D9C600CE0677CAC671246AB079C8FF0E53A3A7919F051F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131512, "uuid": "2a285a51-8eeb-465f-a3b7-e653dc6eee3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131512, "uuid": "4e300aa2-a72b-495e-b8b8-3f9dd92b7084", "value": "3072:JJKwy7lNGoll6ixNM+NT673qGTZ8e8h0:JQjGolAhB3qGTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688131512, "uuid": "958e1cdb-41ee-4ae8-b1c8-5e2fc40aef45", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688131512, "uuid": "d5586ebd-5411-4dea-b294-c012f8febb51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688131512, "uuid": "2e8d7032-8e65-42fe-b13e-c44caf083c50", "value": "b8f4d37298efbff82ec07aa49ee502a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4222ff7-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144090, "uuid": "06a579e6-4279-44a5-82d6-79af11467996", "comment": "Malware payload", "value": "a009d192d61954938dddb6da2be61317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144090, "uuid": "5a56e3b1-88b9-4bc4-9d13-0e0974922ea0", "comment": "Malware payload", "value": "c2a2689212a40415f5bf94e08cc232543076bd9dfae34b78638abc32c84085ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144090, "uuid": "39a9e745-9f13-48d8-9a0f-4c0e413ea84d", "comment": "Malware payload", "value": "a7b26b1810b3a16c4409015dff0f80424db656cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144090, "uuid": "d79c68f8-65d4-447d-a008-bbc29055b4af", "comment": "Malware payload", "value": "fcfe56cbebc38c564856695551148153f654fe6e4fa20a0ad56ae0fdbf24775a0a9a6054427e5df5ab5a64f93a98471c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144090, "uuid": "048eb223-9d4b-4e27-b39b-6440c03c998d", "value": "T17576330C67148A06D5FE177BF0960E2447F9E1977B0577AE280877ECA9F7B66A809033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144090, "uuid": "f4634cf3-e0b1-4853-8bea-b52e92f65a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144090, "uuid": "ab357ea9-af5b-4ea1-abec-f17fd96bf260", "value": "196608:VwhZlfXS2qo0wMaPd4xPWH6KjeWTFL8e+:ug2qo0xWd4VWH+WTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144090, "uuid": "3787bb95-55df-4726-9d3f-4b4234e81155", "value": 7292928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144090, "uuid": "f97da036-abf7-4e0a-8437-82a9c893558f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144090, "uuid": "848096a1-d550-4dde-a3db-2ef849eb924d", "value": "SecuriteInfo.com.Trojan.GenericKD.67726210.23246.22677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3c93f9-171b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688111543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111543, "uuid": "a3657241-a1f9-491c-ac66-73aeb3b2996a", "comment": "Malware payload (RedLineStealer)", "value": "4f88c3ee0a37fa712ccc4992d08f1817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111543, "uuid": "1fa5e564-3943-47cd-ba5b-b0ad68cc0b85", "comment": "Malware payload (RedLineStealer)", "value": "c3605d9a7e5cd2f57b09f4e5721b9817df3803e113d10cf8a70859cb73d02e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111543, "uuid": "972843a0-aaba-43a7-94bc-768c3de1825a", "comment": "Malware payload (RedLineStealer)", "value": "eb3ed3389230ab66f6d5a9fd5b1a850856bf67d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111543, "uuid": "fc9c7ff4-80d2-47d3-8f0a-3ede413a96b2", "comment": "Malware payload (RedLineStealer)", "value": "7ee7d3af511eab3d0833fa8454f7653646b8359a55c1ad930ef51aa57ad6bdee387edcf831bd08da452b96a6650bf411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111543, "uuid": "15dd43dc-292e-4b10-8054-cfa73c6996b6", "value": "T17434BE807353A939CA280270053F196CA3A4DF421B52BB9F52C977E76C33A9976D1F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111543, "uuid": "7b4ca749-3cf9-42ea-be4a-352173d72822", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111543, "uuid": "75c7d349-25d7-420f-869c-e16133b20ec1", "value": "6144:bHFTbJbA2ooooookIwFgZGbpYByPT7lyvIcKSIvF681:7FBbLoooooavByPHly59Ivk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111543, "uuid": "edc0b668-125e-443b-8248-9e949c909313", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111543, "uuid": "42fdb32a-c032-495a-9177-b2cdfae6f6a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111543, "uuid": "cbdc3f4d-3eb2-495e-8029-cf1b229f164b", "value": "4f88c3ee0a37fa712ccc4992d08f1817.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e6493a-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144714, "uuid": "a9974ea6-fe1a-4577-9f10-dcbad4495980", "comment": "Malware payload", "value": "128327fb3decc22f4011c3b33ddd35a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144714, "uuid": "d1fea511-6d8f-48ed-9034-b31fae1de9f1", "comment": "Malware payload", "value": "c38b2cc03b78ca4173c4bd61653c9a10ea798e088d57613164756438ec3c2441", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144714, "uuid": "34b0a0f3-dafe-47de-8cf2-000b61733019", "comment": "Malware payload", "value": "a9f5088d0908436ecba7275a405b20a0eb1f62a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144714, "uuid": "c48f45c2-d715-4ef7-931f-e1e4140bb108", "comment": "Malware payload", "value": "19a85f4722ee18004379480c6f7fec7479d7d8973cb2b09d1e8ce7f07d5d7adeadc1b361b021220d27f8f3663fc2ee0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144714, "uuid": "6ff03bc7-1c92-4135-b875-c5412acb0270", "value": "T1AD646B5EF1E9B5E5CCF3E0B8C1BE8696FA75300D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144714, "uuid": "5af603c5-fb5c-4a49-a070-31ccdba1e08d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144714, "uuid": "08bd78fa-4023-4792-a1f9-242f23dff94e", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144714, "uuid": "b0c0417a-c434-4515-9e2f-2973281de46f", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144714, "uuid": "7f850462-1661-4b02-b884-48eca27b5877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144714, "uuid": "bd61f46d-997e-4c62-936d-dd5e144e9883", "value": "59loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82b08c0-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144097, "uuid": "be820f7b-a4f9-43ea-a9d9-da6483fa6cee", "comment": "Malware payload", "value": "0de0384a9fb6c83017e60dd2521faef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144097, "uuid": "6fc5a235-eb59-42b3-8aa8-8ff3e5edbceb", "comment": "Malware payload", "value": "c38e1ab86b9c9eb0230a11aa218708fcc5c8c6a1450bc87fabb7f731f9fab362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144097, "uuid": "ecb9069c-1019-4cfd-ba73-5a0f5fbdcc18", "comment": "Malware payload", "value": "bfb60c04f1f7918cd91bb524cb1c434e4c911a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144097, "uuid": "b035e833-328b-438d-942a-626502fab489", "comment": "Malware payload", "value": "8268d756ac5681508c919f18b33f0fedc9b2ccc721b271caed96a4ad04c6554fd70745bc78103267948885bc527653f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144097, "uuid": "99bdccc7-e2ba-44e5-98e9-242a52c72cad", "value": "T1B9C63362F7949E31EA2B863875A007A296F0AC67BD91AF4A290470FF7E17F147301177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144097, "uuid": "dc844ce9-b615-408a-9144-5587199983bf", "value": "196608:qBRLQP2+uCK3F7Y111la0gm6E7q5PlVT7s2a8Dznk4VMcZr1ketRysN3UNhUrBtV:qBRLM2+uCK3F7i3imzCs2nTHMcBCG31P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144097, "uuid": "ef9ab387-524f-4c0a-8b57-8347938eafe9", "value": 11817984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144097, "uuid": "58bcb555-b34c-4721-9cd8-23e49046cbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144097, "uuid": "17af1124-1bb1-497e-8861-76b3036e039b", "value": "SecuriteInfo.com.MSIL.GenKryptik.GLCC.tr.dldr.17643.4288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcd0a2b-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144459, "uuid": "5db6a528-105e-43d3-b154-95270851c131", "comment": "Malware payload", "value": "3a9a1db53e3ada5a0e3312291f565c65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144459, "uuid": "aecf053d-4645-484e-aeda-3d37f6019ade", "comment": "Malware payload", "value": "c45583d88f6d1f82da01226539f1383c7383fa75b9f48b73fd1800ec48e4ce3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144459, "uuid": "be4ba1cc-5be3-489a-8d29-09307c44e47f", "comment": "Malware payload", "value": "a3a78920441cf96b125d870efaf99bc5077312c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144459, "uuid": "1c5beb97-e49b-44c7-85ff-5829caae922b", "comment": "Malware payload", "value": "ea7a36f605835f98d74824fa56a5ece1f32d85e88ce4d1dbaff4d28584f0cc883f12b4f3606da274f3956b452da7c2e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144459, "uuid": "343db81c-15a5-4f2b-965b-464b657ac19c", "value": "T102646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144459, "uuid": "2177d6aa-c446-4e18-9810-08765f53bd25", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144459, "uuid": "b78ac9de-1d9e-4ef6-a55a-cd3c44cd0bea", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144459, "uuid": "07716619-ace8-4873-9a78-0987eab49e2f", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144459, "uuid": "be817d19-c832-4645-912c-7b52120b47bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144459, "uuid": "80769e70-abd0-4a04-a0a6-ca4fa009ceb9", "value": "28loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebd2483-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108191, "uuid": "7b493cdc-5549-4fb5-a3b7-0ed7483cf0d2", "comment": "Malware payload", "value": "e31833683a240b1be91d141221cb74c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108191, "uuid": "dfe70263-749b-48b9-a2db-2eebc0f9a6df", "comment": "Malware payload", "value": "c4f1afef35777ddba2aac0c3208b2db471de4010fe2f148e53b5985898e8aa90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108191, "uuid": "3a6f64d1-1326-4e26-8363-791fc45c911c", "comment": "Malware payload", "value": "0aec9cf9941518665149690358d851e6097e4159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108191, "uuid": "2d432290-7836-498d-9069-71f9ffb01374", "comment": "Malware payload", "value": "830907f18dae47fa5963dca3afed64f701922fd48e335a9903ca800243307dfda4636df196053f421045a3e449252809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108191, "uuid": "5c789baf-ce8e-4f65-8ffd-b53f22ecf763", "value": "T12D6608E1750976CFD49F6778AA57CE42A85D07F846250803EC6DB4BE7E63C8522CAC38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108191, "uuid": "73c84581-c6d0-45c9-81ad-8511cfad3006", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108191, "uuid": "11641872-72b3-4e27-bb8d-476bd56e4fff", "value": "98304:HlLudZox5Lxv5/+cwZLEBPcV+8/7NahLd8IPVYbL78SaNoA+:XJs+Z0aNoA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108191, "uuid": "b6ffc697-a395-4dbe-b746-1a9528429e72", "value": 6485857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108191, "uuid": "78f7e6ca-7320-454b-8ddd-aaf22a24188f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108191, "uuid": "61becdf9-d983-49c8-ade5-206d3f77a3eb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a5bc94-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135827, "uuid": "245ab72d-6e15-4089-bd07-6c406d531907", "comment": "Malware payload", "value": "f69022f9e0b845a4ed81b4c640959d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135827, "uuid": "aeda4188-67b0-4242-8d23-441b47f3023b", "comment": "Malware payload", "value": "c4f6d5590bd2aae3dca594bcf8e01fe492c68aa877154512da57ec9e4e6ce6fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135827, "uuid": "0a3c18ed-033f-43b5-a70a-7cd2c4f905d4", "comment": "Malware payload", "value": "e0b9129624b2734c6b6dc7432a9f55b35fefa345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135827, "uuid": "c5943e35-f0b5-4165-a942-26444e5313b6", "comment": "Malware payload", "value": "f69bc7acb8bdeb9a3afc92b1d3b88cec33876f38545307430fbc434c1bbc60d93416afce5aecddf506575245067488c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135827, "uuid": "ac76fe43-4b12-4b13-bec1-c5c77f935eca", "value": "T1F3A6335433C068DFFD9E813AC875551AE198B853A790C2BF03A8839A1F377D16EBB650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135827, "uuid": "a09f99dc-57da-4ab9-a05d-b76a2bd0db3b", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135827, "uuid": "1ebca8cc-6749-45e0-a129-0fb67e2f7d5b", "value": "196608:ZBJ5oHlUn4haHbudQmRJ8dA6lhCy1ArqkVpKCX+PrF4ZEeEObeghNqTz7C:7UFThaHqdQuslhrAZYCuPJOE1megLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135827, "uuid": "adda983f-9d84-4cc8-8496-1b5f5141dc88", "value": 10007349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135827, "uuid": "88f25e6c-71db-4dbd-b2ee-64a64afc8f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135827, "uuid": "d293f272-9181-402b-b39a-c97507a50a22", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af02b77d-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135868, "uuid": "0fcef088-1d19-4633-b431-b2dd87e8e2f7", "comment": "Malware payload", "value": "4ac3d60c4850e37a9b39976c1553df05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135868, "uuid": "55aa670d-9c82-4b9b-a71b-68fcdfd766bd", "comment": "Malware payload", "value": "c53eac22482ec00bebb3c006d442c7b48a448f9d0cc16a743af9a88de1a1da6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135868, "uuid": "6f64808c-6d4c-43fc-b891-72013ab1377e", "comment": "Malware payload", "value": "45e5a0e35be7034e38543fc1a0c3f9ca3808fa5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135868, "uuid": "a9cfbb65-44ce-4ecc-bada-e411aed05671", "comment": "Malware payload", "value": "9b3034ad5ee39ffd8382b0e8bf2733dcc93116fbe5056b559553a6535b8f3bea2617ccbd4f3fb919095722961aeaacc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135868, "uuid": "760ff8ac-c2ef-4852-a27a-fff13f494ee3", "value": "T1ABA53388E171D1A5CD2A41385619B97FF91B0C7899BC4DD28FE13FBE9D3C18252E423A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135868, "uuid": "d3ff62b7-e3ec-4d64-aa52-12b8179042f7", "value": "63685582f743c381f537d25cbc69ab79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135868, "uuid": "790e9b9b-8717-4d9c-99a8-54084d42e028", "value": "49152:vepDNj9UCdjGNjXn/S1qe7FFsOAckBNMmH3Cy+3u:vKNjuCpaj61RjONQy++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135868, "uuid": "fb98d05d-c337-4b58-a602-d327cfd4367e", "value": 2166784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135868, "uuid": "6ee25f9f-3374-49fd-89e5-f1eb038df4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135868, "uuid": "0f5538b9-300d-453b-927b-56e2bbd6b26c", "value": "_D0DE469BB8424834A796EDFE1D0176CA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc48bbe-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144642, "uuid": "93e1e51c-fe01-44db-93ea-677e0181051f", "comment": "Malware payload", "value": "cc7417bcdf17e80ebed5d2e711d1bec5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144642, "uuid": "0e2d6ab7-2f6d-4a2b-9975-2c4d2e11c59d", "comment": "Malware payload", "value": "c67070eadbed16a56ce0b138540585436b801aef645a02843f74da50831c82ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144642, "uuid": "b7e7f5d8-131f-41e5-bd29-845a7b528627", "comment": "Malware payload", "value": "681140e1f661c3e5c41072ed9556d57408e92c4a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144642, "uuid": "a4b6b7c3-8fb1-4944-86c1-036b75178488", "comment": "Malware payload", "value": "c2de776e26595a655231d1c0c35e582419f0cb9f76db4644797f7c559698e8d9ef2952fb76ff69bcc6a4dafccd9db605", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144642, "uuid": "793540e3-bb07-4319-a57f-ba6622f07b55", "value": "T163646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144642, "uuid": "7ac00743-03a8-4b64-ba59-4ba8d20b885b", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144642, "uuid": "00db994d-7557-4461-acbc-00c1c4d55202", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144642, "uuid": "62dac138-1e68-4b5b-bc89-ad8cb3ee6668", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144642, "uuid": "de378e5a-8b98-422a-86cc-4f9b42cd8c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144642, "uuid": "3e6f5167-eefe-4685-a4a4-699669af760a", "value": "51loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5a008e-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144779, "uuid": "8ed134a8-738a-4ce5-87bb-300a85e519bd", "comment": "Malware payload", "value": "19c04bb363de37eb2c12beef3197d0e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144779, "uuid": "9af43204-49ec-4c8c-9144-2124ac80e635", "comment": "Malware payload", "value": "c695ea56e8bafd695949e5d5f6974fcca839515b4d7416c240ff7ecf0a766a51", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144779, "uuid": "fb9e41e4-3b79-4f71-950e-39af91e51086", "comment": "Malware payload", "value": "776482982b15b7cafc5f701aaec175fe47db8ac6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144779, "uuid": "68956c57-594a-4945-9723-e93cc46214b2", "comment": "Malware payload", "value": "da32631db2708dd7f82518a8165a4cba959a1f444b7c271fe6fec5e73a15874abdc6b71a2fc68040d2bd340896277bb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144779, "uuid": "80325803-291f-492c-a93d-3432d604ef32", "value": "T132646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144779, "uuid": "3d9fc07b-1d14-4003-a7e7-e680ec3a8bea", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144779, "uuid": "4730f62a-54a8-47a9-9570-50b1c3bfe933", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144779, "uuid": "d8b21a1b-9445-4a6f-bb39-15607e08bcc5", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144779, "uuid": "b97ce944-4ed6-411e-8d5f-c2b55ff4ee25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144779, "uuid": "6ce83875-ad15-47d2-97ae-2eb005b23b76", "value": "67loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb4d342-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144861, "uuid": "4b38148c-e388-4e90-8242-f323fac13686", "comment": "Malware payload", "value": "9a92456f61b7cc82cdd7893d40c7f65c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144861, "uuid": "3c7d8e18-9c9b-4a5c-bb34-456f8bb381f5", "comment": "Malware payload", "value": "c7592df8debeeda292fc093a4607d7d81174bfb9c752ead1e731cccf3cacae00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144861, "uuid": "764a4bac-c1f3-492b-996f-7c584e2c4d6f", "comment": "Malware payload", "value": "db5c762695cc4e377cd368c746f7c2edfabb6873", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144861, "uuid": "e94795f9-a935-4b60-9678-f3e551719bac", "comment": "Malware payload", "value": "62deb2323c0079d34edff727d3d45040a2f1775c7806a5298574e5c109cfdb03419d466c3422f4afa69d942e4d049281", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144861, "uuid": "2b767374-0894-40d0-9a91-beb4b73bfe7b", "value": "T100646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144861, "uuid": "6e728a0c-2c84-445b-9e7b-f4042279c9e8", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144861, "uuid": "1f7e4b36-575c-472d-9403-30278237b254", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144861, "uuid": "28e5e076-956c-414a-9da9-241d3ba5fb80", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144861, "uuid": "a7a01c09-f789-4a07-a88b-9e155c4337ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144861, "uuid": "30fb6df1-d01c-40e6-9de3-59d6e6a80a77", "value": "77loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c372eb-175d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688139926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139926, "uuid": "6ee00f87-ca97-46b6-a2db-a44d04506532", "comment": "Malware payload (AveMariaRAT)", "value": "bbafc80e9cf22cd8b7e0618cf9423f4c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139926, "uuid": "b4488917-ddfe-4eb4-8e82-779048696bb5", "comment": "Malware payload (AveMariaRAT)", "value": "c897c8d2450936785b92dae3655022d1c6f21c9a56c5117f823dec60eca96868", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139926, "uuid": "0c276b58-31e7-4eba-96f2-f2ff6ec5a366", "comment": "Malware payload (AveMariaRAT)", "value": "d5dc26422792b0736d5c15d92d10e1c5e3593081", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139926, "uuid": "dca8b3e4-d967-493d-a40c-8049bcafcfb6", "comment": "Malware payload (AveMariaRAT)", "value": "49ea9a05a6bcb5e50edaede6da3c5656f5145ce1caaaf4eb6ad92dbdbbdb4ac0a3d897c3bf4792aad83565328c68af0a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139926, "uuid": "8e0c67b9-8180-455e-8569-c0ff2b84b3bb", "value": "T1EED4E19C7650B5EFC81BCD769E982C60EA61A17B170BD203A06322EDAD0D697CF115F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139926, "uuid": "4a068e6d-fd50-43b1-88fd-97a68f39ef6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139926, "uuid": "5359cc5b-da7a-47dc-bb5f-cde29b0bd8ef", "value": "12288:Q0l8p2iNfmsZcl96YJih8VaxIvpiCaYJdJvYXQmCdfGIJAPs7wjx:9lC11ms66YlV3NaY3Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688139926, "uuid": "65a68b9e-ca34-4f89-aa0c-23a8d40c438f", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688139926, "uuid": "67194e01-51dc-495f-827b-26f2bf83710d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139926, "uuid": "0c30ee79-6c62-40cc-9433-e349f9a435d1", "value": "bbafc80e9cf22cd8b7e0618cf9423f4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141e4148-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110697, "uuid": "bb5f70c3-5f3f-4af0-9fb7-7d33d4d16477", "comment": "Malware payload", "value": "45d1f210f78c7e79884d279e90eb0e6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110697, "uuid": "be6fdf81-0572-46be-8f5d-c9d7d0dbcf2c", "comment": "Malware payload", "value": "c8b6ac07bffb6eccc53676c3f5c439fb3df848f7c11b7c8502a41582928a7f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110697, "uuid": "514353a7-e7d6-43c5-a64c-d41f251ec11d", "comment": "Malware payload", "value": "0f681b83aec2dc93f2054484455090b886752a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110697, "uuid": "265ceb78-821d-4320-b466-14d686387c7b", "comment": "Malware payload", "value": "67d8aa168e30c372b966a2dd51370fc4a022726b5522a89b4006fb05e0c051f1ae3535c4d05ad281546f024cda8c7a57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110697, "uuid": "5f2d75a5-d589-4b2a-85cb-8818dbbe095f", "value": "T16C938D31B1D0C032C4A36574547492E26F7E797227B8A9CB5B6828396FB07C16B7C39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110697, "uuid": "7547f2d8-1f6b-440b-890d-a2904b8226bc", "value": "1536:4YBD1IgLwG+MMMof/27UO0avFAFI0i35wkbJPxogEg7nCngC:4YBD10BMTo2771tPx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110697, "uuid": "180c4d8a-cd29-402b-9810-8b26be5c7a65", "value": 93863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110697, "uuid": "6b1ce66e-6700-4892-ac55-ec604c6d9d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110697, "uuid": "7cdbdd3e-f3f9-4f21-a151-83a084020c7c", "value": "45d1f210f78c7e79884d279e90eb0e6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d4781c-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688120934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120934, "uuid": "7d762c13-1c94-40ee-a682-bd2c595756b8", "comment": "Malware payload (AgentTesla)", "value": "99d177d432d32b757d2620638b0905d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120934, "uuid": "c1296a82-5083-4252-a72a-1aa6b7437672", "comment": "Malware payload (AgentTesla)", "value": "c9e2dee6a1dc4f492f226a9a3d5d78477b50211d680267ec4e00da90ee8d8370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120934, "uuid": "6513e366-64f2-46f2-8b57-1732460a331d", "comment": "Malware payload (AgentTesla)", "value": "1da00194acde0698268ebbfda44c8648629517b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120934, "uuid": "ac66ebee-b7f5-47e5-a921-7b98977fddca", "comment": "Malware payload (AgentTesla)", "value": "4dab6fe30ba8a53dd8a6f6dec01fb7bf128f71890e26b51521ce12e7a80ee8474b4a60e39c56383e26322f218ed0b568", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120934, "uuid": "d80bb316-ac4d-4a55-9fe0-ce5fbf30aed5", "value": "T148844A4C3B8EA617E67F97B6B0628F840678CD5B6153D7CF1982B9E01FB63C1540A1B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120934, "uuid": "08b485e2-59b7-440e-a8a1-9a1bfdbaa18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120934, "uuid": "45ce515a-92a9-4a5d-8f88-407b2b9cda8c", "value": "6144:AYZ+Y7UVm2PB6NoNP+OQjnTggEHGtx4bazCSOd0WPXokAg:AYZ26NoNWOQjkG2azCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120934, "uuid": "ea0154ed-9038-4bc0-9842-19b261198038", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120934, "uuid": "e5997b89-baf0-4e26-9d33-d7fe63a49af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120934, "uuid": "a15b6a60-77a9-44c4-9745-19f46fc3e5f0", "value": "SecuriteInfo.com.Win32.DropperX-gen.30452.21360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fc23f4-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144476, "uuid": "ca020d53-44e2-467e-bffe-6a8c3d7d61fb", "comment": "Malware payload", "value": "d185c6fc131478c95537a505c7b1ff9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144476, "uuid": "54550e43-6f43-425a-ae3b-611cdf85a668", "comment": "Malware payload", "value": "ccc5efdb1d58206d39a0924a506de7601d404db45872e190386ee9abb49fa849", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144476, "uuid": "fdc1d63e-4ade-41d9-9664-2aeb12b60471", "comment": "Malware payload", "value": "47df94f21880387c803b0f427a60c985c35fa184", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144476, "uuid": "d5e88907-627e-4b45-b0b0-15ea4688618a", "comment": "Malware payload", "value": "6b289e977e35997533ca6a8a21a73ded488e138f91389428d450c051b9855792f37c7df9439e89174b1fcc6fb9e70259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144476, "uuid": "c8ead0d3-34ba-4191-a61e-9e1449e85e88", "value": "T1EA646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144476, "uuid": "034437ff-974c-48f2-a575-b9c3d75e3dc5", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144476, "uuid": "b8c3c935-3ca8-4717-a3b0-37405080bf7c", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144476, "uuid": "0bacd290-07e7-44ac-9c5f-d96019b082f6", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144476, "uuid": "3cb9c3f4-d46f-4aa6-b737-236d86449c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144476, "uuid": "a12cbf88-d243-40fa-b38f-42c0e1bfbff0", "value": "30loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354c86ae-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688169164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169164, "uuid": "82c487f7-c68f-4cf7-98b2-7f7121b274bf", "comment": "Malware payload (Tofsee)", "value": "2ab3a0b70137c4cda8e9617ea0b24f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169164, "uuid": "5d641773-d1a8-457e-9a0a-c9498c2072b5", "comment": "Malware payload (Tofsee)", "value": "cd8cd3b51c28a0989e8d506ef07ba261373ae6c91a93fa0aa48927db40e4625d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169164, "uuid": "f4a64fe8-548d-440f-9b37-ac268f8cf617", "comment": "Malware payload (Tofsee)", "value": "7044ecbc79ce878458ed9bca82b772e9892e4f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169164, "uuid": "e96df53d-2f82-40ad-a81e-e53bddba0152", "comment": "Malware payload (Tofsee)", "value": "e491048592794a7366c4bbae9a2fa19d80ec95d4ad5b781449bb32198e095c7966194d917eb6e442d4b003b485e883f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169164, "uuid": "80f0de2d-92de-4a48-8e39-4bb54dc0eaea", "value": "T18364391392A07EF4E5269B72AF1FCAE8360DF154CF093B6632189E1F04B80F6D663615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169164, "uuid": "991822a0-d777-4d6d-83b9-0055242318cc", "value": "37146ea85ae0b616e18a34bdbcaf2cf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169164, "uuid": "530fc89e-5c45-4994-8609-f258d7f8816e", "value": "3072:xGhRHuEHjZ6ZVXtYOr+/dNIdf6R+WhW5DMm6fvyWyTA:YLHugZ6ZVXtD24di0WWMHfaWyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169164, "uuid": "bb8be959-1107-48cb-ae93-c2f767619e49", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169164, "uuid": "d2e6ccbd-9026-4b62-9ead-695570cc7561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169164, "uuid": "a79cee05-72f9-4016-885a-67bc022fcd84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858d160c-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688111317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111317, "uuid": "5e2bcb97-d94e-4c36-aa1e-4fe55f7a9fbc", "comment": "Malware payload (AgentTesla)", "value": "ac52c79c91c7467403d22fc73e090824", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111317, "uuid": "993c148d-d627-43b9-9276-ac9aef3bd78b", "comment": "Malware payload (AgentTesla)", "value": "cd917c86fe27ecd3feeca690377817bce1f4034830e6d68a19dbffc8c61e97bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111317, "uuid": "dc9a505a-11c9-4985-9a43-53bd095bd04e", "comment": "Malware payload (AgentTesla)", "value": "378b3474289a9b44a582cfca60a4439dfc12c4ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111317, "uuid": "aff4a885-d7bc-4107-91bb-1d8be08b557f", "comment": "Malware payload (AgentTesla)", "value": "2e8b8d7319dd0a6c748c73db8d13ca53339d118fd4169a0d49abd51a7f83b2eb16eff2774bac5e9214c0ac9c77d3f3ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111317, "uuid": "63694bf1-1a4a-4aef-a446-2e6952788948", "value": "T187E4483D29BC5723C134C7B5CFE18723B224982B3161EA765DC39B954796E422AC363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111317, "uuid": "fab3f4a9-a33d-4f28-81ce-89229b8b100c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111317, "uuid": "8a8ed8bd-ab92-4bca-941b-9dc677ac3f18", "value": "12288:xFuPUiutBujUn9Km6JXidl1riyPW+wm4VJbaZmGwTDD3EaO1f75exBLj:TuPUxtV9YRQlFSrVJG5wTDD3EaOJiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111317, "uuid": "f5e4da34-5852-4fb5-a462-0c61fa80d0b1", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111317, "uuid": "1de247b5-9864-4c13-8c2d-519dc136a7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111317, "uuid": "a1520d33-8b82-42ee-a7c2-46892eb376f8", "value": "ac52c79c91c7467403d22fc73e090824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60427d8-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154401, "uuid": "b23a7e82-1187-49ae-891d-e029e4f6239c", "comment": "Malware payload", "value": "f3a03325b5ffac0cfd9df4eca5776fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154401, "uuid": "b90a7c20-9a9f-4abb-833a-bd2bfe342c31", "comment": "Malware payload", "value": "cda3ab9c1f6fb75333b3e1b70036efa8778f346946442285a275f4f6358e181d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154401, "uuid": "16d71468-f3d2-40b2-ad96-2069b80ca414", "comment": "Malware payload", "value": "da17352dd015c39174b1e03e68eca3a75080c1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154401, "uuid": "cbcf701d-c5fc-4952-8236-8e76796f3421", "comment": "Malware payload", "value": "aabb707b4bbfa772705ceb4039b4563d1ec5b5053848dce75a373f4e328c0e857e99b67102cb2c6e5a9da385db42a9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154401, "uuid": "f192f2e8-97d7-4846-a534-523021fb9b65", "value": "T191660209B3B4CE17EE9F07BEA372426583FDC919A14AA74E164DE1F65492310E84CCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154401, "uuid": "f907df90-0366-4feb-9ad3-e3e39132e6d9", "value": "196608:qqlGHbjPXJn3xdEjOo2BBT3J9ms11HtB84G+WU:nGvPZnCeBTjmwNB8d+WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154401, "uuid": "b979f56c-489d-4ccc-b1c3-78e8127ce6cd", "value": 6562304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154401, "uuid": "258e53a5-f238-41b6-8940-6c7fc2043eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154401, "uuid": "bcd60296-356f-4129-8ed0-77fa94d0c8b3", "value": "SecuriteInfo.com.Win64.Malware-gen.3291.22873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80130727-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144379, "uuid": "52b2ba7b-5620-46cb-b2ec-95da4fa8fdbb", "comment": "Malware payload", "value": "ab9106c0bf1b52ccd6e6c7352a77a5de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144379, "uuid": "f7c9e770-d2de-4c94-a658-6668f2a4328d", "comment": "Malware payload", "value": "cdfd3b35aba9dfba211774e8df04724907193505b156b3999f49cf03c58c913e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144379, "uuid": "36f80bce-c01b-47c9-9b0e-e877a2134dbd", "comment": "Malware payload", "value": "7a4b4f99637484a1452761f24162b1ce07d089b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144379, "uuid": "f041e54a-8164-49db-a28a-78bc3e94d523", "comment": "Malware payload", "value": "2a63c3e6f1a52f0f579e1fed6f0ad6e08916b0f0b175f4764e763d16111d7744901c19009d628ac3bb1462cd37a139f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144379, "uuid": "68c71829-c67f-4e3c-96ef-5d3239f5e74b", "value": "T13F646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144379, "uuid": "c2b75728-3ff0-4672-b0b7-e90723737ea4", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144379, "uuid": "9e4d5d05-d1b7-448f-b362-3ec970ecfde5", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144379, "uuid": "a6b1c94a-dd38-4eda-bd67-ee4b1b80307d", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144379, "uuid": "80a82363-addd-44f7-a2e0-b6b65058448b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144379, "uuid": "2a370eda-7dd8-4779-8cab-375e608cb3be", "value": "16loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3320bb-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144614, "uuid": "ba306361-6af3-4ce1-ac84-795766fd17f7", "comment": "Malware payload", "value": "0e5a8d1b0a85067c9e5696a36084f62d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144614, "uuid": "315097f6-a91d-44a5-825d-7e895e81d04e", "comment": "Malware payload", "value": "ce41803389f07224ba06d80b859d1430d31eeb36d6cc5a9d719b30af0af1875f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144614, "uuid": "5e8089b4-fbef-4fed-af03-d40da04df9e4", "comment": "Malware payload", "value": "7e2f51582a71bfd14dbbf59c29249db29c666d0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144614, "uuid": "3d3e146f-52bb-4f51-9c79-8bafe54d2319", "comment": "Malware payload", "value": "6f7bf29766b51df385aac3157282c4f84906fcb14fdecb5a2a83e76235bf07d3c84c46d7a6af5a16a8d6965d96f5a690", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144614, "uuid": "8161104a-3bac-4fe5-ba38-35d024c19adf", "value": "T143646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144614, "uuid": "72926b4e-a8cf-4b5d-9510-355577445753", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144614, "uuid": "f78fa8da-63af-4681-bc82-8677da498582", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144614, "uuid": "95c959ea-3a1e-4409-b8db-9640ebb18148", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144614, "uuid": "3478549a-21c9-4540-bbdc-70f6d07aec51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144614, "uuid": "1478b022-4c24-4ccb-9fdb-44054e8ed455", "value": "48loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631b4cce-1742-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688128439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688128439, "uuid": "18d3de12-1264-4274-a7dc-968555c93b46", "comment": "Malware payload (AgentTesla)", "value": "f1a3492ad9b9f7134c4954a565478e6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688128439, "uuid": "a7f99d5e-a3ff-4677-ac04-34a098c5ece5", "comment": "Malware payload (AgentTesla)", "value": "cef9ee760a9e4e3d132a05164243a878622db8cb86d26753e10a4430312d3486", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688128439, "uuid": "94558aab-b824-47b2-94c4-a8a9a4f4da78", "comment": "Malware payload (AgentTesla)", "value": "276950b89f2a9a0b1689d4aa14f6604075c2bd44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688128439, "uuid": "66417742-5c28-42ed-b018-7257baeb593c", "comment": "Malware payload (AgentTesla)", "value": "abdeae39ff543c0e827b5c5501f833c41fef50091880ae8e7650fc032874b86b4e46eeda64d9457106407b948165e325", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688128439, "uuid": "dc8c0888-bbdd-4aa9-8ad6-8f47e9cf0c19", "value": "T13D25D724957E0912C074C3BDD6D1E32FAA9D4C9724209B321CC27FCE9F7AA06159BD6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688128439, "uuid": "210efee3-a978-4ba1-a8e8-883427a56a4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688128439, "uuid": "abb9db62-cfb6-49cc-9793-996df7e0f62e", "value": "12288:IrBk763UvVOD4vNfHs+w2AEOUdS6B7R2xuSH5MfPboK8:IruoU9lF42omQxu1Hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688128439, "uuid": "d2511f27-8f3f-466d-af09-5338e35cdbc6", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688128439, "uuid": "212fabce-a2b3-4204-ada5-48313204c9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688128439, "uuid": "49220b61-3194-4e3a-aeb1-3d1fcfd6967b", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e66ff6-1703-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688101541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101541, "uuid": "443c7ac1-7267-4244-92a5-c9512c49b712", "comment": "Malware payload (AgentTesla)", "value": "5554a8f5afdfd930d7dedb7d0fcc6913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101541, "uuid": "3be35779-7356-4d8c-b5cf-6b97f4262a5a", "comment": "Malware payload (AgentTesla)", "value": "cf97a63b3df6d8de1da6e6f64089917cab11cb2a24f53a06aab6c288b1184b23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101541, "uuid": "029d1016-3f83-4a53-8ad9-e32398268b6d", "comment": "Malware payload (AgentTesla)", "value": "7772e20a990f43819280dc7d4406493feebb0983", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101541, "uuid": "76969557-5ef8-4931-ac18-f642de9363d7", "comment": "Malware payload (AgentTesla)", "value": "ace9c9ba6d8bcb53375b985afbfc2be4da8f211d646774beac097a963dafe39e5302dcb5916818f57bb6399751ffdc70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101541, "uuid": "3e7c4a30-c4ef-4053-b69c-37089f00df33", "value": "T12CB4338C81164C67F02BA108923C72A47EDF97B9AEFE558AD1056C61CD0FBF25E9131B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101541, "uuid": "5ed4afa3-b8b2-4179-a247-c449109d8807", "value": "12288:SVVtinYA5coP9o8Mhu97vUdHtfg3vX1wRuTB1RhX9:SPt85co1mOUHZg/X1wRYXht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101541, "uuid": "52d3bc45-23d7-4a5a-973f-2cfde97510ee", "value": 524765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101541, "uuid": "df1a68ef-f4ba-4897-88f4-70461d6750c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101541, "uuid": "de68b4e0-cdb7-473d-a8c0-c075681c53f8", "value": "packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b045ab5c-179c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1688167223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688167223, "uuid": "156efbec-88a3-401c-bddf-bed1206063b5", "comment": "Malware payload (AveMariaRAT)", "value": "24eff0556a9977f1db95d077b78cf224", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688167223, "uuid": "4daa714e-db65-42d7-a436-86abd147c849", "comment": "Malware payload (AveMariaRAT)", "value": "d025fe31c8af04b66743695df6f9fbd7b451b57346ebedd501ae13005c83e08e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688167223, "uuid": "aa9d49a5-79c1-4397-b0e4-8c822040f9e0", "comment": "Malware payload (AveMariaRAT)", "value": "b42ac34f91d8b9ecfa492c0b65afc01e33690cc4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688167223, "uuid": "5f7c07b8-4280-4071-8757-a912d802b409", "comment": "Malware payload (AveMariaRAT)", "value": "fb61dd14d66debb19630629b346cda6fa80b39c0640477d1c5f1d50b924de4f6e4cf0fc17a4f29060fd7881257385095", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688167223, "uuid": "f96c9f81-937c-4ea6-860d-050580518bfa", "value": "T1D4D416F919BD5226C072CAB5CFD5C723F117842A72619D32ADD29BA10BB6B4235C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688167223, "uuid": "acf7d639-dcfb-4735-bd2a-fff898b08255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688167223, "uuid": "faf15a3c-4e7f-46c6-ad57-78805323e07b", "value": "12288:d2iNgJU4G8HqVS+nKo7sLTCcU6UIc/c4MmyX4q96Ku/14Jw:d1yJUPJnK5LTRU+cEbme9614C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688167223, "uuid": "7ecc07de-d590-40e0-9795-83b4b29556d8", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688167223, "uuid": "eb79e7b2-e7b7-456e-8b46-6bd2fe82a9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688167223, "uuid": "f17ea3b7-073d-43ea-8036-0c7982c446ec", "value": "INV0037488383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2fbd5b-173a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688124912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688124912, "uuid": "aed3e24c-e7d9-4c2e-bb1a-7d13ab98cd47", "comment": "Malware payload (AsyncRAT)", "value": "b6f4cd84f9452d5e364c479742ce4b65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688124912, "uuid": "af3f9e68-3eae-4bba-9d05-f0c6f014da20", "comment": "Malware payload (AsyncRAT)", "value": "d02aff3e225944eb3733c89cf9cbe40cbaf64338e2d3f096d38f61217f82eeb8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688124912, "uuid": "3123ebff-87ac-4d6a-8e78-585056477b20", "comment": "Malware payload (AsyncRAT)", "value": "b419d8761146934b6f77b636d13685d065451f03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688124912, "uuid": "3a022260-550e-4c1d-9433-5805460443b2", "comment": "Malware payload (AsyncRAT)", "value": "1628878cc12c8b08e04335eeb35a7cdf736cf8cab989915d92f567aaf92c5d1589d29c39e4e0116f3d4dadffbf99eae1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688124912, "uuid": "cabc4d0e-fc9d-40ee-9224-73dfa2b9e007", "value": "T194232C003BE8822BF2BE4F7898F26145857AF2673603D58A1CC451DB5713FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688124912, "uuid": "0db830c8-f0ee-44cd-a43a-6992890b65e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688124912, "uuid": "39b40e0c-1b2c-47b2-85a9-f4642c12b4eb", "value": "768:LuyYN5T7w0vqWU8Cuzmo2qQWKjGKG6PIyzjbFgX3iUVyGTiS6v+GBDZbx:LuyYN5T7XL2mKYDy3bCXSUAnmIdbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688124912, "uuid": "acb3d734-21bd-4e0c-b369-c0e4f4adae1d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688124912, "uuid": "3ba92e43-25e7-40c8-91d8-a9207c57002f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688124912, "uuid": "30a8ae0d-479f-4a91-aa05-a214667f08ae", "value": "b6f4cd84f9452d5e364c479742ce4b65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bac75c2-174f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688134063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134063, "uuid": "c1e349f0-2fef-4099-856d-10986ea64fbd", "comment": "Malware payload (Stealc)", "value": "89898788b3e29fe9336eb005a461accf", "object_relation": "md5", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134063, "uuid": "d46981ab-b0d5-477c-8a52-9c8aac9c2aad", "comment": "Malware payload (Stealc)", "value": "d044b2e2fa06d26d5feb07c473fc8e185903326c0bc88c96f05d7c62eaba63fe", "object_relation": "sha256", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134063, "uuid": "a28b2c57-d4f8-49c4-9057-933baeeba1c4", "comment": "Malware payload (Stealc)", "value": "590583d74f3745a844e8344266127bbadd955e51", "object_relation": "sha1", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134063, "uuid": "1600c037-51e0-478f-ac22-66eb0fea81f9", "comment": "Malware payload (Stealc)", "value": "fe0bb5ee4d77d5c66255697995dc42031a084a5ea42db9bca7980d47be238c84a5c0bd4ac7b7e6495c4d54f4c68384a6", "object_relation": "sha3-384", "Tag": [ { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134063, "uuid": "e8d66368-b9ae-4e33-96c9-b667714001d3", "value": "T1A4C633937B64264483C7027143E4694AA3B5E5BF822627B753EBC8201BF5F1127973BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134063, "uuid": "96bd8818-6947-4b88-b026-4006cd23905c", "value": "196608:E504QYlYDXrnxQEwdT3bUMY3akRrK/B6na3hMtn8xb9nwXy1ugCyAhLRA:EaQOXmdjo18IQmn8t+sugCphL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688134063, "uuid": "c1e19f7b-c1c8-4336-a6e4-bf102b5f1cba", "value": 11766343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688134063, "uuid": "de878d95-b81b-40cd-a45c-255087bf66d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134063, "uuid": "a3323879-5857-4183-ae66-264b2d415c52", "value": "89898788b3e29fe9336eb005a461accf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b7a2ba-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688111216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111216, "uuid": "8ab1a0a9-4c43-4120-a6b1-2c2ed8f3a1b3", "comment": "Malware payload (Formbook)", "value": "cb66355b2504a0a08aa7192f024e7307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111216, "uuid": "f60ad497-9a16-479b-8a06-21b5d9e6201d", "comment": "Malware payload (Formbook)", "value": "d088a3c1bbc7b1c97e5ce94d4a2e1f8ed7fcf7cef8e2b21d70ee15bb3f49d509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111216, "uuid": "65419752-98d9-45f7-b99c-2f8d7f9fea7a", "comment": "Malware payload (Formbook)", "value": "32e7a466a70289ee62c36d859fe4f5bc72ab0677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111216, "uuid": "fb792f2d-a440-4ee8-b6c3-8d274e7b28ef", "comment": "Malware payload (Formbook)", "value": "bb2a0e234388605db79da962e5a465ff47e58620a9c4488df2d00b6271d0dea650d94dce26e91c7c2c3be68b1e16c967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111216, "uuid": "c1653b99-5aea-47b3-9bb4-847231cdecf9", "value": "T105E4483D2ABC5723C134C3B6CFE1C723B264982B7161EA665DC39B954796E4229C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111216, "uuid": "4b632c2d-7497-4f37-a266-dc520acb4fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111216, "uuid": "608a2bc7-9b00-4b88-b6ef-0fc4a2c7ceec", "value": "6144:/ZGczuXq1DTAv/2eIlnu9RfcevNP9Bp7S3VdKN8lODh3ykJEvHhLqxpvtjycKSGm:/FuXWDKueI0REeTu3u8lcEvhUyclGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111216, "uuid": "fa97bced-406c-40e9-8ff7-50db8bca1cf0", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111216, "uuid": "5dfb82fb-b2ce-4a8a-ae07-a3809e65191b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111216, "uuid": "be13dfe8-b48d-4ea6-9ac2-afd1e6c1b7a5", "value": "cb66355b2504a0a08aa7192f024e7307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82095dd7-174c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688132786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132786, "uuid": "0988af87-e285-4661-b1c9-51a5ce0de488", "comment": "Malware payload (Mirai)", "value": "5f93d51cff104ea0c3aec6ef13532093", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132786, "uuid": "843897fd-0db9-477e-a4d9-d82aabb1cb28", "comment": "Malware payload (Mirai)", "value": "d1d545c05d29aace58eafc059eb05542931c4f0173c44171c41ad4fa78f8c75e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132786, "uuid": "f194ffd9-cf92-4d02-98d7-f09f546ab2e3", "comment": "Malware payload (Mirai)", "value": "b61f430666c5c01d2591bb12401f7332eb051c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688132786, "uuid": "2c1eaf79-5d59-416f-8b52-376e19b14cb7", "comment": "Malware payload (Mirai)", "value": "a40093d30a0f67fa395d0e9ae8ffb01b8558085a56efcdd123110cc0551bba9903216bf3600fff7bdf712650e296db40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132786, "uuid": "72199a2b-a750-4e3b-bfe1-ab1fef9133ee", "value": "T11DA3E622BF650FF7DC9BCD374AA92705198C650A25F97B367930C848B64B25F29E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132786, "uuid": "c17d11c7-0557-4cdd-9e25-0d32977ebcc2", "value": "1536:CUb3kUIgRwaom79x0WDmE3QqYowq6QJAriITw/XUNfgZUFleGDnnn0:CUb3kjgnR79x0WD1QqYr/w/XUNfg4Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688132786, "uuid": "656765ec-68cd-4883-98db-5e7b5cfe01d6", "value": 101672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688132786, "uuid": "07d6e845-0f8c-45c0-9f2d-d3ed9cead75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688132786, "uuid": "a2a8410d-3a3d-4dcb-aff5-02e56d325f1a", "value": "5f93d51cff104ea0c3aec6ef13532093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea4a3d2-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144994, "uuid": "f25f7471-66b5-4f90-8750-5b7adbea811a", "comment": "Malware payload", "value": "8a85113be2c51d6d424c7b617e951c4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144994, "uuid": "130d272b-0c20-43fd-b6c8-a364cfa6e2fd", "comment": "Malware payload", "value": "d2bb7957248b0555332c439ce5575b47587064531921f9b82b2fc777e60eaa50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144994, "uuid": "e2d64d13-ecba-4a63-8fa6-490b08287d1f", "comment": "Malware payload", "value": "6f11e5776a41338828e997654debcea882a47047", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144994, "uuid": "d9f0a944-9798-4a4e-b380-6cae7d08fc93", "comment": "Malware payload", "value": "aa24a173c6555dd7fbdbbc46056b5e395c4aebe904147b137a2e748eabb31bbde55ef33c603a1ffbf1763d352aecfc82", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144994, "uuid": "af64ea31-1542-4bce-bd6f-06bc6b939725", "value": "T1CD646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144994, "uuid": "6c5a2423-7a11-4462-87e2-efca63566ae2", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144994, "uuid": "05132aaf-58a3-445f-9703-e1eeb0dfc3b4", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144994, "uuid": "6279f469-b076-4043-8805-8425ef7c72ee", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144994, "uuid": "4cccbc56-2246-433c-a193-110999e660ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144994, "uuid": "f0f0a054-facc-422f-b9b4-8d3bb78d5b3f", "value": "98loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46c65dd-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144896, "uuid": "3c71a453-a13c-4e97-8de2-0da26ffa0f69", "comment": "Malware payload", "value": "a1c42ef5caa2f6c814c8c8dc442000ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144896, "uuid": "fc7fc96d-256f-4a1b-9269-30806dd87571", "comment": "Malware payload", "value": "d3d8f96cc416e55dad60e03da801e9f7256969ec2d9f149ddb79128260f1b8d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144896, "uuid": "58a95237-d632-43bd-a5ee-602ef9a2eb89", "comment": "Malware payload", "value": "89596bde14587c624b124a94a169c20f26f4e31a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144896, "uuid": "56c95852-efc4-41e9-a297-18cfd5a42b87", "comment": "Malware payload", "value": "7e831284920e3424801136794104d7a80df1f0839b48d92692efeae6b110785237d233e2041d5df62eca7e28efda3bcf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144896, "uuid": "2b1865c6-54a3-455a-86d1-a9bbbdd0074b", "value": "T1F9646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144896, "uuid": "a44e460f-ece3-4818-8190-065261200da8", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144896, "uuid": "22de5fc8-f4a2-4437-9b6a-004667edf0db", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144896, "uuid": "fbc74ae4-d3b6-4601-895c-03a1c1606a85", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144896, "uuid": "801eb75e-4621-4a4b-8027-a1b8b847822c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144896, "uuid": "98685182-2b86-41e0-aa0b-a3a38dd32c6d", "value": "82loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d0d64-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144907, "uuid": "35af91a8-02da-4119-9a93-d179f4b7fef3", "comment": "Malware payload", "value": "10a245972d5134621e68f7cf514f45d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144907, "uuid": "9a52d227-fcc7-4b52-9ec2-e97396db02c9", "comment": "Malware payload", "value": "d419532c6b0faad01f2cc2600f9d20ea37f76971d82c4398c7f6efc4b105f451", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144907, "uuid": "b717b406-5247-4f01-8fef-4267cd3a8073", "comment": "Malware payload", "value": "35a0669d410efbf9b50e05c014cf737abde3b042", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144907, "uuid": "f0652162-832c-4525-974f-6a1e9557d319", "comment": "Malware payload", "value": "ea46685922c7aeb934e45c4501b286652de2162b6a0a27211555f513238fbb4c5114b93823e1e7964cad66d5c260c0a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144907, "uuid": "b3bcc8e1-0194-464b-a692-03684284c583", "value": "T1BA646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144907, "uuid": "eb6a18f6-d8bd-4b8d-acf6-26c959c42c32", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144907, "uuid": "3d3d787b-6c4c-4d50-8065-069c603692b2", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144907, "uuid": "7978f8cd-c020-4b51-94d9-ec38468ca471", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144907, "uuid": "5d65a537-52bd-4958-a347-c72da846e3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144907, "uuid": "bed1439c-ae56-4d1d-9052-a836b7103c22", "value": "84loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5385ff-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108186, "uuid": "9bc66173-5313-4116-9deb-3b3c50765036", "comment": "Malware payload", "value": "c03ca8de1098f35d462a81354f63dd55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108186, "uuid": "88a0dee2-0ed3-40f0-af60-b2fbf7e14104", "comment": "Malware payload", "value": "d4b31afe232c2da323695cd1e0f5dd98b5bd3601bdc27ad7a14b260cb97237ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108186, "uuid": "67093db4-ca0a-4005-9cf1-ed3081e8dd04", "comment": "Malware payload", "value": "9acfdba8b6d02b6b99cc68854470aba6af6c123a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108186, "uuid": "425e41c4-5a08-4627-923c-87987ebf249b", "comment": "Malware payload", "value": "1afd7811025ace40b2c12848bc5493a0dfb77c597236d0c7f2538024a727d0ec46bb74dc45d4ded3bb86a46c3184e401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108186, "uuid": "ea756d55-064a-440a-a816-2f1e66794e56", "value": "T168A4AED1354CB6CFC89E26BCA62BCF4669AD0BB686244C4BFC8DA57A3D13C453649C34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108186, "uuid": "6e1fb646-b54c-4b67-ad9c-46143fe24743", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108186, "uuid": "4d2b84ef-2a30-49b2-9522-0d7391c5b44b", "value": "12288:7u3iO0HELjk3W3zWeiHjeTQGxNbB/+q0jxQVy:7u3iO0kLjks6ehpxB10jxQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108186, "uuid": "e5a6311f-65d9-4d35-8394-de1042c9e1ed", "value": 486903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108186, "uuid": "bb894c02-c6fc-42c0-9c64-5375a6a2785e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108186, "uuid": "36f49fcc-7115-42dc-b822-0a1d18a9c403", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3a67a1-1734-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688122439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122439, "uuid": "033b37c8-dfe8-4e65-8cf1-5d73696d6682", "comment": "Malware payload (RemcosRAT)", "value": "666baaf6c559fb345249ea301898e131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122439, "uuid": "3a47ae96-c909-45fb-94e6-27b1103f6acb", "comment": "Malware payload (RemcosRAT)", "value": "d5a1b80f534871efd0a4f5d8f2dd169e8e35751ef0416dcd4af929daa82e5687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122439, "uuid": "a4ad3cee-8f95-4ea6-a2ad-65a35d120896", "comment": "Malware payload (RemcosRAT)", "value": "97f771f0ac11ef69df047fc8bf26d273bbe3c7d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122439, "uuid": "3c405a43-6bd8-47dc-9319-41dde116f93d", "comment": "Malware payload (RemcosRAT)", "value": "6fd598afb8d466bdf23572669f68156d3f3edec57b2940c8e7ddc2b53fe03fc46d293df08fc52471592e89b31173ad6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122439, "uuid": "1f96cce1-e79e-4628-8894-dc3fa66cd8b6", "value": "T15D645A4DBB5DAA13C23F97B3A0730A944278851BA143ABCF98817AF11E753D7680D1F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122439, "uuid": "e58bb5d7-c72d-4c3f-ad2e-26888af32ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122439, "uuid": "567455e8-edfa-4481-9486-c1f8b37e3c2e", "value": "6144:JJ6ZN7VidGBxqEXQmtVOQMTTUywuxQO/1Mw0+fhG:JYZNokrtVOQMWO/b0oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688122439, "uuid": "bcfff314-527f-45b4-a11d-e170796d0f16", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688122439, "uuid": "94649edb-b119-418b-a3ef-a8dbccaf9f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122439, "uuid": "8915bb5f-4d53-4cb2-99d4-9949554f0724", "value": "Pagamento Banco BPM _Swift_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d029f14b-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144943, "uuid": "907a7677-f39a-488a-b4b3-f35566e4f8e6", "comment": "Malware payload", "value": "417c75be41cab5d1528c76b81f6ac595", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144943, "uuid": "7f547c63-5daf-491f-b78f-824137face9c", "comment": "Malware payload", "value": "d5fc39089815b32632b9b49f80ead6f220a32b574089ca9c45657963694724dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144943, "uuid": "2afdf46e-7750-4374-aeb9-f029abe80c94", "comment": "Malware payload", "value": "3f7cab0579c028233e7f509bcd8b466e7c6edf10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144943, "uuid": "555fde9c-ce5e-4936-afdf-56f2b35d8250", "comment": "Malware payload", "value": "fda880831793110325e1e7b05166f7667772999f6326500ef4f199306d430fa64af05bb0c27fa7239a19f1e7506cf2f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144943, "uuid": "8f09d8ec-d462-49df-bcfe-f2627a2eb737", "value": "T15A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144943, "uuid": "c20b99c5-d999-4219-bef4-35fd5e8a0090", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144943, "uuid": "be6c9249-a93d-4be3-948a-420d1d5e1a8a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144943, "uuid": "3024d57e-6b9c-4bee-a049-001a993ac324", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144943, "uuid": "9519b4a5-5395-4da9-a7c7-822be8d7b105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144943, "uuid": "750993fb-2628-4c95-b864-bd1640a11f67", "value": "90loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2738adf-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688154395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154395, "uuid": "4b1dbfa6-53a9-4bee-bead-cad4ef379482", "comment": "Malware payload (DarkTortilla)", "value": "bbcb57bd3692b78a45968a630356cd62", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154395, "uuid": "0a5af737-d325-49a2-b380-6884342e936a", "comment": "Malware payload (DarkTortilla)", "value": "d690897261d37632f7befda7f8be278533ccd4db9f965794cf9d4829b259f0bb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154395, "uuid": "1ca2b3f5-5bad-47ed-b8cf-1ed45c031327", "comment": "Malware payload (DarkTortilla)", "value": "cb4a7e5a0f4546a7c7d96b7d44fda0c9414cf17f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154395, "uuid": "7e0b2249-5424-4ef1-b703-0995f9dcb237", "comment": "Malware payload (DarkTortilla)", "value": "0b7a824ce6b8bc7a71255cad57999aacbbce2d674a3732d4c377bf2ddc027004218025784e9b6156533d4526e9ac08f0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154395, "uuid": "9b629863-edab-4402-9b9e-194f14dc4b1c", "value": "T1FC76332037C16E4EC8072470056A932161ABED935C77DF1F79CEB63C8C26589AF7B998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154395, "uuid": "9c10c040-fe86-4f16-812b-ebff5a935caf", "value": "98304:zWfog7FSpCzDCZwtgA2qnmeEcyltDhcV8d7Aa/2wKcfQNrPGPg6R7S6QL82j:zKl75UxqnmeFyTSV3wIlPIh71QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154395, "uuid": "6863ee9e-10e5-42a9-9335-3bed5e46b826", "value": 7757824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154395, "uuid": "87db9ffb-6168-4362-9e4a-85565af61a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154395, "uuid": "b3bdc7aa-a0cf-4729-8e05-27e2cd852a53", "value": "SecuriteInfo.com.Win64.CrypterX-gen.2270.14941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ba0244-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144793, "uuid": "ca15a81d-3b7b-451f-8593-5bd7b033a6a2", "comment": "Malware payload", "value": "a6062039f5140d7fca5d94c9763958ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144793, "uuid": "25d700c6-a89f-4e17-a179-ee0c30e60d5a", "comment": "Malware payload", "value": "d6e0c4384d0acd5bd6c3b5777c54ccb5b5d38fdc6a6218c434eb521654557952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144793, "uuid": "91d031e6-b616-473e-a791-43cec886baea", "comment": "Malware payload", "value": "50f43bfd985f499f91cda91459f5beb54a3ba2de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144793, "uuid": "dee0e173-b781-4595-854d-7b02641892b4", "comment": "Malware payload", "value": "1acbad7667c8eab9e22ae768a16856446895e871569c6b8d9bb15a83da5b8ddcaf8cd1d494e293f09ad3bb68922250b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144793, "uuid": "e6ed8049-06e1-4dbb-9fd5-a24df4daabff", "value": "T13F646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144793, "uuid": "e29f0659-d5b8-4176-b1f9-f6bed039fad4", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144793, "uuid": "f97717f4-2c2c-41b1-8f6d-c73ee17b344a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144793, "uuid": "cd6c2a07-8e5e-4894-985d-7dc974ab055b", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144793, "uuid": "402d7cda-8183-41df-8a54-b34b4647546e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144793, "uuid": "a9767bf5-cb51-472a-9bd7-e8c69f610c6f", "value": "69loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4964bcc2-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1688108209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108209, "uuid": "fdb63ba7-6c31-471a-a3f0-8c430da086d7", "comment": "Malware payload (CoinMiner)", "value": "19d2b0702da583c199f55ad88fe25efa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108209, "uuid": "5447b51a-e059-4cb1-b780-6e8812ec065e", "comment": "Malware payload (CoinMiner)", "value": "d742b1cf923ca6bc5126ca7b25ec921e7ff49430e19b0e558bcc51b673cb1817", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108209, "uuid": "a1cd3555-69a3-45de-bdad-cbe0dabd938b", "comment": "Malware payload (CoinMiner)", "value": "231f5e3e8db4b3f9b91d045b48ddf43ff0d36ef1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108209, "uuid": "92f4829b-08d8-488b-86c4-dcbe58698ba7", "comment": "Malware payload (CoinMiner)", "value": "963f49723a198dc435bf21e2df38546f9a917d77aa109e7d9a0dbe5581193dfaef2512425f81f217522e073277a90476", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108209, "uuid": "aa249278-e270-4ef1-b9d0-3e4d7ae8ff98", "value": "T1BDA6C08FD5F3931182FA97EC254390A0AC43CDE5EAC1A7A898E6435611CC6065FF79EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108209, "uuid": "52c358c4-7f7f-47f8-a362-9da33ae9a388", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108209, "uuid": "17a63993-7079-4921-b872-7b8d76181d39", "value": "196608:jBVFX3++2qYM4HXrvAKUMRym3uNptAdMPhibnFXi9e0bmORPH:j5n67Mk0KNRym3MAdqibnIVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108209, "uuid": "c8c20c27-5b5f-41f3-b3ff-3fa5244abc2c", "value": 10398720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108209, "uuid": "1b89ad73-5661-4119-ba8e-dbe8a72b6639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108209, "uuid": "f772468f-3a8a-4f63-a183-8896ac14bcb0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbb4ca2-1798-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688165286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165286, "uuid": "54186898-c85b-483e-bd4f-848f6268528a", "comment": "Malware payload (Amadey)", "value": "92b3e754c8fae381d0b97d5a5506eb2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165286, "uuid": "34dc2bbe-154a-45d0-9e90-225789515721", "comment": "Malware payload (Amadey)", "value": "d797bbfa8e1c38da06915ff6e717299c1d1c264574c522ac743212013db3090a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165286, "uuid": "4b15cdb4-a10d-4258-bf30-8ec491a9d40d", "comment": "Malware payload (Amadey)", "value": "eed6ebbf6c5a4c5899d86e620a82a0e508a1d22f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165286, "uuid": "2caa2f32-7abf-4a25-8bbf-a32da33571d1", "comment": "Malware payload (Amadey)", "value": "a4dc5e5544d8c4de2cbc449e80efc02234f03963308feec55234a2132ecde2a2d728f9efe7ab2dd57900f20fe7253a55", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165286, "uuid": "87493b4b-6d69-4beb-a937-1d8c443fab70", "value": "T1B3642A1392E13EF4E9368B72AF1FC6E8360DF5558F493B6522189E2F04B9272C663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165286, "uuid": "d537d5a1-9b0d-4003-b17b-bc6c9d457159", "value": "e01beb805c20903e324ef65e741d0209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165286, "uuid": "c2fa365e-bebd-414e-8ae1-7a33f4d9e170", "value": "3072:nbcNlIiOEDGRXyAoV/Zr9txNqFwm7j5TsI61dXyT:bk+il6RX27lNAwmpst1dXyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688165286, "uuid": "858f959c-7998-4878-bd41-c091fc43b132", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688165286, "uuid": "2d8f362e-76e2-4ff5-b46e-e7de513240e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165286, "uuid": "b8782b62-9f42-4d3a-902f-14485ac62e9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2a17be-179b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1688166545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166545, "uuid": "54899b9e-306a-4d76-a10e-405039f17666", "comment": "Malware payload (Tofsee)", "value": "d47d9b44ed788a66ccf1d5957182a0d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166545, "uuid": "1010b346-c62d-4adc-8971-24ca5dee61db", "comment": "Malware payload (Tofsee)", "value": "d7cb6af0bce02d2148720bb52acf1e6b678e621efd0f5dd5fc83cc3e78e0091a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166545, "uuid": "0b07c64f-87ae-4d93-af07-cee06ba0a260", "comment": "Malware payload (Tofsee)", "value": "d92faf25272698726006e01d5c2e3561f17c75e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166545, "uuid": "d17b0a55-a86c-4890-9049-ac521d6c9443", "comment": "Malware payload (Tofsee)", "value": "5f50f649e562f4ca5e74c3465a347e54cdddc5f03cfba1751d304a7ba62addb1b4e067bfbe630af56030187633dcaa8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166545, "uuid": "51574937-647f-44ab-9da0-fbfba7b7fe05", "value": "T171643A43D2A17EF4E53A8A32AF1FC6E8360DF5548F497B65221CBE2F00B91B2D563611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166545, "uuid": "6ad763e6-c5e1-410b-955f-5d29d45d563f", "value": "c1f59b5b7783d7b87e622c768d615c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166545, "uuid": "2000f9f8-a5dd-4129-9378-484f8278c42a", "value": "3072:7x6HniggNuWw5ZekZcdOe69NAunB+zb6e/z5T8T6M/3yT:F6C3Nr+F86/Aukzb/d8WMvyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688166545, "uuid": "ab6d8db5-5ef6-46f8-b281-14390371cb6b", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688166545, "uuid": "202d2895-16df-474a-9975-76e340a69bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166545, "uuid": "839778ad-03ce-49fe-9b2c-deebf45ff95d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcd76f7-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688142009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142009, "uuid": "e4a33eb6-189f-4806-9467-1f4d2a74fe66", "comment": "Malware payload (RedLineStealer)", "value": "e757dfcb3befa33dfac1c148d5c01f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142009, "uuid": "b3317441-49bf-477f-aa40-9feaa1148431", "comment": "Malware payload (RedLineStealer)", "value": "d8bf6fde0e280b57191b25cac3745e0e7f9c0f35dfe0b0a4afef8f5e2d7bab3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142009, "uuid": "580ffd9a-1625-4f8c-97d4-e4874772ce7e", "comment": "Malware payload (RedLineStealer)", "value": "987c0df35b4d5f6eab0ebd06aa643aad8e4bfaab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142009, "uuid": "f2264c97-fb88-46a4-9e21-e87a67bbaabf", "comment": "Malware payload (RedLineStealer)", "value": "f2dd15faa74e9cbbed3877c4a94f397fb765a77e2e013bf982bb395203398db96c3dd16415d37de1cf017e7fe8bd842f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142009, "uuid": "524f76e8-cd68-4e14-8e3e-d846f7db1a7a", "value": "T10F15028176D204E2D7222933A9D4C5A35E79ECF55FA044533F7863390FB12D0AAF4DAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142009, "uuid": "1b138728-cc36-4489-b7ef-2a0db6c3b15f", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142009, "uuid": "892fdb48-346d-45a3-b24e-8f7f51e9f3d1", "value": "24576:KazUdN5VGDLVUCN+0UHQxbklv+TSjmfVdAbkZ:KUUdvQ/uCpx0O593Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142009, "uuid": "a07c2137-a5e6-466a-85a9-8eefe505eba5", "value": 881984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142009, "uuid": "12d624f6-8864-4aac-bf8c-a927697013b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142009, "uuid": "3661ed41-eebd-4b62-8c3c-2fbbeb76e88f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e033883-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150710, "uuid": "6a0335d2-9335-4ed8-87fd-0a08f086f38e", "comment": "Malware payload", "value": "b976fc34dc06fd9d2434286fd323d778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150710, "uuid": "16117f01-59a7-44e7-9af9-d88c227d17d2", "comment": "Malware payload", "value": "d8f11b9c857787260ce3ec9537c7814f5c1b02a90fb41cfcb4c48edd64e549f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150710, "uuid": "9ce25a19-926f-4243-aae4-f587ce3a6182", "comment": "Malware payload", "value": "7901318ffa980dd72ce9eaebc544a1efbf61bd56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150710, "uuid": "b53dc391-8c03-47f2-9633-40d536e3b62c", "comment": "Malware payload", "value": "a40a2c1a8b172212d72cdcb4a1a16d2af2f8c320489cafa7dfbf08474d1c205e6dfb8e3155fa92e171f5a21475f7224d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150710, "uuid": "88e2da13-4558-4093-b083-b62a28ebe0b9", "value": "T1F4C6335B56E211C6D37007F48AB707A195B0F9023E3ACDE77A26B8BFA512754973230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150710, "uuid": "eecdfc7f-d4f7-4410-a39f-d66844acf850", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150710, "uuid": "08cd51c0-c032-48f6-8905-597dfb1ad3bf", "value": "196608:PWr4wuaebMAeNoEit4UYWKcrVMZ73AJQiHzovwTX/FjJl6Z3ks:PWoLMo+OrVSmovwz/F+ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150710, "uuid": "b31feade-fdc3-433d-907b-24a7bc5789fa", "value": 11812352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150710, "uuid": "668f3975-abb5-4a02-9a07-454b87d82c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150710, "uuid": "d70cebce-fc2a-483b-85e0-71a0546e8df1", "value": "SecuriteInfo.com.Trojan.Generic.33953450.13394.9915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a941ce-1755-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688136605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136605, "uuid": "e0698a39-4ef2-47e5-9f04-7278d6f67630", "comment": "Malware payload (Mirai)", "value": "f73abe8faa0c817507702cdd0f39ccb9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136605, "uuid": "24fcd42c-52b2-4114-a5d8-ff025be661c7", "comment": "Malware payload (Mirai)", "value": "dacc01807ddb5a94bfed1bd78bd65e6b7d57e151b73b5a334bc3175fed1e342d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136605, "uuid": "e752135a-9da8-42c8-93f4-ae0d7eecb4f9", "comment": "Malware payload (Mirai)", "value": "28579ae90c6d1d9304b58e0f7eb3dbd8ea68fb0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136605, "uuid": "229580ed-50ed-48e1-b38d-3f4e8f40f8a5", "comment": "Malware payload (Mirai)", "value": "bd5f15b302f8c561ff41c78345b67b307eb0be911115d25bf215ca3868045a3320b39f22b2d913f779515a21498c476a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136605, "uuid": "42e0cfb6-3aeb-4a39-bb59-d5471ae01307", "value": "T10FD35C46EA408E03C4C51775BAAF428A3322A755F3DB7306CE186FB43F86B5E4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136605, "uuid": "c8e21afa-ba32-47ba-a8d2-8fe2b2a2e86f", "value": "3072:c5fhTgG/C7kkFO+MJ4AF2rcJHI9FJaB3bM/9JGGC:ypgGNkFOP4AF2rcdIBaBrM/9JGGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688136605, "uuid": "36e4dea8-123a-4c5f-8eb3-4119b49a66cf", "value": 137680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688136605, "uuid": "291f1988-aa13-4e71-bd95-e47bccd3140f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136605, "uuid": "9aaa64bf-2fbd-48d6-945a-6f931c6eb2fa", "value": "0xh0roxxnavebusyoo.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5a734b-172a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688118068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118068, "uuid": "ddba8ef5-24d0-4144-bb79-96c2946b62ac", "comment": "Malware payload (Mirai)", "value": "5e9d40a75f0aee5a4f3ffa1d942913e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118068, "uuid": "6343fbdf-7370-4cf3-88f7-8e7db973c33e", "comment": "Malware payload (Mirai)", "value": "dad6f7abdeff4825803c43873403a4434ad3f7b5a7640dd84190a43e799fa216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118068, "uuid": "c8c8fa75-6713-40af-9791-41a5260d9076", "comment": "Malware payload (Mirai)", "value": "7a63ee8a9ff64ba392d2dd812ce0dbadeb7fffd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688118068, "uuid": "17479bbf-ada2-410e-9b31-b17a32dabe0b", "comment": "Malware payload (Mirai)", "value": "20762d1b50723eb4f9a27bf49849454159ccd2ae45725f053efa3c640d94723eb0bade4a939af5458a6636f98ff47400", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118068, "uuid": "564c9ac0-ca51-4100-8856-106c01dbe877", "value": "T1E333199AA801BD2CFD4AE6FA81160F1CF5303B6410634737A2A6FC975D723A85D1EF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118068, "uuid": "708032e0-92d9-4244-b6cf-5f4a4d1fa6ad", "value": "768:zreOjp9lwpL8a2QJOw4PRunp/u5WeMEvpaqMJTcNa4H86VK:nNjpspQ0p4PEnp25ptaqMJQNaG8oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688118068, "uuid": "b5d1634f-7109-4d0e-918b-924620f3a632", "value": 54632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688118068, "uuid": "1d96f2fa-c774-410c-a975-4fa604bd457a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688118068, "uuid": "6d19a3bc-635d-4d71-8cc1-84fc88535ed5", "value": "5e9d40a75f0aee5a4f3ffa1d942913e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb343da-179f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688168505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168505, "uuid": "10e9e58b-76ad-4fa3-9a5b-ecac15e54d09", "comment": "Malware payload (Amadey)", "value": "8e9058dbaa3b32f314bba89c00be534e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168505, "uuid": "463794ce-fa0c-4024-8728-00b7315b1299", "comment": "Malware payload (Amadey)", "value": "db1eb251388e4c9762470974e219c3e29a47c1811c819cc2efceb3306a7afb68", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168505, "uuid": "c399e911-6238-4f22-86eb-1c87397cf22e", "comment": "Malware payload (Amadey)", "value": "c9f506b7dd517e99100fd3833e4dc60ff50a7e02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688168505, "uuid": "e4477d5a-5797-42e5-b3e8-a9638f8faa00", "comment": "Malware payload (Amadey)", "value": "4dd6db0e267b0d7cfb8261385215521a66eb6406f367d7ea99af5f04d0b8594b16839523d4be2f549a68624b8f10b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168505, "uuid": "f05da6b7-e5b7-4af8-9b07-c6a230d19575", "value": "T1BA644B8392D03EF6E5368B72AF1FC6F8760DF1568F487B6622189E2F0078176D663611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168505, "uuid": "7614b430-b4c1-40d6-b654-a8cfb855d923", "value": "c1f59b5b7783d7b87e622c768d615c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168505, "uuid": "058fc0c1-1956-4d44-b65f-4a70fe18e3ef", "value": "3072:f/JvZCiky6G2WCPRP1fEn8jqWO+HQ5z5TMG6y/XyTs:HJRCik3G2HhjJOXMny/XyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688168505, "uuid": "e3b7b7e2-f314-4086-8a61-02427339eb6c", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688168505, "uuid": "a243fb61-13ef-4294-9d87-a0259bc6c432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688168505, "uuid": "548cc6b1-cf31-4f97-956a-d5eb9360d1b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05148abc-175b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688139018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139018, "uuid": "dad47fde-188f-4d6e-a659-520862bda750", "comment": "Malware payload (RedLineStealer)", "value": "fa37c0e7714dbfee64e5bbe289cb0b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139018, "uuid": "97d43b0e-a32d-40e5-9fde-c949584d69c7", "comment": "Malware payload (RedLineStealer)", "value": "dc7c3e74ee2bee96a497b83d6f417305bcdf8a5473b15ff5c348cbf18a2d6330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139018, "uuid": "9e0676b8-4483-457a-99e0-194dcacbd9f8", "comment": "Malware payload (RedLineStealer)", "value": "0e2044a2fa378a27ff594344c3147de92706b81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688139018, "uuid": "57b10c24-7ea5-4c28-9f38-cd70277e0aa6", "comment": "Malware payload (RedLineStealer)", "value": "3fddc38f6af17bb061b132cd4fcd8421123a92cc7d0bf3c6b8d1c6104a6a1a2dac572921d099fbb620b1675ae321304e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139018, "uuid": "370b9301-bbdc-41e6-ab62-a0aee43a218a", "value": "T1FC551242BAD18972C17328364B786B10597CBC202F75CFEF67D06A5EDA628D0D732762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139018, "uuid": "e0f7a826-a2b5-4d12-840b-5f732de9f245", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139018, "uuid": "49fb00dc-bc59-48c9-8f9d-d6e80ff38acc", "value": "24576:2TbBv5rUyXVjMDRvL2Uw+xzLedGz/KRdFGZpgIXc0NIdsx/B3ktB2t4RDw:IBJjMDRvedE/SdFAgz0NImxFktJNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688139018, "uuid": "90ae3f78-3cb2-45fb-9353-5f5668047e83", "value": 1358902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688139018, "uuid": "804985f9-3eb2-47a2-bd46-5f0bf2a6cdf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688139018, "uuid": "dd52debe-edfa-4227-b6e1-21fd42c1606c", "value": "fa37c0e7714dbfee64e5bbe289cb0b94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a44c8d4-1716-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1688109553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109553, "uuid": "b7dc01f7-9f65-4ef8-a10c-1fe3c6df4c75", "comment": "Malware payload (AsyncRAT)", "value": "00e00e2ee8fb97824142b7774ed50b7d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109553, "uuid": "0f027b7f-5828-457e-adbc-05f242ca0c88", "comment": "Malware payload (AsyncRAT)", "value": "dc813f0190bf6e0339c33fb5ef149bb7a7561f46bbad75c4a843c126d3be4b30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109553, "uuid": "6bed6cfa-c671-459f-9ad5-edef1069e7fc", "comment": "Malware payload (AsyncRAT)", "value": "0d5a469c2191b26c4c977af1d7b5c80aff7a142c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109553, "uuid": "1b9384de-1e4b-4a82-a9db-76edcc6b651a", "comment": "Malware payload (AsyncRAT)", "value": "3df7779c35132791cbccb42ce5509e0b92dafe716d0ca20314a850eaf7aa00758718364d321ef1573c1374b03d63ac01", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109553, "uuid": "bb35ae7b-9220-4cc9-80bb-0122d9cd8a59", "value": "T1AC348F1037DA666AE3FF9BB8F460011583B2E4137627C7AF1AC498F90C93715D990BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109553, "uuid": "8fbae540-81c2-4bc5-ac39-8693d395bc55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109553, "uuid": "9f6c318f-c510-4e81-9f72-cde8c3b81332", "value": "6144:P8XN6W8mm0TxQMbUbixoIuv2NeUAHGp9i1:kN6q5rbkvgL76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109553, "uuid": "8434e24b-f5ce-461e-921c-2e22ebe8403f", "value": 230912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109553, "uuid": "26e02d53-99c9-435d-8c29-d0223946733f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109553, "uuid": "5265cac1-8278-4929-a66f-f54f48f74fb2", "value": "00e00e2ee8fb97824142b7774ed50b7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5d0c89-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144565, "uuid": "957d37f0-b70e-4acd-9d53-61efd4b30e10", "comment": "Malware payload", "value": "8b979fa48e19b8c0314ae2993e59cca9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144565, "uuid": "da31e195-be90-47e3-82df-79ea3154d4de", "comment": "Malware payload", "value": "ddb5586cf5ae5b6739baeddd80252377895c7999f42caffc0c2a35e7c37cf564", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144565, "uuid": "b1ddacba-46c4-4a36-b154-5033173b47e6", "comment": "Malware payload", "value": "93620f214c5ec1b1cd19ec4a4d6827c2eda8f174", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144565, "uuid": "e479e65e-2a04-4c1d-a10e-d6d8b9ce89f5", "comment": "Malware payload", "value": "d44cc8eee70a5276de11eb11c4bf5befc685ee0267d6a528cce01765a08c96581da085a5a2b82e98f3b06160346761dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144565, "uuid": "e3aa9482-c6ac-4b3f-83cf-a2a6271ff036", "value": "T1FB646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144565, "uuid": "2d71e6ef-a75c-47d5-8496-ae87d04227a9", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144565, "uuid": "9982ec31-3dc2-4ee1-8ce7-2c79801553a1", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144565, "uuid": "db09d0ad-41b1-4fad-b465-1f0f17e7f9a2", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144565, "uuid": "d6d4f5e2-7cb6-4bbc-9a47-ad3f3723a1df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144565, "uuid": "2f7c5b78-525c-4591-aa83-7883473505d7", "value": "41loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c7db9d-1732-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688121402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121402, "uuid": "756ef7a3-9545-425e-930d-61e058261f05", "comment": "Malware payload (AgentTesla)", "value": "f926404447df738a286a5aa7f1be9e87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121402, "uuid": "7e5e5348-2c66-44bc-83f9-74492d99f789", "comment": "Malware payload (AgentTesla)", "value": "de955fab450ed36ebd64571db676d4f9330458fadb058f22f57c0a4683d4fc96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121402, "uuid": "d5b4ad9a-6335-452a-9399-1aaf8f2af335", "comment": "Malware payload (AgentTesla)", "value": "9f2ff3ed29b83014523e0afbd247cbe633eb7a56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688121402, "uuid": "e4acc8c8-eec9-4500-a6d5-78eb0cb02ea6", "comment": "Malware payload (AgentTesla)", "value": "1b2004544222f0a45f01053b9c7d0b1732c86cdebf51737d578e99c182072c36f453ff6a2f4658206ef77ea3d6428967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121402, "uuid": "68d6bb0b-af11-40b0-835d-a56e183a8722", "value": "T1D5357F24D57E0B12C0748778D5C2A26FBA9C4C9F2C608F3638C17E8E5F7B906159BD2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121402, "uuid": "eda6e5c5-2a0e-4ae6-a2b6-8f9a2641e188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121402, "uuid": "f43dd28a-9593-4503-8b2e-531e845b701c", "value": "12288:QKBk76D7MBZDc4WjTjT5KBupqpkIIpvAp+TSx/W4OcgcYEL:QKuyIc4Wjw4pqTsopQONDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688121402, "uuid": "5323c0fa-d83f-470b-8935-bbc84c7aad8d", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688121402, "uuid": "98a979ee-8f66-49fc-83bc-018088683dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688121402, "uuid": "067599d8-711a-4d10-9cc3-d1155608300f", "value": "INVOICE PAYMENT COPY pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06469d9a-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688108956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108956, "uuid": "afb5eaca-5281-4a4a-a41c-4b9f76fbff84", "comment": "Malware payload (RemcosRAT)", "value": "f9694d61cf5ce2d929f53c5c19c4d1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108956, "uuid": "02c5045e-fe55-4670-a1e0-d3f84501983e", "comment": "Malware payload (RemcosRAT)", "value": "df906c77d802e4e977ff24b11e1840d6948338250023a27b2b30ad9ac6e3f4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108956, "uuid": "ca6f09f3-54c0-47fc-be7b-7e7c3f1f5205", "comment": "Malware payload (RemcosRAT)", "value": "d7f2f87632df0bc80e369aba62c9690affee38a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108956, "uuid": "e7bcc5bd-9057-4e9e-83e3-3545f88a64e4", "comment": "Malware payload (RemcosRAT)", "value": "feb82e67e4adadfb2f4c32b37b6fd36da458105af54673c2b7a386583ea3b110855f3cd64bd90da43b367d3aa8ac7fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108956, "uuid": "6e1f41dd-f5b7-4e4b-a7e6-074bc5ecdb7a", "value": "T12F159C3C18BD6337C174D6B6CFD1C723B264946B75229A766DC39BA54782E0229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108956, "uuid": "cb327085-6b05-4a5d-9292-4b2da85d7096", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108956, "uuid": "191f3c4d-2ae0-48bd-bab1-7a52214917b4", "value": "12288:KYzGvU9wMHv6TBeU+lmS4VOFo9y1ZtZm0BkuStVXZWzzcI:jzGv83Hv6FeU+oS4A4yDtZMZWzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108956, "uuid": "e8a239f1-bde4-456a-bd54-a42427e42af6", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108956, "uuid": "ecd76f9b-cde1-47f5-a6e4-abb9ded2b931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108956, "uuid": "2560ea31-0bbe-4ae7-8ed2-9a7c9d8b8b49", "value": "f9694d61cf5ce2d929f53c5c19c4d1ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5182d35d-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144730, "uuid": "46025e3f-e2e8-4407-b30b-be442a505b91", "comment": "Malware payload", "value": "ecd2a85c3fae781c34d3b9bb3ed931c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144730, "uuid": "b38d2b72-db41-4844-ba5f-bac64055f883", "comment": "Malware payload", "value": "e0705bf2a1e159191750110abeff8ee628aac9106bb17c6cb94fa9095213263c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144730, "uuid": "6de5250a-39df-46f3-ad11-ec743db2de2f", "comment": "Malware payload", "value": "0d8b16222aa3edeb2348ddc45a26269c62a5398f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144730, "uuid": "cb45a50d-9839-4ce3-8234-704cecc14b4b", "comment": "Malware payload", "value": "9b833fc98dad3350f060e4fa8b8d5594e0377345756e6dd52dbc8845fcabdffd9a54d63ccea777368996c15d75d52fee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144730, "uuid": "1ec60d78-79de-46aa-af69-aac94ae315ef", "value": "T136646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144730, "uuid": "cb593d2b-0d35-40f9-ae74-5a8da3dd4935", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144730, "uuid": "19d1476b-930b-4647-9f56-16b1d8c891f6", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144730, "uuid": "ca0ba002-8933-41cd-aedd-930b75c16882", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144730, "uuid": "b7f5b2c3-8ae3-41b7-ad1c-03f4b4bc0fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144730, "uuid": "0ca037ce-8fd8-48be-91ff-077b39a21273", "value": "60loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c394b11-1723-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688115005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115005, "uuid": "1d77718c-b1d6-438a-bf21-5d58eb4e8a23", "comment": "Malware payload (Mirai)", "value": "443321c2384224021c4625c40d21e26e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115005, "uuid": "4516d754-e08e-4f8a-9fa4-bfd527d1f0f0", "comment": "Malware payload (Mirai)", "value": "e0cdb47b419597457649aef9ba0adab95e1c75a40a2c24c9d680ac9eddcc8950", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115005, "uuid": "6fae564e-cca3-4416-b065-8e2a82632d8d", "comment": "Malware payload (Mirai)", "value": "0b8b22917dd94ac69a0aac5097879bb2d8a7f109", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688115005, "uuid": "b47221c2-db4c-4b51-b8d6-8618054e34e1", "comment": "Malware payload (Mirai)", "value": "6dd4031534bf54c1ffc15cbd01c5eaa72bb28046a36c2d033d0126d334b14e8cdf0556e751f226466b1d4c9968dbdee2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115005, "uuid": "fd2316e4-ac5d-45e3-a3b1-0458ed2ddca3", "value": "T199C33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115005, "uuid": "1cc41e60-6576-42aa-9ad8-7ba6f527aea0", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7c1+b2L8M/91ce/:skHK8uz4hlVPqRJd2Nvb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688115005, "uuid": "11f7ad37-5e85-41ee-b53d-8a9f3c1feded", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688115005, "uuid": "0e044d0e-b747-4c07-9fd6-757638ce0609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688115005, "uuid": "d689bbb0-922e-4785-9f0c-3aaab3987d22", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec2a396-1733-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688122204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122204, "uuid": "0d1545d0-1874-4fd6-88c8-bec2868f1920", "comment": "Malware payload (Mirai)", "value": "2278e807b1f89e10d5962e02f459b383", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122204, "uuid": "62c7721a-26e3-4930-ae4c-52bf13db6bed", "comment": "Malware payload (Mirai)", "value": "e105958e10ed3967ee55b7b024914e0cb6bf6cc2af5cd05ef26b203d043a96d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122204, "uuid": "773e9ffb-fe2a-4828-8284-1c26d183f195", "comment": "Malware payload (Mirai)", "value": "a13550a25ecd411ca147d1f3bfae39817bb9c8b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688122204, "uuid": "174fa727-da41-4fb0-91f0-26a98eccd722", "comment": "Malware payload (Mirai)", "value": "5511678611cd651a0948abbd76478730d71aee57d33dec9517ccfa0e24c48348116647d3ebfe21b31f20bfc3d3c26fd8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122204, "uuid": "3910b851-8604-4304-9b2d-4ceedd316d32", "value": "T113F2E176D7A3405BC8EB4C3858AFB448891CB718924DFF30F3857C276CA1B25A1A4366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122204, "uuid": "8cf4cd7a-867f-4593-b8fd-d21c275e940f", "value": "768:giN3wI+y7N8Y4LfsNPw6ALd2FKqQVp7U3w43al64yvYsEMnbcuyD7UWyq58:giN3Z+yuLfOw6ALd0K1p/mYJMnouy8N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688122204, "uuid": "7100df0c-6f31-43f4-b5b4-1419b74a9e7a", "value": 37616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688122204, "uuid": "c741d774-396d-4247-addb-d3dcd962790e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688122204, "uuid": "2beaa8ae-e75e-41d4-ad49-5e26101b7ac2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e570046a-1798-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688165594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165594, "uuid": "8e2ef73d-1d7c-4375-b4ba-b762472eae29", "comment": "Malware payload (RedLineStealer)", "value": "67b0553296ddb3b4f29137ab4ef7984e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165594, "uuid": "c4c88d01-e779-45f7-a228-24b9abe5ad4b", "comment": "Malware payload (RedLineStealer)", "value": "e166bdcfe26090d11b0481f8712af12f17d6ee6c8320464d672e44178a78585c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165594, "uuid": "b94c320e-0a8b-44ec-a3f1-35fbfd85f562", "comment": "Malware payload (RedLineStealer)", "value": "2c87615e46a60e0e29cc5f1004971acc15d3b0f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688165594, "uuid": "359583b7-63cc-4c8b-8111-5917b4824017", "comment": "Malware payload (RedLineStealer)", "value": "a416f23968ff78b4fccc268e2e2916071357c94fbb46ccc38ce100844c5efdbb55bc4994d00489a8c9e0f4c3bcbad88d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165594, "uuid": "c454adbd-83f5-4260-8a8d-ea46e28142e8", "value": "T10F15014175D244A2D7621E32AAD484639DBDECE05FA046633F38532A4FB13D0AEF4DDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165594, "uuid": "46299f9c-9f32-4f24-8216-423cef637e13", "value": "54223957b934118afc498e8a06f5b541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165594, "uuid": "a54e866a-dbd9-4043-b638-199042f66ac3", "value": "24576:O3jAdN5VGBdaV1ZRLgPC4Yv+AEhs607MX65a6K:OTAdvQB2eC4Y1as/DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688165594, "uuid": "747a7283-6ff1-45a3-ad5d-06698935e0ed", "value": 881984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688165594, "uuid": "e6282739-8241-4b38-9aa7-0f2d98d3e581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688165594, "uuid": "35975e1a-1603-4ee2-9383-43ca156b85b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61774ae3-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144327, "uuid": "c41f655a-084c-4b66-86bc-9a0b6d581fd9", "comment": "Malware payload", "value": "dbf161014034d9a8154eb91e81c6c88d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144327, "uuid": "9f5fb8fd-7d99-4d53-bba1-d7193bbceed7", "comment": "Malware payload", "value": "e2480e9cdd3b475bf276573c6e9b2e04491911bb21d761d159546446d6fd9fb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144327, "uuid": "8e9e5b00-4a2d-425b-a670-1a596ad086ae", "comment": "Malware payload", "value": "a15c427c5084b22edc90ed43317f22db1d3387b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144327, "uuid": "fa5762e8-a10c-496b-9e67-49759f7e5aff", "comment": "Malware payload", "value": "34ecdc050fcf6671c1fb055dfd52cc6d6d24e3deffd21b9611332b8040433df3e96d69cc8ea5fe287efe79eb3454bd32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144327, "uuid": "b83ac9b2-c02c-4a73-b237-0c517edfbbbc", "value": "T19C646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144327, "uuid": "28ba0cc3-b4b1-4267-8228-32d3a121096b", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144327, "uuid": "3eba5fa7-5607-4e94-be50-e4a6e0547c9f", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144327, "uuid": "ebd07850-a8e4-4c03-88fc-8ce49b85584a", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144327, "uuid": "8702379f-0b7a-4811-8a56-0917c96058cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144327, "uuid": "bcd93445-97df-463d-8ae1-041e10823c86", "value": "0loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fa2516-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1688108313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108313, "uuid": "ba5b8940-717b-4455-91eb-855f7af472fa", "comment": "Malware payload (Lu0Bot)", "value": "b6d1287e22acc498f371ba1a94cb481b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108313, "uuid": "da7321d3-a97f-4570-b443-a62081f0663d", "comment": "Malware payload (Lu0Bot)", "value": "e2c630adb97cc041c5ce1835add03841493ae95223d43c9e415e26e6c4c418e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108313, "uuid": "316f59b6-bae4-4ba8-8a54-90d479ca1c97", "comment": "Malware payload (Lu0Bot)", "value": "5de65c073c359239a8d401c7c241cae5de98b0c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108313, "uuid": "04e5351e-2ad4-47a6-bec8-e107f734af72", "comment": "Malware payload (Lu0Bot)", "value": "36a7c19ca4ec437d38d1c00c75fa7ee2fbe3a6f07be3108073499099ead0aff86050d31c78bbdcbaee720bfe14b0202a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108313, "uuid": "9ea2e349-da62-4056-9efa-290ea153737c", "value": "T127C53325CDDD5E73C9B127392DE442A716367EB1CF84039B2302548FADA2AD0A5337B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108313, "uuid": "b30e1942-b550-407b-93ff-f71699ffc283", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108313, "uuid": "70ef4ec4-e726-461f-a6cb-92975c85742a", "value": "49152:5qVMAWRywiN7AqzGKWPy3tsdWT69leSkFAaGjv616zzU45tZevvDnZjlE/X4HOox:QKo5czXmidWn1FOz6cgsSvvljEouH9HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108313, "uuid": "3392e6c0-db39-4f09-abe8-679cb74b0aac", "value": 2655183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108313, "uuid": "f69e9924-552c-4c24-9d47-3e5ae223312c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108313, "uuid": "3250ef14-6797-49a1-bb9b-082005eebb7c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd44719-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108161, "uuid": "f662f9fd-dc50-4867-8be6-02a819e76731", "comment": "Malware payload", "value": "4483d488a5c353cb248ec5d773b4e6d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108161, "uuid": "26aac01b-cc91-47fb-acf7-e4b2017d8de3", "comment": "Malware payload", "value": "e3accf11e158588fb3490e0dd3b77f88bfe72b4ff53c2ea85fc6c849a18916c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108161, "uuid": "7e7459e9-4d7e-4ebb-b836-095afac544df", "comment": "Malware payload", "value": "e277ef3d993f06164cfcf76da05c2452c407f39c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108161, "uuid": "bc5ab11b-a1e3-4297-86e1-f00f0f5b9895", "comment": "Malware payload", "value": "a1cfbd19fd31d2dd01183d8c5af1a3b82bad740bb4b82f67c64de1715a6f90cfff54abaa34e87514bf03e920c15d9920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108161, "uuid": "840c6edc-b86c-4bb8-9b01-800083e97665", "value": "T13B752BE1750876CFD89F277C9B57CE42699D4BF846240817ECADB4BE3E63C812686C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108161, "uuid": "a2e72178-4b20-4769-b510-386aa643056a", "value": "d530486f0bc66a888117b2cadd793b9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108161, "uuid": "edfdfc81-8978-4336-8735-9b2c6234b713", "value": "24576:7u3iO0kLjks6ehpxB10jxQHUrfifbD4SuMyludq9NTm5B6RyK/0E/md:HO5F6O0xLudZB+xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108161, "uuid": "551d9182-286c-4442-98f6-0ba25df7a69a", "value": 1614309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108161, "uuid": "f484322e-0a09-4e05-8e31-5f4fe4647d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108161, "uuid": "f35f8aa5-f688-4fbe-9382-dfdebe1927dc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fda4937-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163115, "uuid": "28460cab-399a-400a-8099-d0d57fa7c41a", "comment": "Malware payload (Mirai)", "value": "7bba683ebf12c1ac875a1a08d7c24c15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163115, "uuid": "32314588-e3ff-4a8f-a5b7-a7b032ac20b4", "comment": "Malware payload (Mirai)", "value": "e60691f9582bd71280ce63cc5ae7f09f4830d05775475aea26f3160a9fba1a2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163115, "uuid": "de8015d7-a3fe-41d8-8e93-ff8e688b83de", "comment": "Malware payload (Mirai)", "value": "a88d30eed43b19fa441bfd79e65b000bc51e58d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163115, "uuid": "28c74b31-465b-4487-8dcf-45a0f711f1ef", "comment": "Malware payload (Mirai)", "value": "bfd2954ac6599723628dd1d936b128c54521f470eea6867f73c6d80effc902caff94d3588f8073fbb1826cdd98cbff68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163115, "uuid": "25c560e8-b451-4e1a-bd8f-1228fdc6da52", "value": "T1B8B2E1705484863BD519E73E3EAE84DC90B1CC811B0FDB0AA21FC595F6CBC2A6682D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163115, "uuid": "1907a868-2086-40ec-a826-046d7f828bbb", "value": "384:MlTHiCXMIiSOFwoW6lJU9LQYjgDaouZ3Zf8PhJxUyGO4kny2fB9v1RXV:mtZVZcJnYUDafZJEPhIyCky2f7XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163115, "uuid": "d74fc1e0-ff21-404a-aa19-37baebc5aba7", "value": 24788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163115, "uuid": "5f38fd04-e460-48eb-b6e4-04c0dda0a894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163115, "uuid": "ebd30aa1-170c-4d50-a998-807ad6daaab5", "value": "7bba683ebf12c1ac875a1a08d7c24c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6638b39b-179a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1688166240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166240, "uuid": "9ab1d434-923e-42d4-b80d-b58ae4a98165", "comment": "Malware payload (PrivateLoader)", "value": "e96d05f3379cca7a6877bd9e56efdf5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166240, "uuid": "75c762a9-7903-4297-8f83-3686fa424115", "comment": "Malware payload (PrivateLoader)", "value": "e614bd80dce4697792d9c6eef6c07a2d3f5cd912b48cca27869e809305845714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166240, "uuid": "774ff499-65a3-44e4-8594-471c171c0a5b", "comment": "Malware payload (PrivateLoader)", "value": "af3218c73dac3eb2127f06839bb0a4eb77e5f049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688166240, "uuid": "c992901f-202c-48be-979f-b3af1aafb0e1", "comment": "Malware payload (PrivateLoader)", "value": "aa22f1473f576edbaaae532c6bcfdb6f644df375ee7876d80d5a09e151a46527beb43ba05db0a31a96eaba75ec0a1da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166240, "uuid": "c829c38b-0598-4991-855d-7986a1b7ba83", "value": "T100D533BA37805B45D2B511394A61C63406086DC42AE487E773B35FAE6833BAEFB0D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166240, "uuid": "9f9d1813-05d0-4b8a-a697-92971704bb6b", "value": "a2d46086c374c42d1560f4bbef810708", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166240, "uuid": "0ad8f287-e556-4c3b-82b9-bffeb464522e", "value": "49152:bZaX1sSgBVsFGeL6felXWxduJYnRnA1FDc0oJ/y3hjfgMPVYR+4OhCa/64wtfb:9G1QVAL6zxduJY6Xo0oJepfzNYQzoV4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688166240, "uuid": "d2f0f871-57d3-437c-8045-c8be675c7adf", "value": 2994704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688166240, "uuid": "81a5637d-d0ec-43c4-bca6-301152a28a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688166240, "uuid": "b3cc08db-2395-4b9a-9673-ceda88d7f0fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973e19aa-1719-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688110917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110917, "uuid": "8b2034e3-2c50-4ffc-8fb8-618992177fee", "comment": "Malware payload", "value": "47eeb5868c2d03c0954749edd148f676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110917, "uuid": "3c8289da-316d-4468-889d-1d14358d0586", "comment": "Malware payload", "value": "e69ca3074fa888461bd7104a805dc8b4bf513a084d71b038ba8fde62deccb960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110917, "uuid": "bd422960-9881-42eb-b15b-c0c236f6ea35", "comment": "Malware payload", "value": "725daf52e958c729522869c54ad3dc6d95830447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688110917, "uuid": "59df6cef-f114-495a-867e-538e32b7a744", "comment": "Malware payload", "value": "573ad37ec72056f4c84b0931ebe0719715a5c02d0b52c6b41d614d1ce74f22e6a293812c31234ce506821e346b9e822a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110917, "uuid": "c3d096b9-f60e-4663-adcf-c0033ba49fb2", "value": "T1F994E01273808079CDB3DAF27C585BE8971CB6E1D7DEE1C333C4417E4AEA69220AD566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110917, "uuid": "071db1c7-627f-4542-9bdc-0dfd518c54c1", "value": "9ef61842dd257cd165ffcf2d74517de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110917, "uuid": "b7f5f5df-abcd-4592-8788-3a158db7047e", "value": "6144:o03Yms6B7U1Q+Lb4ZEHg6VS/udVDqdZ/LIlCOuJOdW9KeHHXu9qP:o03YX6B4rUZEH1awVeuCFJiWM6XeqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688110917, "uuid": "80a41b7e-a6fe-41be-a2c3-0221ef904074", "value": 417932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688110917, "uuid": "50b5d226-4d37-4491-a7a0-9882ed216784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688110917, "uuid": "84ec3bb1-28d9-4a19-a82b-9a742ac7348b", "value": "47eeb5868c2d03c0954749edd148f676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2fc2da-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688141985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "30b5f366-ecfa-40e1-826d-81b36fbda517", "comment": "Malware payload (Smoke Loader)", "value": "50c14bb5c17c714f76bbc7aa030e4ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "78e44927-1f3b-4b56-9d30-500ada3ef3b1", "comment": "Malware payload (Smoke Loader)", "value": "e70c809bc313ac4703985d9cf00621fd8d4c761ab0a8346d991c3015d6782e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "620ffd92-f717-4b5d-bdd2-e86c0f174f05", "comment": "Malware payload (Smoke Loader)", "value": "24f17427a3e01637e92e8d47cf31dc4f51afd2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141985, "uuid": "f05b0f29-dc3a-4829-8c4c-88770ebcd7e6", "comment": "Malware payload (Smoke Loader)", "value": "3531fa6fcb28b75776e17906c750a4d1086db67771198f0b5b106f8e63c45a15e3f10c92cdfb857223ce5dec40885436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "483e912f-2636-4530-aec2-3c74ba52742e", "value": "T1C454394392E13EF0E9364B72AF1FCAE8770DF5548F49376A12189E2F04B90B2D563616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "b87d75ba-6800-4075-80a4-766846ebcd9a", "value": "1ff66a1ed7eed59bc0ffd84293a8bb71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "39ac9fac-07e1-4e87-98c0-222df38b76e6", "value": "3072:5keRBDPgkWw+EUWbdgAt8c6UC2gl6MVaDPcg5zCJyzs7w:OKD9beA2YVMVU5CJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688141985, "uuid": "6598c8cd-5325-4edf-bfe9-40c2b9aa4609", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688141985, "uuid": "714787dd-fb7e-4e03-84e3-a44e0aa693ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141985, "uuid": "250003ad-eecc-4b4e-8c2f-47ba51b9a07a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba458c8-178a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688159484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159484, "uuid": "291983cc-8043-4917-af61-b56cba2a500d", "comment": "Malware payload (Mirai)", "value": "45045fc28c41a9cf45c93e0414b9bc51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159484, "uuid": "85c47ba2-4448-459e-a3f2-b31260a8e487", "comment": "Malware payload (Mirai)", "value": "e8c7a29c66d610f9d49d28fc5756f03528af69366cdfb5f6b16082d8ec8068d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159484, "uuid": "3264626d-d64d-4308-8c10-8a6e0a5fcf05", "comment": "Malware payload (Mirai)", "value": "8a7183e202e98e63760cdb82d71c664282ec7756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688159484, "uuid": "b04997fe-f83e-4802-ad87-c3f7e353d9b6", "comment": "Malware payload (Mirai)", "value": "61b7ceb16e925f03d3d94933cfbb8f151e41b69ef99049e9a4304403f3f045b31e10863f63f967f6575108d894ae00bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159484, "uuid": "b15230c8-5469-4af0-8c80-7f4c6365a269", "value": "T1E8536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159484, "uuid": "5111af85-7ecb-4360-9a26-7fb8b57e12e9", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8E:p5ofF8I9cKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688159484, "uuid": "c0ed0736-d1d7-4734-9d81-9422aee323ef", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688159484, "uuid": "94f8c34c-8e8d-4125-93be-8c0b198a6d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688159484, "uuid": "5cb3a75e-4263-4dfa-94b0-b5dc7b44d502", "value": "45045fc28c41a9cf45c93e0414b9bc51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f86598-1769-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688145320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145320, "uuid": "4a51a50c-2fca-4d0f-82e0-f96433849d20", "comment": "Malware payload (RedLineStealer)", "value": "11e5b0c75694353917122cf1b8775716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145320, "uuid": "cd475551-e3e7-465e-aecf-2d873add4091", "comment": "Malware payload (RedLineStealer)", "value": "e8d7197a7c6ba760b398ebe50fb5ca8770e454fca9da731438eb329b8db56c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145320, "uuid": "c1628ec4-01fd-4de2-a88e-4e39a7b25b8f", "comment": "Malware payload (RedLineStealer)", "value": "61807331973bdcad63b61f5e9b99454be32bb766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688145320, "uuid": "8ea679bc-9eb5-4d14-b0ab-2dd1e9e1cfa5", "comment": "Malware payload (RedLineStealer)", "value": "851eb0a7a442d008dd707800a0304fce7ff6f3bade5ee6ba7bca747df9f8eb1c3f227e0b5472040f680abb182e204de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145320, "uuid": "d772ba0f-2945-44ea-8626-e1d13f891492", "value": "T126847B4386E03EF4F525CB72AF3FC6E9762DF1548E497B6922189A1F00B90B2D563712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145320, "uuid": "ce6f95c0-6049-45d6-aac7-93f9811b259e", "value": "1ff66a1ed7eed59bc0ffd84293a8bb71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145320, "uuid": "f41966f1-44cb-462b-8ee6-55e31df9ff7d", "value": "6144:4yfGOme1nvYBRei1hC1kEMny5qxUFGb1TAYrzzhi2HfY0:4OGFW/iqM1U2AYrP4qfY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688145320, "uuid": "9876e797-058f-41ac-90ab-a56e3bd3f2b5", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688145320, "uuid": "2e5dadcb-c874-489e-b363-cf1b0e1c0948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688145320, "uuid": "b47dfd5c-3fc8-4f3a-befd-5726e3781c4c", "value": "11e5b0c75694353917122cf1b8775716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb32218-1760-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688141452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141452, "uuid": "2e3c8fdf-32e5-45b7-8922-a52351be855c", "comment": "Malware payload (AgentTesla)", "value": "680d39757b5aa2370fea7067ce69c526", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141452, "uuid": "4cf767a6-3951-4070-8227-7c2d76925ada", "comment": "Malware payload (AgentTesla)", "value": "e9d52b013b45c0dfeb0f8d129fef28086c9605318e4a307f6af43b8a81156d6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141452, "uuid": "b11e6b27-fd23-441b-87b6-9ac95cdbe995", "comment": "Malware payload (AgentTesla)", "value": "11605c884e28f9d2015d2f5e1134e355c3a06627", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688141452, "uuid": "901cacb0-2c67-44eb-9f75-507b43a70d32", "comment": "Malware payload (AgentTesla)", "value": "643717319b3a23fc38e22a4c53f4c580221da56cdf8ce4f08a88dc062f7a02eca8312d8bf6acbc50eb75c2656a0c457b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141452, "uuid": "908d5999-abd3-47f5-85c0-2888ab9c7387", "value": "T12A845A487B89BA13D67F6773A0728B4446B9CC1FA163A7DF14C239F01EB23D1598A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141452, "uuid": "f4ca5c85-784a-4218-aa89-a2e381db9867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141452, "uuid": "250bf240-b706-41aa-b78f-01a606893262", "value": "6144:JrDZeSwxQrq/4zNLNoNOQ5sDguEdQpNuUmi0QKeDMwWgHl9pZ5Hg3:1DZVzNLNkOQ5NQpbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688141452, "uuid": "64add707-fbf4-4973-ab68-0b6c9ae08f7f", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688141452, "uuid": "adffbb13-35c2-43e9-8d45-bdfc23761023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688141452, "uuid": "817cb8b3-7b5d-4bc8-b593-911ef1f2c795", "value": "SecuriteInfo.com.Win32.DropperX-gen.6282.15247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6e611d-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154390, "uuid": "9b7a5c3e-3021-47c0-b938-79d634e6df50", "comment": "Malware payload", "value": "8843d668992e1d6301341e90cb18a744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154390, "uuid": "50ce6ba5-2773-46ec-a8f2-857a90bd75aa", "comment": "Malware payload", "value": "e9dd56b0676872ac18c5c07d7f07d2863602dd9e67647b86f2e8fa8002908b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154390, "uuid": "2980a9b0-57d6-4143-b29e-9bdc5266b894", "comment": "Malware payload", "value": "7741b7aca648fdcdddc0e81f393fdc83067b0700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154390, "uuid": "b45a250f-e56c-4f07-97d8-38316a5ed424", "comment": "Malware payload", "value": "3a343c8d5768b9647641a75d1b3407b316c6f8b46afea89caff1ed3697b1e1ed04ad19c97e4ff88ee973d71b38011ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154390, "uuid": "236e6d5a-aa19-4fb0-bbd4-4bfaa3d921aa", "value": "T1CEE6331972E2500FF4B8BBF9D19E449A8C34B0B14B25B7FB26D9D46BDE435E03932690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154390, "uuid": "60715a3f-65a9-4b0a-a36f-f7b2ad0e5af0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154390, "uuid": "ba529633-8cd5-4954-ac25-34ad146c7750", "value": "196608:QBNTnJL5n5toG6vqHvKNGGaNTMZSp2GWP2gHJJrnL8dZLnPtT5A7/I0BpTA:QBVJ95t1KNGcScF1JrL8ZztT5mRpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154390, "uuid": "1fdf1644-be5b-4e3f-abc4-ec2ade111f1c", "value": 14860288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154390, "uuid": "b3940063-0b31-47fb-862e-872e2972055b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154390, "uuid": "be2e9eab-5f6e-4eb7-8d7b-09e2084c8351", "value": "SecuriteInfo.com.FileRepMalware.26013.28578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8802bd90-177f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154700, "uuid": "962e42d7-d20d-401e-bdf2-83f7a09d774d", "comment": "Malware payload", "value": "7bddbffea35cc0455c19f12e50e57684", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154700, "uuid": "2dace90b-7d93-4e4f-91f8-76150cf794d7", "comment": "Malware payload", "value": "e9fc2ab5ebf544d59bdb069c26523ee2fc09fa89854d5bded788d95811330983", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154700, "uuid": "ffa2a099-5fc9-487a-a147-294765f96a15", "comment": "Malware payload", "value": "da6f7e7fa71a595791fc5f704db7d2a7b30e20c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154700, "uuid": "ee637005-7321-40d3-bbad-40084a74dd72", "comment": "Malware payload", "value": "a142e8fc7bc30a289e918f4ca34a66d31f77c85820eddc60af402a88671b4f06fc58ec1cf677cab03fa54795761cf9bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154700, "uuid": "017c42c8-71fe-4872-bc0b-e787bf304450", "value": "T1E2870212B286A23AD48FCE36AA3AF545793A7B714610CD477BF00ECC4F36A81763D546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154700, "uuid": "a75e34a6-1c94-4cfa-b916-c03adc17980e", "value": "ee125513a96bf1eeef0db8663138578d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154700, "uuid": "cb29ff35-5677-4f0b-b83f-b5f84d7d0488", "value": "786432:89OX7x+Hzdm8FVLKYjBmqFesFObcwQ9UZUpDNEX+aWtV:89msH1t5j8JsFOwDYUpDaWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154700, "uuid": "01aa9e68-69a3-4287-8327-780cf9831257", "value": 39047168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154700, "uuid": "9dc24b7a-8547-4c98-8fc1-401e20b31c63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154700, "uuid": "adb8ee9a-f3fa-41e6-ae40-68635cb56c2c", "value": "e9fc2ab5ebf544d59bdb069c26523ee2fc09fa89854d5bded788d95811330983.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7651c808-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169273, "uuid": "6e1e3d2f-ae79-4211-bddb-6c7377363cff", "comment": "Malware payload", "value": "57ab72d0d5ab4612a0c190699776bb1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169273, "uuid": "e93897ef-76ee-4874-abca-c144a3f02b01", "comment": "Malware payload", "value": "ea417845a5fa33d81ce343a2b7a103e321c7a1ed2ab44541610d2c3321cf7325", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169273, "uuid": "f2a0077f-abc5-4f8e-9be1-0422458f901e", "comment": "Malware payload", "value": "a218d1659feabcb3ef13dbf986a9f00c7d39c5f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169273, "uuid": "d02726d3-c55f-4609-ada8-c8181dbfd012", "comment": "Malware payload", "value": "db0d3ef9c76164fad5df5623602225c60ca20738c6bddb7aaab211239619fe48ed6c04588c379e6eafb016196f7e0666", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169273, "uuid": "3f5a4d32-1988-4e83-9e4b-9726c602c9d3", "value": "T147D30946F8819B11D5D112BAFE1E128E37131B78E2DF73129D246F647B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169273, "uuid": "a42a598b-5b38-408f-a365-c3f97e174ebc", "value": "1536:otn6NbCelpNIj6Sdv7wUlcVxfZ7RfXyNt/kclaPTrayUJ1XixiYvdPsiyB5HDccL:UeHzUGxx1fXsk4aPPay11PREFDcRml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169273, "uuid": "2fb2b7f2-6fca-4297-89ad-edca1facfb5b", "value": 139708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169273, "uuid": "ddcbaf00-39cd-429e-b01c-6d5cae2bad51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169273, "uuid": "9c4b448b-96d6-4ab8-80a1-1a7fc01dada4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a5e84b-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144744, "uuid": "ac717981-7843-4738-9ec4-e6b03f4c6c1e", "comment": "Malware payload", "value": "26007d7f22cdf0897872fde88ad4405b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144744, "uuid": "396b961f-116a-4036-a799-2ca0c5de79ec", "comment": "Malware payload", "value": "ea643b3cf5bd74623cf04b1965125509376e28908a19e584b9afdcc81ea6765d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144744, "uuid": "2854bb62-43ae-4460-8edf-45c5caa12383", "comment": "Malware payload", "value": "67eae2a7e606ed2dfdbe9c4bb55b868ce395b604", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144744, "uuid": "fdc041b2-c8fd-4a25-a7a0-5902657c27de", "comment": "Malware payload", "value": "d348532095cade30e53a92ae4f3adb00f2748eb5c9002e254dc02958bb85438393f27c0819a15198ba8cc5a8a6a656b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144744, "uuid": "e247a717-5b3a-4994-b261-dc1635f17904", "value": "T1A8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144744, "uuid": "7d80a430-1ca3-476a-9201-835b83474aae", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144744, "uuid": "90aa2ffc-a13b-4f72-87f7-9e30da071053", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144744, "uuid": "01d683c3-ed18-40bb-ad8f-7794e5f1cb93", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144744, "uuid": "b81e2db7-719f-4665-a522-f852d23aa7b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144744, "uuid": "364c1d79-2bda-4102-bdc4-e0dc8fcd76ae", "value": "62loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca2e58a-1702-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688101048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101048, "uuid": "c304f693-3e1a-416d-b15b-3c1fccce15bd", "comment": "Malware payload (AgentTesla)", "value": "0dcce5c54658fc8e2282b8f737e93be5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101048, "uuid": "e930cbfa-4e1d-493a-a757-de7bc792b8f2", "comment": "Malware payload (AgentTesla)", "value": "eb2e0bf52e69c88784e19aef53a2c0330d3151ce8d448c5c45de44f3fc965aa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101048, "uuid": "b68eb447-9494-4272-89fe-9dbe72a5e21b", "comment": "Malware payload (AgentTesla)", "value": "622ed85d5cba99ac24d691b98b71ab7080074161", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101048, "uuid": "eddcf1e5-f23c-40ed-985c-35099e48b2e8", "comment": "Malware payload (AgentTesla)", "value": "a8c67fb6c86cb625623d4f04159499f225366b6b05ef5074fb96ed9933682cd4654bb487fecad7af7b331c03c6ad93b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101048, "uuid": "306b725b-22ca-4a3a-aaef-028aadbf8204", "value": "T17F55BD38297DE327D174C7B58FD18427F364A92B3025EAE56CC267E54326B112AC723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101048, "uuid": "e7e69665-a4d3-4129-87e0-e7b83d5cb391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101048, "uuid": "ca62967d-6bf8-482e-a735-1ed6e8885cb9", "value": "24576:uVp0K8s6owsmKZw2XXPUOgnwy45hbCbsfeHzYTuxa1y+ceBwDdplNMn0:uVp0K8s6owzInPUOgwy4fVWa1jceBw9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101048, "uuid": "f64475b4-6e11-4311-9f4c-4da21410dd14", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101048, "uuid": "e4586acb-a854-46e7-b50d-f2b5910ea637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101048, "uuid": "06adbe62-380a-4aa8-ad97-ad22f7d10a53", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db71f0cf-170d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688105877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105877, "uuid": "0cfae84b-30cc-4f6d-9159-66401c53f1db", "comment": "Malware payload (DarkTortilla)", "value": "1fbc3e86ce2477ff8024133653afe0c6", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105877, "uuid": "ae694ae6-21fa-4bd1-a5a5-866af67fe63e", "comment": "Malware payload (DarkTortilla)", "value": "ec29a42f42352a576191dc2bd23f2cf526a22f76b48a859570116ea35156b8cb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105877, "uuid": "fb832a8f-3c29-4b56-8694-9cc664b8c91d", "comment": "Malware payload (DarkTortilla)", "value": "0fa32e91ae8b2dfe8ac33e357d23a881ee772cf8", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105877, "uuid": "e2828853-f801-481c-adaf-944072c2a3bf", "comment": "Malware payload (DarkTortilla)", "value": "c8ef23dbbe421cb62a85392a35e501e9f0db5cd7a28f4070827f8566e5f20d794774cf8e67f3b0695112a8883ebf2ec7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105877, "uuid": "1d1b0bd1-180a-46ee-b3dc-6994a111d390", "value": "T10AE49D1B9FC60FE1C1647D7AC3AA855C43F0C2EB1160F3635ED485F4C627B8AAD1A25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105877, "uuid": "90553388-60d1-443e-9c5c-9d07b6586179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105877, "uuid": "4653bf13-65e4-4635-b4d8-ac34613e27ee", "value": "12288:pudh9TVmdkv2hnUvwDW8jpSeVYUKLlmpE:puXjmdk6nUvQLYUcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105877, "uuid": "9132e0b8-0496-4414-beda-0b49ef39b2d6", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105877, "uuid": "47a0267a-fdb6-469b-82cb-7dcb1ca96e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105877, "uuid": "3a29ebd9-af1b-4b7a-8d62-13e7e383c39a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3769cd-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688150731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150731, "uuid": "424d9ef1-3e73-4e10-abcb-f4d12b6cc2ca", "comment": "Malware payload (RemcosRAT)", "value": "b7b16c744f448e824d2c4d4235f1c34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150731, "uuid": "d887b474-ebc3-4288-be9c-00cd65826d83", "comment": "Malware payload (RemcosRAT)", "value": "ec786af55576e020a5cd63cefc5458b46868055b6222e255d35b4ec4689cbfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150731, "uuid": "ae5dd952-ac8c-4824-acd3-ed115b095a64", "comment": "Malware payload (RemcosRAT)", "value": "79a4e71a519b24e3bd6aa2ea2546523c6e90d5b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150731, "uuid": "d042ef24-8e65-4894-984b-6bacaacc9124", "comment": "Malware payload (RemcosRAT)", "value": "568094c7dbd3056358f845ea8728b9cc74198bdcc4ba2a2540c0125fe82bf2bbd627e4b72a2fec46b91689a1c7a0ed42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150731, "uuid": "40d75eac-7764-47dc-b24c-76e9fd75b897", "value": "T1B276120CB3589E5BEA5F0BBE9BB1545887BDC201A146AB8F0E4DE0F69443350D94DCEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150731, "uuid": "99dbb9fc-5edc-419c-9772-d0e87ddff730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150731, "uuid": "51bf56b8-abb1-4b54-99d4-92203e4c29d4", "value": "196608:2T0z2rdDMrbJp57GpcyNLh9k+ENhXlIy4VXBb9:PYtM9ipcyFHEvXlIyQXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150731, "uuid": "35974f25-89c5-4015-acc8-3cf68c9677e5", "value": 7447552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150731, "uuid": "ab099151-90a4-4a65-80bb-7d6b5c5f5207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150731, "uuid": "fae787ea-62f1-41ef-8aa1-9063be8ec0c7", "value": "SecuriteInfo.com.Win32.Malware-gen.14681.20641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfe6359-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144751, "uuid": "b7f4c838-5666-41a4-96c7-ce8da0f6e307", "comment": "Malware payload", "value": "e787816b117f2469a1c8c3b760b0ff4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144751, "uuid": "52faab7a-5d67-4c68-91bf-ab6957a28f72", "comment": "Malware payload", "value": "ecbc3c9f6ab2cfcdbd70041718d11d8a32ad41d90423109477182714bc1469fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144751, "uuid": "face8839-3135-4096-ad5a-1855333778ef", "comment": "Malware payload", "value": "9623865a5cca2e7e30a5756a0447cfb89955d7e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144751, "uuid": "66fd65e1-a293-4993-b828-0773f7255c08", "comment": "Malware payload", "value": "6cb2bf1280cc22dc935b2554f11584b2d98e30be97587c01854f2c5fc0856bf1705bfcb7b7be95d89d4c0ffeafcaacea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144751, "uuid": "5d199205-d295-4661-9dc7-148345362d03", "value": "T194646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144751, "uuid": "ba38af55-ed22-4cb9-93e6-4171fe99acec", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144751, "uuid": "901d5f27-3862-4245-bb49-20445eed6e1d", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144751, "uuid": "703b66f9-e762-4f3d-93a3-6154d9dfca6a", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144751, "uuid": "699b7498-20c9-4a02-9c92-47fc7c073f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144751, "uuid": "ce82a638-871c-4f05-8e1e-4bb133284330", "value": "63loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5279bb83-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140866, "uuid": "714b1381-f08b-48d2-ac44-a276d98c9c82", "comment": "Malware payload (Mirai)", "value": "2eaf1f3d01597b8b1a0aa5950a3b2f70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140866, "uuid": "cc182ff8-e960-455b-a14a-838320ce6584", "comment": "Malware payload (Mirai)", "value": "ed3ec43c2eecf6dada06ed3312782861a2c6175a144cd41ebf35f21fdabc01c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140866, "uuid": "44fb3bea-37ef-4ab4-aa22-19d13e1ee561", "comment": "Malware payload (Mirai)", "value": "67213fcb1af6e23caf43bdeb1c892c8260948f5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140866, "uuid": "c65ba976-e987-44c8-ba10-489d6048ea98", "comment": "Malware payload (Mirai)", "value": "3a0c834987841f88d3d704fd92594adfa423bf5d5edaa17f14a4cd4e70b62136a3b60e6fa727eeefab21432fb8e18516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140866, "uuid": "74ae45f8-da39-4ab4-898a-7cdd43140979", "value": "T19AD2E09CE656BFA9CE8C947C09EE02766E8434C3769D46C907538489377EB8BBC1D234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140866, "uuid": "ef13b69f-2c5f-46d4-bb27-9f78bdaeea00", "value": "768:11uUtLrVDsAp6tLkFqok//xDMflhJbiWUS:1bDs06t4fYpwNhmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140866, "uuid": "ce6db05d-97c7-4f10-8181-94d577a4f275", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140866, "uuid": "e37be77f-a1dc-4712-9cb2-397de1a2a37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140866, "uuid": "d6b531b1-3798-44cc-a57c-7fe574193d81", "value": "2eaf1f3d01597b8b1a0aa5950a3b2f70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc4114a-171a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AllcomeClipper)", "timestamp": 1688111411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111411, "uuid": "082c85ea-ae09-4625-81b5-6c68ede0aab6", "comment": "Malware payload (AllcomeClipper)", "value": "ed0a563d3d57d03356187c1a2fbcce3f", "object_relation": "md5", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111411, "uuid": "53f61675-8896-47f2-a1dc-f952a918b6b1", "comment": "Malware payload (AllcomeClipper)", "value": "ed78295a1b60b7053383c7f2a4837c62cb5625d7d57b5f4121df45660a000c65", "object_relation": "sha256", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111411, "uuid": "f37e2bf6-99a1-4457-a939-9d333620177c", "comment": "Malware payload (AllcomeClipper)", "value": "29b80e1cd5dcb6e134985ad547afe03fa9f5f9d5", "object_relation": "sha1", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688111411, "uuid": "ad4fa3cc-2889-41f5-86d2-abf57b658b33", "comment": "Malware payload (AllcomeClipper)", "value": "3bc846488da0278c2e3c30dba70044bc5e73a9cfa89917b1f17197166566ebf5dd9983df34503bbe3d5234e32ad3a3f2", "object_relation": "sha3-384", "Tag": [ { "name": "AllcomeClipper", "colour": "#A2067C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111411, "uuid": "3dcf3897-a920-40c8-ba7b-aa5bf987554b", "value": "T104C38E1075D1C872E472193149A4EAB19E7DF9700F64AEEBF3C8067A1F342C19926DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111411, "uuid": "b45e88b7-2066-47bd-a618-4ffbbc1845e1", "value": "ed5e7a68bd9d3fcbe4fc8ca66473351b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111411, "uuid": "cfc32b87-6c6e-455e-9db7-9e8fa8410e52", "value": "3072:kBHLe0crYUAc3W3RBjJ9wUZBva7oRrADruYQLeT8YGjjsxf:k1vcruc3WBBEUy7oL3jjwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688111411, "uuid": "6168ea5b-98ab-4e5f-8724-0a9fe550b7bc", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688111411, "uuid": "d1189140-1c98-41db-a37a-3842eec5e17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688111411, "uuid": "aa38b2b1-238a-4b0d-b397-701325947a20", "value": "ed0a563d3d57d03356187c1a2fbcce3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bfd06b-1755-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688136604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136604, "uuid": "dee40bd0-dd59-4584-b54b-d165446923dd", "comment": "Malware payload", "value": "530852bb6f8c6fbe4d7090786c4b5400", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136604, "uuid": "faa94435-cc63-4f92-b1a3-3b262d2cc9a1", "comment": "Malware payload", "value": "edd0cdf3e63bf6c7b62db9afe0ec85a6e5e187e9dfd45c7ded00276bb227c715", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136604, "uuid": "fc335309-8c86-481f-bac1-c8cb9bd77dec", "comment": "Malware payload", "value": "ea9f8ec313b1f0f0c0399768fa77e4d48a58606c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688136604, "uuid": "2e10db66-756c-4de8-9993-5ddfbbe303df", "comment": "Malware payload", "value": "e986630c65df9025427b285d78eeeeafe5cd91da7b08f58eea442eeb7ccb09a597ae093747c671f87b50f2ad7ef6c660", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136604, "uuid": "90c4ba13-3323-4a60-b2a8-7bbf7f743676", "value": "T1534329C8E6D7E9F4EC090A313137EF32D6B6E13F252CD993D7A86563AD41642D4022AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136604, "uuid": "7aee8dcd-53e8-4bb9-a556-7f15cc9c3daa", "value": "1536:CVKFOD7prJkaNup1COy7O/HgeFD5nshci7EYdP8xO:XFOXprOfPTy7yHgeFD5noc3WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688136604, "uuid": "a5d04eba-ddd0-4ef5-be39-052402a0b12a", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688136604, "uuid": "ffeea418-7fce-4ff1-8632-d557a8489cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688136604, "uuid": "3b61134c-23b1-4fc4-a864-26cd5c7ede7c", "value": "0xh0roxxnavebusyoo.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a054a3-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144093, "uuid": "1cb4cd34-35cf-4432-aee4-e60cb1b57ee0", "comment": "Malware payload", "value": "bba532370c668349ae3cb3ca3fbb71d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144093, "uuid": "934f9d5f-30dd-4a69-ba15-aa880a142e7b", "comment": "Malware payload", "value": "eddd8a2b8647f48fd605ae264f0e9590ad30d897fb4dca10382a496c6d9c1101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144093, "uuid": "f248784d-7cea-4b23-8135-eefdecd4246e", "comment": "Malware payload", "value": "7e9c210f39dc8dedf84efdec2af5f1efe74156b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144093, "uuid": "5621a4e5-35d9-4a04-83ca-08d0ad62249f", "comment": "Malware payload", "value": "46003b94107f00dd0fff38c3b4eec1530c1608b4df61689208e6c0c773ec2d48465c0f09e8cb866132b8afbe1cbc65c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144093, "uuid": "595993ac-c880-4b06-84a3-32bcda290016", "value": "T1CEC6336646490235DCF203BA646B53F254F77DB3A63168BF13F191B7CE41E8460B2A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144093, "uuid": "363be139-3ab8-44f9-a0ad-1dc2df12dfb6", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144093, "uuid": "74812874-d9eb-4e71-ad5f-e7e604b173ef", "value": "196608:UfU91MumAmrW9dtIiVXaeKwwwX+MpamYCaRpNHzbE6H0z1M1mWms:jvmu3VXWfwfaRPHzQ6UBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144093, "uuid": "b9e976da-5308-4c08-bb02-c65162b327d1", "value": 11924992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144093, "uuid": "7a75db01-b32f-4314-8416-b08dd2f59e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144093, "uuid": "9b812974-5a1d-457f-afb1-a11d7032ab23", "value": "SecuriteInfo.com.Win64.Malware-gen.30169.6220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d850c59f-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144527, "uuid": "45b7fce7-ffb0-4082-a2c8-0912fe4d2db3", "comment": "Malware payload", "value": "687cf32413f4ded6c15a93c6f9e8a587", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144527, "uuid": "86b0d8f7-f0c5-4106-8d49-f4b77d7cfa68", "comment": "Malware payload", "value": "ee3e8fc21dd5c45d66c9481739f0898bc8300d4d868c60a3efc7f9226fbce06f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144527, "uuid": "c70b2539-da59-4c33-985d-200408184563", "comment": "Malware payload", "value": "65f3a8f3bae4ad7cfd8936ae25f69856cb94db0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144527, "uuid": "1b9e8b3e-f303-456f-9a0a-950b7ecf27a1", "comment": "Malware payload", "value": "08e929192210117a3d1a997472e2e3d9e779a7d3e40c8b202bb54744dbeb2fc62db97b88df9743a2a5e8b18e01e82488", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144527, "uuid": "cbfa8b15-8073-4a01-ad08-7fee4f81b110", "value": "T1BF646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144527, "uuid": "7f250051-a720-47f1-9810-157514efa38c", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144527, "uuid": "288a1a33-b8de-4117-8f48-3a7d04d32804", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144527, "uuid": "d1a7a36d-6bc0-4c97-847e-fee3cb68836f", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144527, "uuid": "ea5e8e7e-c247-45da-8d17-99736c78a648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144527, "uuid": "984d4e10-d917-41ea-9999-46c7523c7e29", "value": "37loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d306473e-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144088, "uuid": "0851a785-0786-4fbd-9ed2-0714aa3933f2", "comment": "Malware payload", "value": "85f61d02469049886e45c04629b529ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144088, "uuid": "e3eac399-cf5e-411e-b300-22fdebb4b9a9", "comment": "Malware payload", "value": "eec6444f132d2af93a5e215a734c0a518b6763cb72b825638a8fde6c911bb45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144088, "uuid": "77cd6e63-abe3-4373-b708-87f910d639f2", "comment": "Malware payload", "value": "3354f5a333e47d79f1771f267a4ed1dba123bc9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144088, "uuid": "c5068eab-a5d9-4b13-a93f-5c0e046928bf", "comment": "Malware payload", "value": "8b87f97ab854eaceb04d3715d92769b5d5f419cbf89b9e6f28da265d23ad10aeb6ad11fc9874e9f43dfe24919f4dedfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144088, "uuid": "45d4aca3-89a6-47f0-b408-69a27e1ad5e8", "value": "T1D6E533365DA92772CB278EB42D0D0B9AD4E43773B452F1AD3A40DD6B2D36C590FC21A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144088, "uuid": "f47a18d3-50ec-4230-9213-aa0917ad0763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144088, "uuid": "034227b3-87bb-432a-83b2-7e98fe06e372", "value": "98304:2kTQ0d4KPsp7oXq66Obc5fhQzrjiMCP5IrHT:NTRxS7Ki5fhQfCPMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144088, "uuid": "adcac394-b8b3-47dd-9eee-369d36d0219b", "value": 3195904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144088, "uuid": "dcf41e15-e316-4ae8-87a5-01d889a5f730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144088, "uuid": "382ebe84-cac4-41ea-b71d-d8725d439384", "value": "SecuriteInfo.com.Trojan.GenericKD.67699774.3814.28409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98337052-1730-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688120797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120797, "uuid": "18f241aa-bc1a-4a09-89a2-ca705b36f7d6", "comment": "Malware payload", "value": "7197d2dd373016bb3dec80bf0430789d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120797, "uuid": "87afdd16-9f4b-4ee4-97e6-a366897e4e67", "comment": "Malware payload", "value": "ef28e3fb2199796b924da9fbcb0e012e1b97854b8affb24f014f702ede51cc88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120797, "uuid": "31603426-36a9-4c52-86db-6fb47286dbd4", "comment": "Malware payload", "value": "3448c2f9bd347d01f399e36c05cf4053b6cc7c73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688120797, "uuid": "e49942fb-c51a-4b07-aa58-a05aae2dc7af", "comment": "Malware payload", "value": "483c41718bb68813c11dde44271935f8ea78431797ea2f127774cfacd4a5ecec27a8b960655f51346baef0c35cbc35c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120797, "uuid": "a6009cd7-c3c5-4672-9e09-bade18feacce", "value": "T17E7301B08E15C1B0D1854CFCA5AB5481E78CFFB0C9A23AB667951447FE128CF8A6AD13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120797, "uuid": "3e287de4-ea7f-4d41-a268-049a2ea20400", "value": "1536:FBRaduKyusQpQD4m0Bsv3SLzGVup/PWICeLvMh4bK+aUX:FTapbsWv8vVVuBPWI/Lkhd+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688120797, "uuid": "f0ac86e6-e316-4cd0-a5fa-016e24853311", "value": 73768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688120797, "uuid": "53b91a90-041a-4ad0-bd5c-548af32c6310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688120797, "uuid": "9fea83c1-43c8-4619-881f-f61db6a83412", "value": "7197d2dd373016bb3dec80bf0430789d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eddb565-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144833, "uuid": "e071640f-5e12-44d8-b3df-23c607f08ce9", "comment": "Malware payload", "value": "bf05e15af537e5172881f2b6518220e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144833, "uuid": "51e98b99-2549-400f-9b1e-c3cd5db2b186", "comment": "Malware payload", "value": "ef972f8ca7ee30e122ddba41b42ac736280ee4f7e8e7c0fe053f0777616ea9f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144833, "uuid": "9398f1ba-a687-4955-ae11-0d6a4dc51f4a", "comment": "Malware payload", "value": "f7a12ea5c5e6809a1f1edc1a96fab5187d875c0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144833, "uuid": "07dfd29e-fe8f-4446-b61b-d51f0281849c", "comment": "Malware payload", "value": "8dd30c90cd2cc4923143f7ed5802da6931a5c69aece7d4500e768c7caea452d5527d8d7043ca255af25ebab0fb89a079", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144833, "uuid": "d0018f8a-3b73-41e2-879c-92ce444fb25d", "value": "T185646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144833, "uuid": "e381635a-6acb-489f-8a55-24f222974cd5", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144833, "uuid": "51d7cf7d-0221-4054-b626-846777d7b235", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144833, "uuid": "edd71da7-3f42-43ef-bc1f-decf26717e65", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144833, "uuid": "1cb5aa09-5168-4e30-bcd8-01f718c26594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144833, "uuid": "43fc12d7-18f0-4173-af4a-6aaf550883f1", "value": "73loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14312b5-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144891, "uuid": "6163a24c-5036-429d-9b7e-8945f720a2d8", "comment": "Malware payload", "value": "08262b9f723aae1716783fd838a0c87b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144891, "uuid": "4c395e8d-6146-467c-861e-73de319e1280", "comment": "Malware payload", "value": "f0220a189017d79a975d9b560fe0a57105f811a507c4c4f8382a3818eb71a21a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144891, "uuid": "b117a486-141a-4476-8fff-ddeab9dfc3e6", "comment": "Malware payload", "value": "0202eb078888c63af64d18bb36c361a1317c538e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144891, "uuid": "db8d8655-ecac-44c6-98f6-3f60dbf72079", "comment": "Malware payload", "value": "29af8ac626c7577a9197c3f8c243166335d6c3dc063108694c05c005aa15a591ac3f7d98e38f56fd0a93793b62be9af2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144891, "uuid": "4a5c941c-f34b-47fa-bd2a-a0d2c6e3322f", "value": "T1E0646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144891, "uuid": "5fb74d1f-9cf2-4f4b-8625-f59d3e8ce20c", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144891, "uuid": "8db540f7-a9ab-44d7-a28d-a2683a1a478e", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144891, "uuid": "b5b1fd72-212e-465a-9177-9f2e6602dd70", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144891, "uuid": "e49285f3-7279-4f94-80b2-8b35d8dbd6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144891, "uuid": "dba48ff5-e1a9-4b97-bc48-5c25e479f1a7", "value": "81loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fabca5-170c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688105226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105226, "uuid": "ea449fb9-aa72-4b66-a621-de37941fe641", "comment": "Malware payload (AgentTesla)", "value": "380a5afe36e5167ac47635f5ae0d3c0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105226, "uuid": "a6b16cfb-0c1c-4946-a3ef-edfa3ed8c0b5", "comment": "Malware payload (AgentTesla)", "value": "f069180ae1318498d510d0b1988c96f48c4a7bb89bec10a41906d5ffbaca3732", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105226, "uuid": "19e4da8a-d28d-4959-bbcc-9f13981f0c01", "comment": "Malware payload (AgentTesla)", "value": "405525fcb12aa788bff6ea3a0eecd056050e470b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688105226, "uuid": "041654e5-e1ff-48f3-bdf0-5c3c8f537c38", "comment": "Malware payload (AgentTesla)", "value": "8336a34ec7f3e28dda37ede4d24041cb7e68bc68b2b815ed66922cd221277d492a06bad7e1283b6760a7f6fdd6f83e4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105226, "uuid": "df9ff51a-dd3d-4e1f-8657-922a0a7d8ea1", "value": "T143F3A14663ED4208B5B72F4C5A7D90348B27BF99597BC26D01BC584E0BF3A44C9A87B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105226, "uuid": "8142e962-c2b0-464e-9449-6aa8969caa74", "value": "1536:hAYJJMMPQXgBFhHZ4OQYcEp24+zVevP5e+3kGra+TmsmY0:kgBFhyOQY06To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688105226, "uuid": "984adf1e-5355-4531-9a2a-95fa1067d15a", "value": 168798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688105226, "uuid": "47ae8c0e-f067-493a-9807-7daf0bfb017a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688105226, "uuid": "85cbc298-2d8e-4983-afab-df23800eba8a", "value": "Weterings Machinery B.V..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b7f6f2-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150695, "uuid": "4f657fd6-d9fd-4225-a04e-3464c1437572", "comment": "Malware payload", "value": "e0aabd65014bf2c1019a9fd8336f80b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150695, "uuid": "38910ec3-a03f-476a-a2bc-1107af5005b8", "comment": "Malware payload", "value": "f102824c8eb81422390490deda8ecad6b62811805f3ef9f625a2c029e633061d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150695, "uuid": "0317db25-a794-4536-b894-0db4eef073f6", "comment": "Malware payload", "value": "00019011d4deac48102dc6c382c968ab83e42623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150695, "uuid": "967773a2-2662-41a1-a4c6-efe12a370a93", "comment": "Malware payload", "value": "fe92957187996b11c39dab863fe815eee01749019b6d51ae9bf4348848aa07e98e07433bfec49f53a3ab32cdb4000cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150695, "uuid": "cd8cbd9d-445f-4d7c-90f3-846085b82673", "value": "T1AF3633E9A98F9D10FAABE5BFC3630188036DCA6A7704F651B40C78C65D05AFBF190749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150695, "uuid": "ab039562-ad8a-4b80-b4bd-763a5ce2f675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150695, "uuid": "06b28a50-5c95-4cac-9dee-99eb464354b3", "value": "98304:8EqdKjHcc0NR1zOVxXsuVyY6Q5eTnuTINvX6TrWk7aM7spWB1RQ4LhLFMa:81d6V0NR1K0uVSGeSTINXgyku2E8RQ47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150695, "uuid": "f3eb7596-a1e1-486c-9e30-5ee6a8f89349", "value": 5315072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150695, "uuid": "0f19088b-55ab-4cc4-8302-a777dbff9c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150695, "uuid": "b83aad68-38fe-4d1a-ae34-90182b666a21", "value": "SecuriteInfo.com.Trojan.GenericKD.67655977.4555.25731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33859e6-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144948, "uuid": "06cb96ca-443c-4c66-98b9-09ed69228e26", "comment": "Malware payload", "value": "b99ce7954347bad91f2aae34da204928", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144948, "uuid": "3e08e5e1-a06d-4c64-be0d-f1f4b33cf078", "comment": "Malware payload", "value": "f1224604fd5a0e22ba9f26a5af853cbfef870df70a76950ed727eda3c9a77735", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144948, "uuid": "1e72590e-f4b8-4aaf-8156-93c36e2335d1", "comment": "Malware payload", "value": "9af5b426474513a630df29d5946ddceb01c336b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144948, "uuid": "8d41aad6-b05f-4b03-b047-9f6ec295dcc6", "comment": "Malware payload", "value": "7d3ad2d6d7831a3f7990229440a42b9d8dc36ef3187327a4992d6c5d1f9246b68dd7b12dadae2f10ca37120a3a10c339", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144948, "uuid": "94e3a6f5-bd9d-4d94-be47-5f27c18bab3b", "value": "T198646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144948, "uuid": "b3301ffc-991c-4e15-b4a1-a4c24c5fab90", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144948, "uuid": "09492127-2553-4bbd-96e3-695c677e81fe", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144948, "uuid": "419a7aef-6840-43bb-bb77-98b5e11913b5", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144948, "uuid": "88b201d3-d7e1-45c2-a876-9a745b397421", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144948, "uuid": "d7dfa7e0-514b-48e8-a174-fa9243bc8ab8", "value": "91loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c903f9a9-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144501, "uuid": "54a25f9e-241b-42bf-a0a8-9d0be35e2baa", "comment": "Malware payload", "value": "4a56e3fd6b5b75a35bc7ccf7a1abe056", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144501, "uuid": "2ea10151-6341-4a49-86da-7867b443851e", "comment": "Malware payload", "value": "f13b311fe2f31a057524c05c0e400e8dcfea5dcde895c669747d86ddb00ae4a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144501, "uuid": "3d3a1ec8-600f-4efc-ad7d-48b8d3895559", "comment": "Malware payload", "value": "466569b0c94550ed8e66d060fad2d579297aa550", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144501, "uuid": "27a778d2-81bd-433f-9c92-83dfa853a47c", "comment": "Malware payload", "value": "63608afefab57bff357ad41389d2ed2811d24c7986852a85e03d5609f9233b1bf5f011d05c756f39b6b59beda803231b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144501, "uuid": "b4cdce3a-163d-4c81-b853-25c23d14536a", "value": "T14D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144501, "uuid": "0567c3ec-d4b4-47f7-8fc0-e92db6023bf8", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144501, "uuid": "4dc21947-48ea-4a17-bec2-7d3f950e3246", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144501, "uuid": "cc5e4a01-5385-4a7c-a8c2-fe108ce84665", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144501, "uuid": "c5bdc070-7ce2-445b-a8a1-5c9ff181e046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144501, "uuid": "775b1662-4285-44ac-a3e6-509b52649928", "value": "34loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bd7d94-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688108250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108250, "uuid": "11ac3240-51fd-4207-9f92-188062378569", "comment": "Malware payload", "value": "26d3003d1af9edd2ad62f4c17044f0ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108250, "uuid": "7659f544-9817-4ce1-9e20-c89f85c7125b", "comment": "Malware payload", "value": "f14564e5c120af0f98f199744fe2a517089b6a522129bfe509f1ea9d87b9949e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108250, "uuid": "4156e253-c952-4eab-ab3d-2d3dfb160ac7", "comment": "Malware payload", "value": "e605c8263e32c46f6582b1c4844bcc12fd2c5983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108250, "uuid": "a415b66f-2f23-4ca3-9323-071fced15da0", "comment": "Malware payload", "value": "66414e41f96234c592a1360cf8acfb70ec385eb1f2944b9cda9979ad3d34a7a0894fa3a5e268e3b2183183bd3ea115a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108250, "uuid": "fab928ed-11fa-4638-9902-63fdf018ac3e", "value": "T18E551202B9C148B3C57218335A785B20593DBD602F69CEDB67E07A6ED9316C0EB357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108250, "uuid": "075d481b-3dcd-46e7-89bf-d0ce972266be", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108250, "uuid": "f90c08cc-de52-44bf-8f8e-20b574f71fa0", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbnAW:IBJctgBhc6Kus+9gO0qnAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108250, "uuid": "287c5589-8a47-426c-a0d6-03cd7efa555f", "value": 1350631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108250, "uuid": "e72476b2-890e-43f0-af1a-289781f6239e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108250, "uuid": "a6f87213-ac29-43d1-b0fe-829a18253f8d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f743128-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135734, "uuid": "54ab52a5-5764-408d-adab-2a853a7bf2c4", "comment": "Malware payload", "value": "cb2d7a7fd419b5646e7ecb0f8f2cbb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135734, "uuid": "23e235c5-1405-44cb-9e57-524580a8b256", "comment": "Malware payload", "value": "f15d7c357b89244c9526ca1f248d8944665f72a756c408dbf0abcea90fb92b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135734, "uuid": "e0319507-aa2a-43f6-9746-d1ad2b97cbd6", "comment": "Malware payload", "value": "23c7d9a2566b3c35470074d3a7984cd43a2fe25a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135734, "uuid": "fd19dc74-b79e-4f8e-b18a-75dc50d0a28f", "comment": "Malware payload", "value": "51a8d309005675d4777dbd9c56ffebf76f71d5ac33ede16a95f59e5ab9e75168e776d854e4373ca3e4daeddb9a972547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135734, "uuid": "c3869d1a-8451-4861-90d0-afd52970bf8c", "value": "T132E57B9B36E844E9D0668535C8068A4BD3F2FC460F3097DF41A15BAE1F736B24DB9722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135734, "uuid": "21587e96-c080-4544-a4c8-501258df36dc", "value": "78e108959140955b7b00ee50f6572fc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135734, "uuid": "27503af3-4f30-47f4-bba9-7fd628b58192", "value": "49152:WH/CfTsBM2LUTeBAoetKz+K2n67WsMkpM7vgC/0seaInM9UUB8MsGMbLr:WHkKpLUsAoq4C/099u8MLMbLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135734, "uuid": "50f9f13d-8a99-4bd9-a37b-a03bc2ed8c61", "value": 3020800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135734, "uuid": "b6c8be3e-0017-4ee0-8c98-3bd0dbef3045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135734, "uuid": "4df837cb-8dcf-45f5-9124-176795af6ac1", "value": "\u6d88\u5931\u7684\u5979\u5728\u7ebf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c024ca30-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154365, "uuid": "1ca8d283-e7e5-4a0a-8b20-6ff04c170e3b", "comment": "Malware payload", "value": "1f06e8929600b3f2ab08ce444b074bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154365, "uuid": "2469e3ac-5f54-4515-8c42-185f1d4c2dd8", "comment": "Malware payload", "value": "f29b24a003ba8f768f50e2cd2f43d797d4e791a7dc3dc6de8397550d6a49c1fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154365, "uuid": "b28ca0ca-c187-4d90-b527-48b554d2a2c0", "comment": "Malware payload", "value": "cbbe0b0b1ce08cac52bfd82b80259cfdf22dd2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154365, "uuid": "f7d5b3e4-68fe-4298-a81d-1e915fd8b85f", "comment": "Malware payload", "value": "a5dd349c2bece31d6552450fe454b293e6568c32a761c28484245c7ba8c71f979f2a1d7e71c3bbf0bebe738bbfda04d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154365, "uuid": "eec0d7a5-2c4d-4483-b890-18f279e14cf3", "value": "T13A76338581D5820AD4FA4CF6B5CF68D6D20DD200DB9E1BAE8F648ECD2C410E9E65CDBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154365, "uuid": "80aca8de-8f78-4250-b0a9-9d0ab8ef4083", "value": "98304:adpauHImk4Q15tde9g4BF7ykyWACehf+ugOut1nenqSaArVLzHKbQGAEFVrHM2pZ:a/fIMQ1q73ACe5rZFLzHCjxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154365, "uuid": "a4e257c0-b6f1-4cbb-9aea-4a22c45bdca0", "value": 7497728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154365, "uuid": "bc5ba765-b8dd-4d7c-a30a-c6fef0fe133f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154365, "uuid": "9b38154d-4cc9-4f64-8f51-50b35c0edf7f", "value": "SecuriteInfo.com.Trojan.GenericKD.67767313.7645.24997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea8829d-175f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688140833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140833, "uuid": "4e97d9ab-7518-4e2f-b213-24fd17e6ff93", "comment": "Malware payload (Mirai)", "value": "fe4c492fbf6aadd062ce6fc28f3a91e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140833, "uuid": "c6c17a75-326b-4949-b2f7-8c3b651f097b", "comment": "Malware payload (Mirai)", "value": "f2b29fe45af2998eb41ba3cdfd080089e6ec5cc9527e5172d83294e0e6ccd335", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140833, "uuid": "d641e580-45b6-4251-aebb-8c6e3564940f", "comment": "Malware payload (Mirai)", "value": "98c1cf585b4122ee5955499ad0fad1aa57aa200d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688140833, "uuid": "b35375db-2e97-4e57-ad34-05e58bc0bafd", "comment": "Malware payload (Mirai)", "value": "b9cdd56de94980d4c73f6771ddb72529758e7210b63db807949b8ebd7d42bc6ac9f91761ff9044889df029f4268577ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140833, "uuid": "012af4f6-206b-46d0-b8cf-48ce5d4bb554", "value": "T16EE2E16A473509A6D5F0EE76CBF6CD4253613F3C629A7442129423DCABC760B32EA4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140833, "uuid": "fdcd99ea-4c4f-49ef-a3aa-175605e53381", "value": "768:WljOHlOTcLs7Z8FviuyIENCHBhroJ4qDkGZ1vPwr4HQ9q3UEL5g:WAFOqquyqBhEiQLI6LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688140833, "uuid": "946fb539-3fd5-4b47-b215-44e1170fd911", "value": 33036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688140833, "uuid": "c2f1f896-6979-4cc3-85e1-979019f568a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688140833, "uuid": "4e18473f-8d0a-4b60-b226-a5b92bddc93f", "value": "fe4c492fbf6aadd062ce6fc28f3a91e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce751c8-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1688135784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135784, "uuid": "897a0d84-df1a-469b-8a6f-4c1f13953dde", "comment": "Malware payload (Gh0stRAT)", "value": "a87795a5a6a51766a7fac435d2e58764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135784, "uuid": "40d769af-9f02-49ff-b6ea-ebb2a31493a2", "comment": "Malware payload (Gh0stRAT)", "value": "f350d74e5b2da2f913bcd900a286bd7b6e6b1a9920ebc5e7ebbc23126984c17b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135784, "uuid": "0be621f9-612b-42ce-8de0-fcca732086fc", "comment": "Malware payload (Gh0stRAT)", "value": "6c7645d1b8148f339b59fab6e20a225b34466f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135784, "uuid": "a2651b38-a0f4-4a86-ae4e-abc5b8fccd2e", "comment": "Malware payload (Gh0stRAT)", "value": "da4d27279d5cabbf1f86a4349e5e73b4622abd7861b4b2f27897b44e62cdce930b8e531da193e6d144c3d0da3582e07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135784, "uuid": "ad8657e9-78bb-44d3-825e-b96cb19f7754", "value": "T12E06AF4BB2ED20D4D5AAD178C9078A0FD7F2BC351239878F01658B9B5F372614E2E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135784, "uuid": "4dba741d-b5bd-4d6d-aa60-df794b6e6763", "value": "11c8d19b3d517eefe392403b67e6a2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135784, "uuid": "47f42c32-021d-4c40-8442-74c81375906a", "value": "49152:yBIYsGTTT2Fjsxm/3qwq3skukw0dwZf8Jwr1BWKdMnqroz1gngbTwjACQxnhURvJ:yBCkeqRfwZf8CBWKdQX608jCVhKvy63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135784, "uuid": "04bb997d-7215-49f6-a1bd-8985fc23e5a2", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135784, "uuid": "234a0e25-5f4a-4a17-bde7-6a7e9318da2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135784, "uuid": "37105115-852c-45e3-8b1b-4aa7b882728c", "value": "\u5c11\u5987\u548c\u72d7\u72d7\u505a\u62e8\u4e0d\u51fa\u4e86p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490766e4-1776-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688150729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150729, "uuid": "ac7b0742-3e8e-454d-9a5c-a4982c951c66", "comment": "Malware payload", "value": "9f0e943d9bd5d1297e30a7771ab88f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150729, "uuid": "78c56c8c-2cb2-446c-a2a4-f7acf02f1b25", "comment": "Malware payload", "value": "f3afaeb3c1cdd4474471da47d97e95d96d09a4fe5060fd3fb4ae1bcb785adb74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150729, "uuid": "28e70f84-76e9-4b89-bec9-c5872790c0cb", "comment": "Malware payload", "value": "5efd7bf3fd2c0cfd694820af3139eb7325bae59b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688150729, "uuid": "03ea2253-8b3e-492d-ba6f-729f5ac7dc5d", "comment": "Malware payload", "value": "9e8d4455666b8d53113b53e183f51b0d9cb3bdca7f132f0bd9d4b3536dd5af1206aeb499107d7c0bc5347bb84e22188b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150729, "uuid": "7b16246d-a430-4c78-a788-87d2d8e12d37", "value": "T129C63346EAD38967D31A13BA04A16E57DE33BD39E3254F5FE2B054BB05732885032B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150729, "uuid": "1f45d143-deb5-47bf-9b7a-fa42477926b8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150729, "uuid": "99b150d8-78f8-49b2-8053-8d00355c9522", "value": "196608:1LSqA2rCy/finFWWESh0kiI3Ven8I6glw5fYG/HTSpu4pBzA144C2u39C:1L1rt/anFdWkiI3mTZwVr4bL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688150729, "uuid": "fb7f5c1c-92ba-47ac-97a8-36070e5e4d15", "value": 11863552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688150729, "uuid": "5d900022-9394-4acf-a9b6-ab07d41f28f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688150729, "uuid": "3c56f616-860b-464d-8059-6b5165941473", "value": "SecuriteInfo.com.Trojan.Generic.33996976.22686.7462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64026b4-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144980, "uuid": "28ed5b32-f2b6-4993-9c6c-3eb57c34b1b8", "comment": "Malware payload", "value": "3705947d51d9568ff9066623a4d1d747", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144980, "uuid": "c27a040f-67a7-4707-b1cc-80cfc4d322d7", "comment": "Malware payload", "value": "f428d76abdf9c3bd61006b1c56e81c6222d8b1110e4265e059273c766dd8eb16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144980, "uuid": "91a84d1b-afa6-4cea-8612-b02e41aa8a3f", "comment": "Malware payload", "value": "6e79f297184124659fa0e4dee829cec3a9335318", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144980, "uuid": "b0c52ec7-b848-4529-a97f-0c6cd13e4a02", "comment": "Malware payload", "value": "8007201a98b863e71f8b625bdf091a1980d482e17cbfe4590a380b309dbd6051cbb02957d39a61289cb542a3fbfa9b06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144980, "uuid": "9b232883-6243-4087-8210-5d4e9e55c6a3", "value": "T154646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144980, "uuid": "9751d0a4-484c-4ad7-879d-0952aee66541", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144980, "uuid": "dc363bdd-5162-4ae1-aeaa-ce2c34bac77d", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144980, "uuid": "7c227722-6155-4b2b-a971-882dfd7fad20", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144980, "uuid": "600a7d2d-bea4-4356-9aa8-538358263d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144980, "uuid": "0ac71927-7957-4234-963b-958446785aca", "value": "96loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4134005-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135876, "uuid": "f41ef4ce-0a65-4ae1-955f-5c5044ebf9d8", "comment": "Malware payload", "value": "64039f083c96cab5ea0de62f789886ce", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135876, "uuid": "a71a8ca0-ef1a-4489-82f4-9004e1408320", "comment": "Malware payload", "value": "f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135876, "uuid": "9a03a083-9963-4506-a2a2-c75df6e7b426", "comment": "Malware payload", "value": "ffb89927ad892b7d6e3d6a88ec24a9d6a161dee2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135876, "uuid": "7495b38a-8dac-4280-a9dd-fd9fccb704bb", "comment": "Malware payload", "value": "1a8b311797d89a50959fe98c939f7566b77d44166d29dc2c4e688191560c218f0bde3b56e119fd485bcb905d8cd44bbf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135876, "uuid": "3fd89928-99a0-441a-932b-45f6194ddfe5", "value": "T178C5230B79CBCF22C80A263095873B648EA99D644FE70912396D779C2C766E073D3BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135876, "uuid": "d10322ab-bac5-469f-9085-37529150b8dc", "value": "49152:3BiErnG0fwkAjwzYUrngrwjCBt4CFFDO84D2nng01WQhNzvS65R8ct:XnGvMzYUrhjCBZPO84DH01WQXzvP5xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135876, "uuid": "0aa6d417-1fdd-49f1-8c17-8c6a7be84ed3", "value": 2537472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135876, "uuid": "8426b3d8-5402-4e8f-92ed-3056dfe3a286", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135876, "uuid": "0e15c50a-cbe8-4dc6-82aa-a81b9db4e84e", "value": "f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0c20c1-1766-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144073, "uuid": "f7eb0920-f1c7-417f-9629-d5fcee1c4688", "comment": "Malware payload", "value": "9fef7d7554ca2ed502bad3981933528f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144073, "uuid": "2e4f756b-a0e3-4509-b01f-9b3eb05c3b26", "comment": "Malware payload", "value": "f4d6fa18bba78d69e878956143665a8f6b489ad5fb5b292507debdc5d3db7008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144073, "uuid": "64a32a88-5151-4171-b6a8-2613db2213a9", "comment": "Malware payload", "value": "0e395c5ac3d9d9a6292d76ea17c68ad32324f7da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144073, "uuid": "705c0760-6441-4e38-ad07-12e2be2e9320", "comment": "Malware payload", "value": "5744c009d7e4c7462b8da749627d9a1a44de8a801ac10e041b0ed34e833c751727bcf07ebf914ae51cb7ab01bfd7bfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144073, "uuid": "ee110fd7-325f-4562-9d5a-a7aaa05a3274", "value": "T1A1D6230673D8DE22E1AF1F7BE5325271C7EAD0869E7AABCF1E5995F4200BB50D908143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144073, "uuid": "cbb80c63-411c-4523-97ef-fc13bead45fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144073, "uuid": "3a8a3923-322a-4b52-a4ff-932ed6aac0cf", "value": "393216:kfyUxSEpVci5KAqTcqxIJGYMkHZ6K/qE:kKuHHcSqxZY16KyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144073, "uuid": "58eeadab-cb35-4e11-a1cf-532a3486797c", "value": 13568512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144073, "uuid": "1d55ddf0-bda1-4cd1-bd5d-311b1274de2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144073, "uuid": "1251b4a8-60a9-4970-a70c-171915601cde", "value": "SecuriteInfo.com.W32.MSIL_Agent.FSF.gen.Eldorado.16679.16830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fa8482-1793-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688163097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163097, "uuid": "6f37c6a7-8c88-4ef9-9c28-8270ce3b37a0", "comment": "Malware payload (Mirai)", "value": "1dfb543ee13015bd4c6f80823287034f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163097, "uuid": "b6771699-47ca-4785-add1-32382abb1125", "comment": "Malware payload (Mirai)", "value": "f519d94edfff8db78c78a2bccde11cf18aeba3b198b2aa26a2c6322f780cffa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163097, "uuid": "d686d839-5b37-4b83-a3c7-dee8634024e8", "comment": "Malware payload (Mirai)", "value": "361d1a98a8a9786d2c9dbcdcdb2f6e787dae8de6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688163097, "uuid": "7adf2dc3-9724-49ff-9642-25293adcfe50", "comment": "Malware payload (Mirai)", "value": "578479b7d925ced64c95c6e6b3a48d13a18dea0087d8165eb598e0c1208be9f6f120daa45dad01ba112803cc4246e662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163097, "uuid": "d135c452-bd46-4998-9f24-401f8f4df5e1", "value": "T13EA2C0712055C5B4C7314439E8DD8AC3A3AB553CF0BB7833776A02B4EE9110D69FAB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163097, "uuid": "e7938953-2616-40c7-bd65-3d950b6bb442", "value": "384:WbHKnVc2+QVLQD0nCs6YXKq4AFajZIUJf+rE8Njk+/thymdGUop5hmD:9nBL3SYXl+87aCts3UozsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688163097, "uuid": "e4893694-009d-4370-84d1-6d62729476a0", "value": 22232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688163097, "uuid": "1021860a-5fb1-4246-86e1-231024c53555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688163097, "uuid": "66d1ae1b-217c-425d-9f3c-4ecc22dc7a85", "value": "1dfb543ee13015bd4c6f80823287034f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a569601-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688109016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109016, "uuid": "5d292dc0-b71a-464f-b0ab-924deac38592", "comment": "Malware payload (RemcosRAT)", "value": "0f48cb3182a6fbf4fe385465b6d7c795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109016, "uuid": "a71979ae-e439-44c7-8da9-693e1b801e5c", "comment": "Malware payload (RemcosRAT)", "value": "f60667b9e2a0a25221cdb47844149beb3b1cd08abbc3360e8684fad9d8aaa20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109016, "uuid": "5b678bbf-ce4e-4944-a0f6-935ae93f9090", "comment": "Malware payload (RemcosRAT)", "value": "97fa10f1583063635f6bdb9a366062848fe3bd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688109016, "uuid": "4c52c516-c4c5-42d7-a230-8a6841842000", "comment": "Malware payload (RemcosRAT)", "value": "697b5dd055ed11b2a334e3aa3107fcdbe2d2f4c48c6b6fa2827a52f2024c917ca67f3ab36970a9856f1554cb4bbe3319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109016, "uuid": "cc91395a-9225-4da4-a6a8-cf326306ab8f", "value": "T1ED25AC3829BDA32BD174D7F48FD58023F7A4952B3026EAE5ACC257994752F1225C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109016, "uuid": "0de4ded1-ce66-4f21-b35b-6ab73e8fddf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109016, "uuid": "7da62b70-567d-421c-ada3-87d5f891266b", "value": "24576:p7+zoYbLtOZAK9nB/rv9EdPWA4rbtQQB:pKNOZV9nB/79EZWFrb6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688109016, "uuid": "e3a55bfc-b5fd-4082-94c6-9d413df89117", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688109016, "uuid": "460314f2-2934-4496-b748-c4d65dd92e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688109016, "uuid": "679bfb57-9d83-46f6-9293-39bd2ef32cb8", "value": "0f48cb3182a6fbf4fe385465b6d7c795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972f781c-1703-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688101468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101468, "uuid": "18ebb41e-794f-4f90-87b3-0f61786b31ab", "comment": "Malware payload (Mirai)", "value": "e48ce25063c5e5eea706574b55b2ab80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101468, "uuid": "fabb6826-2084-4ee1-b1db-cfd2faa308d4", "comment": "Malware payload (Mirai)", "value": "f67ecf7f016fcb38e510dc688da6499ea87ab01a37e9ba8fb17ced55d86d11e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101468, "uuid": "98396000-8e9c-4fe7-87df-b6629293e578", "comment": "Malware payload (Mirai)", "value": "e8190713c21b32ae596e032afcb92d836df8c148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688101468, "uuid": "42aa7dde-2d40-4906-ae13-c2512dfb115f", "comment": "Malware payload (Mirai)", "value": "d25dece03e8ffa5588a8433acd219b98083ce069b5be0fb20a5b05e365a67546145bfc43ec2754981dc5f39d485cb689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101468, "uuid": "34fa8e87-4c2e-4744-b012-fa1d87fc96c3", "value": "T14D639EB3C46ABA94C0588238B5B08D381B53B50297532DF9ABCE8793544BDECF50A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101468, "uuid": "0079a626-dda3-4596-b4ff-96bfdba44d55", "value": "1536:F/i712p2a4wtSBDT+ZtaLWzcmM4InM5jnMYRVChz:Fq7gUbBDTQIL5nMlnMYRVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688101468, "uuid": "068a77fd-42e6-44ce-a310-377814534909", "value": 68436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688101468, "uuid": "84937eb8-56ee-4cc7-bd8d-24107fd9885a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688101468, "uuid": "f8bf4063-3397-4831-9b83-c1719ac9f52f", "value": "e48ce25063c5e5eea706574b55b2ab80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7499add4-17a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688169270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169270, "uuid": "d1557a8d-6afd-4788-9841-63543b17aab5", "comment": "Malware payload", "value": "7af7435b12c43a168a8b91d5dcf7c6a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169270, "uuid": "58eacbb6-8065-4624-aa23-2360d90a79a6", "comment": "Malware payload", "value": "f6faf1d02c4dcc47526bf5839620f566604c9a9c7c8f29ad2ec7aa23e69990ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169270, "uuid": "1610878c-c5a9-48df-8e57-fabe14001336", "comment": "Malware payload", "value": "3bb80b2252d983b543a29daf62065a003bae098a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688169270, "uuid": "51f61925-4cfa-4f4f-ba40-055ac930e473", "comment": "Malware payload", "value": "ca740369449efdb8b2594b65b69eac3208da2782ba2d836289bed7a344e9921aec2209061b4b8371bfd70a3066fda3cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169270, "uuid": "403411fe-f5b2-4a49-ac5b-36d128e0506a", "value": "T11F836BC5F683D4F6ED9305B25177E7368732E03A102AEE42C72E9936EC51910EA2739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169270, "uuid": "40b96def-4484-4285-a44b-27f037bc2585", "value": "1536:Poz0tWXRCi0Ng3klzjBHl1PEFiGEpjWAIB33SATelHE:gz0t+oNlRT1sfE4TFCZHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688169270, "uuid": "6565536c-5459-4aec-bce1-b3b1f42f087c", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688169270, "uuid": "0b018292-6283-43d9-88c2-54893a8939d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688169270, "uuid": "5a0d571f-461b-422d-b176-0e961f75b14d", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc860945-177a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688152641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152641, "uuid": "0920c5bb-e7bd-44f3-aee4-05c459db6e0c", "comment": "Malware payload (njrat)", "value": "7cfbaa946f35782c324951b60d53e608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152641, "uuid": "730f6ffe-b1a9-4ea5-bdc1-da41bd9ff79c", "comment": "Malware payload (njrat)", "value": "f7200c5fb4b76977b2d73ad68bc6eb4d1b2f61c88fc804fe028f9701361b4bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152641, "uuid": "855a6638-8b76-4022-854b-8baf85694519", "comment": "Malware payload (njrat)", "value": "f77442e9be5917d17be6d6ffbb4789e0394753d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688152641, "uuid": "941a6a69-cccc-4dca-a8fb-c7e1dafbe7de", "comment": "Malware payload (njrat)", "value": "a11f78ae6866484fcc616caec62deb9580e6b66aa824525c6acc361df77664f4bd1f93853da21fc565b21d811078bcaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152641, "uuid": "8bd422f7-453d-4f26-aa6e-b7f889cc3a0f", "value": "T179E22CADFBE64465C2BD0AB60571950017B8D103E527F77E4ECA24E62B2B3C84B44DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152641, "uuid": "b500f6a4-2823-44fb-b15f-73f1ab18271b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152641, "uuid": "dc44c5d8-6fc3-432b-bed2-cefd91f8fe3e", "value": "768:/ZorDp8pdvXyzx9uFwna/5nW3TvanQmIDUu0tiEdj:uw68nQbkQVkVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688152641, "uuid": "a4ede298-f09a-4902-b527-fde272f79659", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688152641, "uuid": "89fe0e7c-fdcf-41e2-9324-9b635313b8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688152641, "uuid": "1c97c73e-61f7-49d5-bd75-3f09acb4cad1", "value": "1jsLRvCU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1052e0ad-1715-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688108973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108973, "uuid": "b1e96909-187a-4f58-9123-a19c25a162fe", "comment": "Malware payload (RemcosRAT)", "value": "ad755675eb984524e61ddb7baa72b14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108973, "uuid": "25b0014d-8e0b-430c-b337-2ec803454d62", "comment": "Malware payload (RemcosRAT)", "value": "f82c643baf10986a8ad197d2565b7a093aa1eef8b9d4463f4a42d3cc81a45b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108973, "uuid": "4b0bd854-c864-4f26-aa47-887831e66f7a", "comment": "Malware payload (RemcosRAT)", "value": "359c07a5267a8ea79df7aca944a3764cedf34707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108973, "uuid": "b4aa03c2-fa77-4cc1-b471-a46caa93eea1", "comment": "Malware payload (RemcosRAT)", "value": "b331ac5518257573b8f12f7fcb2e4cfcb8d7efe7a2779b29e2964aacab46a81345f9c089e145e6ec4f3dc0799facf72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108973, "uuid": "b84d1677-5a76-47f6-88bd-5c7f98404bde", "value": "T12C356B390A795D37E036F5758ED4966FF8308C7A392F49E15CB6865072029BEE4C32AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108973, "uuid": "a207751f-79e0-481d-9803-0a4aa06db1ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108973, "uuid": "3b906137-4cab-456c-a25c-fd48d49cd256", "value": "24576:hDaOX8CJxKVLm4hVll/9M6mgBa58KZFC163:bLKVvhjpsgBa51C16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108973, "uuid": "740743e2-7ac4-4454-b51c-c7bad2389c8d", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108973, "uuid": "f35e753f-55b1-4158-befd-e1a21a9048a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108973, "uuid": "9d65892d-099a-4822-a6d5-5879a3a728ce", "value": "ad755675eb984524e61ddb7baa72b14d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6911db8-1796-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688164630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164630, "uuid": "e4d53b07-ecbd-41ee-a075-2d5ab86d4d42", "comment": "Malware payload (GCleaner)", "value": "9a96b18076233d33d7a1ae5b66b77f8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164630, "uuid": "06ef764e-e399-4c44-baea-5a3d63d86893", "comment": "Malware payload (GCleaner)", "value": "f899dbc9ddc96b4579297d98cfd0a66d933d3dd61570d7c87533ddbcea6b4b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164630, "uuid": "aeb0facc-e533-4077-834a-e2aa1dd7945d", "comment": "Malware payload (GCleaner)", "value": "c7155e3609388f7a1067d4e4b66ace6f18f0d364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688164630, "uuid": "4594a08d-3489-4142-ac1d-57f89a424ec2", "comment": "Malware payload (GCleaner)", "value": "d4b645c7ea0aca0ffa7374f4d3e56043abda0508419873731d5d2a3f8218ecd97b3178b6669bfac506d1691761443baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164630, "uuid": "0852ccf4-0f63-4b14-acd8-b9e0ff345f9b", "value": "T1D2552383BA01C53EE973CA383954D9354A3BBEA51E34151A79CDB78D4AB6182C83F742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164630, "uuid": "417f569c-ccd7-45fa-8f58-0535d72d25f2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164630, "uuid": "00fac2df-6f24-41d3-b3fa-ffa2486c653a", "value": "24576:+fOyQ22tgmeIFx0lB46MHuXWmVLgfo/+DGsgu5nZXQ0tyJ81rARpJjBBp/D:+GRBHul6HuxVLBIpxVj92pvBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688164630, "uuid": "2f1bfeea-9c37-433a-bb76-1d288299c8de", "value": 1281147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688164630, "uuid": "b0c63362-f435-452e-aba4-0955076d3355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688164630, "uuid": "92aa2573-1538-498f-98df-cda3cabb0757", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb4bf28-174e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688133532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133532, "uuid": "c5beff31-3545-419c-865a-5a10e06d25f3", "comment": "Malware payload (Mirai)", "value": "5de5cda243b15929694ba37894c89440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133532, "uuid": "d132a02d-4d3c-4d80-97ee-7c1b1903c0e3", "comment": "Malware payload (Mirai)", "value": "f96b4756d9c85ea7bd9c40347f0dc4c0cd096f45890af30aaf6dcec74268abe6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133532, "uuid": "7d77137e-a87b-413f-92d3-31288e08bbe0", "comment": "Malware payload (Mirai)", "value": "e48d7e9bbc47b69886164645738fec19451e4d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688133532, "uuid": "beb86067-1ab2-4244-b6ad-cb2784bb2e64", "comment": "Malware payload (Mirai)", "value": "35e82eaeb9145523d9b56ce5c3b7084b5ef7229a60e1a84c19167e4fe8cc4f1818513f7bfebe9a5562fce753bddb89e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133532, "uuid": "3b23e1f9-e3a8-4cea-9678-989c79e1246d", "value": "T1D1732B1231280B57D4A306702D3F4AA087FEE9D125F4BA88695F9B364F36E7B5481F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133532, "uuid": "349b02ba-c013-4efa-aca6-a6874ec8a9be", "value": "1536:2XXBpz1s00PqV2NDz3fqVjLTHIFgwQp3W:2p0PqEa9LTHMQpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688133532, "uuid": "0de5eb2d-411a-4b0a-82ff-1f8b84d1f75b", "value": 74848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688133532, "uuid": "2018b9d8-48de-47e0-85b3-8cc3948b3682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688133532, "uuid": "e16e6ce1-d72e-42f6-9b9f-bdfefca9c099", "value": "5de5cda243b15929694ba37894c89440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961ca7d3-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144416, "uuid": "0d7ad9f8-dbbe-40c8-9958-b147626eacff", "comment": "Malware payload", "value": "993d1ddb30c3d72e89fd46a78c4d6719", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144416, "uuid": "94d7d747-565a-4ff4-a696-4d3f769b28cf", "comment": "Malware payload", "value": "f9bfcdf31c7326f7d89bc3acadfcb217fdba2424f2db031763d835a7ceddc9d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144416, "uuid": "403a2822-695d-44a3-a01f-b11705aa9450", "comment": "Malware payload", "value": "285ed4aed68880568549460456839e06572b00cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144416, "uuid": "6058d189-d982-494a-87e2-165b776ce597", "comment": "Malware payload", "value": "566226e56f3be4663faf1ddc734644dbd9b08af07f82161064a4cf4b39e7fca347b6bf58040d13b1461e7f5de64a9ce2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144416, "uuid": "deab6554-4055-4339-ba58-9388e20411ac", "value": "T1AC646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144416, "uuid": "cf6013c5-056e-4971-9aa7-b47f0ba1210d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144416, "uuid": "9a0846e4-d5ac-4598-b7d6-24fc1a013c6c", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144416, "uuid": "325f53c1-366c-4bc5-b1a0-40e69559e477", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144416, "uuid": "94ca03f9-7ee9-4c0e-9000-c90725a0b7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144416, "uuid": "09691b09-69f1-42ca-a297-5254509996be", "value": "21loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c8b68d-1750-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688134515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134515, "uuid": "aaccb542-a8db-4284-a9d7-a267e19f408c", "comment": "Malware payload (Stealc)", "value": "05270be6cdef9df3f9d5c9919599ac30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134515, "uuid": "09e2fdde-b6e7-4a47-8c34-ee96cde1928c", "comment": "Malware payload (Stealc)", "value": "f9c0b902d916f689dcf93a3557640741826483e3c2c3139a02605a5ec0546b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134515, "uuid": "dbcc4d3a-02d9-425e-acf8-38d0f0d1837a", "comment": "Malware payload (Stealc)", "value": "e8deef7d2d5d62a9e3e17f45508d465cabf607ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688134515, "uuid": "1fd22eb4-9fe5-4c81-b60d-bb3278b4902e", "comment": "Malware payload (Stealc)", "value": "55a8f32d435d650556f25e6eefc05d161b1bab5660c8292d9351b6b5570df838424833c50c9c817c4045741198b9d504", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134515, "uuid": "1c9c3d07-4eaf-4806-9a12-fc988f8d5779", "value": "T19AC6335277E42150C2E7037182F515879374B9BA833227BF13EAC8355BB2F5026B67AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134515, "uuid": "f1da84cb-bca5-4401-97e2-0687d907b5d9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134515, "uuid": "edccea75-a47c-4b5f-8f79-896b4534e496", "value": "196608:WXk6cYbWJrBfhAEwjDLLKU2NCETLKrJSnMzDOhFQDdLLwXg5+gqyQj1d:W0IMrijX+LqAsaFQBA++gq/j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688134515, "uuid": "120bdc70-3467-4841-8c00-08a6bb4bd77e", "value": 11816448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688134515, "uuid": "8f31711e-2151-448c-8a84-3e849c8d08ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688134515, "uuid": "e6555a22-934e-4e36-8aa8-dcd7c44edf58", "value": "ortrainingie64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1401a9-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144885, "uuid": "085caaef-0875-40cf-982d-c8f1f7766239", "comment": "Malware payload", "value": "d026b5924dc28a0fd17df7985af495ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144885, "uuid": "9348c813-4b55-45da-83ad-240a214c4621", "comment": "Malware payload", "value": "f9d2f019c59d68de425d97f506dadab15b1571cd6b133b0f134f80f574395219", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144885, "uuid": "039b16c4-6099-460a-886d-3caf744911a6", "comment": "Malware payload", "value": "3ae9a525a059b1d4b85e0a803048ea3ef5bd0a09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144885, "uuid": "c1983cce-d8b1-4032-bddf-b87b9f46c18e", "comment": "Malware payload", "value": "b5fee6b0888b4aefeb1f8b83f7ce53509303ac0883817fc85e8f4b2eb5ba37618ffb73277d1092548948af5737207e98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144885, "uuid": "9ae0721e-bb18-4718-9e4e-4d9f55c7dc81", "value": "T1F8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144885, "uuid": "b802f096-a93e-499c-8aad-c0ad4fe1ec76", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144885, "uuid": "5c995e05-f753-4c9e-ac23-48c7865fc1e5", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144885, "uuid": "841c6abe-53c8-4ecb-ae40-ce9ee5fb0a29", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144885, "uuid": "fe959a46-9f22-45c4-8927-4677a6c3c178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144885, "uuid": "59f256ef-9582-498f-9970-d2c2d2e3a02f", "value": "80loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0d4caa-1767-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144558, "uuid": "1b3fe7cc-c4b9-49bd-8043-c4df1d58b19a", "comment": "Malware payload", "value": "8ccd615c0caaf1da83db1f2375884377", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144558, "uuid": "4d36c1a4-34b6-42e5-bd72-6f7ad5c64587", "comment": "Malware payload", "value": "fa422ae3abcab91ab0a94ee0579314871a0d917d981a5d85499e047e97a86ac2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144558, "uuid": "a7a0bc58-8546-4c8b-9da6-2daa506cbf72", "comment": "Malware payload", "value": "fc1e7b57ad8792dd0f23ad2a721117e635a9981b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144558, "uuid": "685364d9-de9e-4037-961e-fd0a33c6b324", "comment": "Malware payload", "value": "3b26e8c606e9c28ccbecdc383d6af1b093deb7225da9f90f4682d94ff71cff7ed5552681b5440fd73858e5f3a6901192", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144558, "uuid": "7ba38878-3ba0-4f7a-87f3-dce9eacc3092", "value": "T19D646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144558, "uuid": "dbfe75e9-e4e1-4b72-b46d-f7dd900ccc5d", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144558, "uuid": "aeb452f4-bd3c-4d69-a152-4ce6946a8712", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144558, "uuid": "4cee8145-3b4f-4217-9ba0-b5b1f7d3e4f9", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144558, "uuid": "e1394557-b18b-4fb7-9b15-8187fbee46ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144558, "uuid": "a58fcbac-7b4e-4f01-a647-8d3855501059", "value": "40loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d751578e-1720-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688114031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114031, "uuid": "f259d3c3-ec87-4209-b654-ef013006300b", "comment": "Malware payload", "value": "c23e04416a7ff16b09ca718d19a1086f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114031, "uuid": "b7022eba-70b6-4dc8-a4b2-76eddc50f011", "comment": "Malware payload", "value": "fafa6b45c6684020d513319282c54e48547a56555c31ac7340a5c68dd1e56167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114031, "uuid": "153c5a30-ff9c-44b3-9cdd-bb3c7d379731", "comment": "Malware payload", "value": "98e5afbb3d4623266f5681be3560219931a071be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688114031, "uuid": "fabaa82f-c282-4cec-8933-7fae00407d02", "comment": "Malware payload", "value": "3301bbcd4805da1fb3a1e167726744b575293f127b4e5929fb5ac3d8ba30e8846202e4d8df16a522614f5b204b542521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114031, "uuid": "a415ab30-7af3-4cb7-9ce7-035ed5cac4fc", "value": "T12244D672755847CAE15A32F1E85650904AF22C2AC1C6CA4EA0F53E7F76B2703CD5ED2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114031, "uuid": "8de0c7e9-3083-4d7b-baec-cc376ef14458", "value": "3072:va1xyMdp43Af6AgaoY11H/3yrEvD9qE29eIP6JqPOEvD9qE29eIP6JqPmv6v3:va1TprmG3yrEZ4e1EZ4e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688114031, "uuid": "b798e269-2037-4376-b699-3bed6becc22e", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688114031, "uuid": "c07fba5f-c0de-4870-9dcd-11989e3b15ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688114031, "uuid": "b29df9ab-29dd-4419-80e7-ec5ca97195df", "value": "SecuriteInfo.com.Win64.PWSX-gen.19048.30929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbf07fa-1761-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688142016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142016, "uuid": "bb8882d9-4825-457f-9d09-a4b8f71be950", "comment": "Malware payload", "value": "00285e5b5015446bf2f5ae3db5216328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142016, "uuid": "70f1f333-4a1a-472b-9f25-2bf94ace014e", "comment": "Malware payload", "value": "fb52d04d3776ae601665d32951258df6743886f9d169ba47a76ce0c6e9646f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142016, "uuid": "1fc1e77d-5222-4db4-acc6-56c6ce37e0a5", "comment": "Malware payload", "value": "f2fdcbb5f27d267382756540968e3e2d408b9496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688142016, "uuid": "585b2a24-c811-4a6e-8a83-316c89e646e4", "comment": "Malware payload", "value": "8b73e27d266b03b8f0a8813a9e2525df6985e5bfae1504d06706025c8c7b2c95dc7fdaeb080e952cb561993895cf2a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142016, "uuid": "3111910a-dd33-4e29-a27c-5e523d0b36db", "value": "T10DE64A07F89191E5C0BED170CA369262FA303C485F3167D73A64FAB92B32BD85A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142016, "uuid": "6da5a943-ab02-433d-82c6-a3730ca170df", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142016, "uuid": "16240c7b-fbd9-47d1-af79-1408893b4574", "value": "98304:RB5kmoJMGpRYtwSc3MpxEX/4XFLaUFsYy3:RLkhJ5pRlBMgAXFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688142016, "uuid": "97ecbab6-03ae-490d-81b2-84530cae6169", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688142016, "uuid": "845e15c7-a4f0-46b9-bf64-9aa6832159ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688142016, "uuid": "51d1a52f-5f4d-4c8c-a5b7-a2f095fed63f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cde32f-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688135792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135792, "uuid": "e3898ea8-8938-46c4-a487-ce2ec2503614", "comment": "Malware payload", "value": "a6a658f0f5c8c1d3c6285d83cfaf51cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135792, "uuid": "f3ffb536-00e6-4dd1-b9b9-d5ea9b4e504a", "comment": "Malware payload", "value": "fb53c6705b5e089dd49bb91bc4c63c63316cdf85b8562354c1981f12889c66c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135792, "uuid": "b290181d-2e45-472d-96fa-0e134da58ed9", "comment": "Malware payload", "value": "339769f21e0a428cd179148cd2a14d40faf612cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135792, "uuid": "f6f9d0fc-4a9b-44cb-a5b9-7ed08938e670", "comment": "Malware payload", "value": "163efe3ad96e68ba8b99617685bb5efd43fe76e4943a2748a2e9001423102cf3ce35e8f9db5b10438dbc35c866715bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135792, "uuid": "54909809-185f-4a26-b058-bf4c405823f5", "value": "T12AA57C327781C076D15A21360892AAE872E9BE345FA467C377903B5E6B319F3DD39309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135792, "uuid": "c76a1ecc-9ca1-499f-8587-a6c8dd24c63f", "value": "142eb48c0de0c149e942f294a16a60e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135792, "uuid": "a34d386d-b268-47ad-aa98-6e37e0571b58", "value": "24576:JUbWNIqk+IbErfDVZnvJbDtxvjGqcJ8TOXwwZwJiP8zPMMLD+Hy4C:dNE+IbUvvJ3UKSXwwysP8zPBDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135792, "uuid": "a6c3a0f8-9567-4257-9ea5-0b731084868a", "value": 2125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135792, "uuid": "5e1892fa-4208-41d5-a57a-7633904fbbd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135792, "uuid": "3171e858-1162-49c6-aae7-f3484ec72410", "value": "\u6d59\u5927\u62db\u751f\u7b80\u7ae0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413c15d-1753-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1688135661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135661, "uuid": "e6c5064a-214d-470a-b708-a7c53d0bb5f3", "comment": "Malware payload (Adware.Techsnab)", "value": "b672ffd7d21f78ab6e1aaca2d768ea45", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135661, "uuid": "c9a695c2-e82d-4764-87a0-d9248bfb1c29", "comment": "Malware payload (Adware.Techsnab)", "value": "fb57cac696e24c505a392895dc3fe4ae001afc03b9f9ceae0d7ed40c5f999548", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135661, "uuid": "e41b14f5-94d8-44cc-88cb-b99823cb9d15", "comment": "Malware payload (Adware.Techsnab)", "value": "c0d6df27f6757b1b443915abdafc6a20ff0d7c3e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688135661, "uuid": "a2f36c39-a3ef-4552-a7bf-0899d5633327", "comment": "Malware payload (Adware.Techsnab)", "value": "df354af3cd15e95972580a63ad334904e7e080a691bcb10ab4310e2988b8714bc1ba52f545c1534602c14bf399f3b708", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135661, "uuid": "fdf4c1bb-0118-4651-957d-a01db33c24da", "value": "T11BA64B43BD45C4BCD2ADD070C661D7327A62BCA45B3053CB2652F6BEAA72BD42AF5700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135661, "uuid": "9c181b7c-0d05-44e6-a336-0f634a9a7355", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135661, "uuid": "f2ef870c-8549-4c0a-b8a7-5512730cf09d", "value": "98304:j09J8Jr5xLHygh4YolijgrUuPR8SfwVG/haEKT4OiZrq1DfPHNADtV6v++Xh:j287xj4FfRbM4O7NADtV6v+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688135661, "uuid": "fe380d5b-17f0-4756-8a08-45d6598fd373", "value": 9668528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688135661, "uuid": "b663085d-bb86-4aa6-9410-c905f3132db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688135661, "uuid": "b783af87-8e5e-4ba2-823e-a6ab9b3b9f4f", "value": "macchina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d695fe4-1713-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1688108270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108270, "uuid": "10b8dcf8-88e5-4aff-8c5d-9614eddf32c1", "comment": "Malware payload (Lu0Bot)", "value": "6181206d06ce28c1bcdb887e547193fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108270, "uuid": "3266dc1f-bda8-48c7-8679-0006badbf804", "comment": "Malware payload (Lu0Bot)", "value": "fb808be98b583a2004b0af7b6f4bf5e3419d8b6a385c5ce4e8fab4ddc0b48428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108270, "uuid": "de3cfa91-d724-4b34-9af2-b520e1badb4e", "comment": "Malware payload (Lu0Bot)", "value": "8eb65b4895a90d343f23f9228e0d53af62de3dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688108270, "uuid": "066ca85a-1753-4e32-86eb-1d38496beb38", "comment": "Malware payload (Lu0Bot)", "value": "19eef8d555dc7ef79ed6c828020cff06d509bc24e40cceba85013e8f47bd4adbce6ea3c6eeba01e3b8441238267d44ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108270, "uuid": "27612c62-336b-4795-9e6f-d556f59cc714", "value": "T1EAC53365CDDC5E73C9B127392DE442A716367EB1CF84039B2302548FADA2AD0A5337B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108270, "uuid": "ba630431-c333-483c-8889-56b398d6fa12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108270, "uuid": "8bec4848-7c26-4678-86d9-d305400f0606", "value": "49152:5qVMAWRywiN7AqzGKWPy3tsdWT69leSkFAaGjv616zzU45tZevvDnZjlE/X4HOoA:QKo5czXmidWn1FOz6cgsSvvljEouH9Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688108270, "uuid": "8135d61e-7862-4c3c-b2e1-777b7d245a3f", "value": 2658263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688108270, "uuid": "74ad62a5-d4d9-4687-aa89-99cd0fbdf919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688108270, "uuid": "0fdafa48-846f-436a-9686-37997bef7f69", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f66bb12-1756-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688137076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137076, "uuid": "599d2620-62c2-4c25-931e-d2f980741eb9", "comment": "Malware payload", "value": "4f4ede05478450539037ffa86f88a68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137076, "uuid": "b45a7249-e593-47da-81d2-6d855e3e093c", "comment": "Malware payload", "value": "fc372a2941ceaebf8988abfa8ffaee141918c6a1a1849d95896d1e474c961395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137076, "uuid": "bccf50a0-a8f2-4756-8f5b-694e7532645f", "comment": "Malware payload", "value": "1bfc06b7c636da5e07ad3813b7822b04efe92a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688137076, "uuid": "8c2642e8-9877-4cc5-bd50-029c7bc76a71", "comment": "Malware payload", "value": "fb13d5621ea015d592e710dd7e6c5816cf062ad5b5fde30ef66ee7249b0e9184c2e8e5d03290ad32295c33a5464cf056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137076, "uuid": "d43d1e12-d9cb-48d0-aa30-081dc31c56eb", "value": "T1AA551202B9C648B3C56318335A786F20593DBD602F69CEDB67D07A6ED9315C0EB317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137076, "uuid": "88ac4f4f-8dae-4b71-814a-af2a290186e8", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137076, "uuid": "eeefec26-3f4d-4227-b7fb-2b15e9145773", "value": "24576:2TbBv5rUyXVcEAZzF45zhPEIhBKuTYzimMTlKO0qLMmbn0:IBJctgBhc6Kus+9gO0qn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688137076, "uuid": "b8d071c2-461a-4789-b0cf-984700f8c852", "value": 1286167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688137076, "uuid": "0e29f448-2c4f-46ed-b610-d984ba236be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688137076, "uuid": "0e277c2e-7dcb-45ad-9712-887ce4a7331c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ff9a56-1768-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688144959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144959, "uuid": "336486ca-87a2-4bfd-81f7-9c7a7ec5d579", "comment": "Malware payload", "value": "889ee66f03e6e7aeb1363ab7aaee7323", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144959, "uuid": "c4e3534a-e12f-4bb0-bf88-2a0d1069dcc5", "comment": "Malware payload", "value": "fe8c2905e581ebf66bf930588528931fbed927d201da526e57ac355720221650", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144959, "uuid": "06e5722e-1dae-47b1-bd64-b0b67318cb48", "comment": "Malware payload", "value": "8d451499c7811b93664eb8239f85e3e6f070e18b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688144959, "uuid": "536d5cea-64f3-4fb4-a3ab-94258629e3f0", "comment": "Malware payload", "value": "6e482b31ae5a5751ff9cfbb81e642fa326ace690e45564c7703509ff3e7ac4431929d84c6b83a116ffb34001034b98c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144959, "uuid": "e33bfbf2-59f7-413c-892f-917ee8e310b6", "value": "T11F646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144959, "uuid": "3f272a21-34d5-43e9-823d-1ee75bf42ebf", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144959, "uuid": "55cf8f5d-ec35-482f-baab-d2c6a280ef5a", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m:5xb8ZqekwkJPaThgyDChXohRRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688144959, "uuid": "0eb4a1c2-06e4-46fe-8355-d7616addeb61", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688144959, "uuid": "b3dcafdd-67b3-4a7f-85b2-0bb7f3e2e6af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688144959, "uuid": "970947bb-dd7c-4124-98f1-e0b2cb3e9311", "value": "93loader_p1_dll_64_n1_x64_inf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bf6e96-177e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688154372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154372, "uuid": "c4c436a7-0e44-422a-8175-467853e55c70", "comment": "Malware payload", "value": "eeba187c5fbc9ff6d9c788b283474fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154372, "uuid": "73f0422d-38c6-4946-b2de-19d7c0f77522", "comment": "Malware payload", "value": "ff798644ff6069f55ec7c83e8f7d2423cb6f345118d1e5cd18556475ba892fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154372, "uuid": "74aa8ba0-7a2c-440c-a741-3e1b04f92c13", "comment": "Malware payload", "value": "b633bb69584245a13844b8ef28e758df0a01af65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688154372, "uuid": "045b60c5-4ef5-4062-a1a3-5496d8435731", "comment": "Malware payload", "value": "4eaa5994a9958cfcea47b59f263f422b92e74f31b4da44d4afea9f71db4beaa964806243c012957b5475b41aa91c3f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154372, "uuid": "e44305d3-87aa-4104-98e9-d47f9faddc98", "value": "T108E6338A82D84196E0FD17B0749B65B3E73AB8517F2D52FB1A70EE8D0850681E17CF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154372, "uuid": "8c964fa3-4941-4295-802f-07a459bc0b54", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154372, "uuid": "8d3c50d8-ce2f-477a-a981-0ed821332834", "value": "196608:rpG2Sl0SKTnzRGnedvTl1n8eeRG6JwkRTNe25j+L8+1cvUKh2pNNXrMy:9G2SkEnOTlOlRG011c8+Erh2HNXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688154372, "uuid": "e9850d3c-9569-433c-b818-30b2a731a04f", "value": 13990400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688154372, "uuid": "f3251edd-8f2d-4203-a78b-4f3a532f8ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688154372, "uuid": "a3482d5b-fb75-4ced-9a5d-35323aa1b4bd", "value": "SecuriteInfo.com.Trojan.Generic.33998779.5541.31564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }